package forwarder

import (
	"io"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/require"

	"github.com/tidbcloud/AgentTeam/internal/api"
	"github.com/tidbcloud/AgentTeam/internal/store/identity"
	"github.com/tidbcloud/AgentTeam/internal/store/model"
	"github.com/tidbcloud/AgentTeam/internal/store/workspace"
)

func TestAutomationForwarderRequiresMeshXGate(t *testing.T) {
	gin.SetMode(gin.ReleaseMode)

	var upstreamHits int
	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		upstreamHits++
		w.WriteHeader(http.StatusNoContent)
	}))
	defer upstream.Close()

	router := gin.New()
	RegisterRoutes(router, Dependencies{
		AuthStore:      fakeAuthStore{authenticated: identity.AuthenticatedUser{User: model.User{ID: "usr_1"}}},
		WorkspaceStore: fakeWorkspaceStore{workspace: workspace.Summary{WorkspaceID: "wsp_1", WorkspaceRole: "member"}},
		BaseURL:        upstream.URL,
		MeshXEnabled:   false,
	})
	server := httptest.NewServer(router)
	defer server.Close()

	request, err := http.NewRequest(http.MethodGet, server.URL+expectedWorkspacePath("/api/v1/automations/runs"), nil)
	require.NoError(t, err)
	request.Header.Set("Authorization", "Bearer agentteam-session")
	request.Header.Set(api.HeaderWorkspaceID, "wsp_1")
	response, err := server.Client().Do(request)
	require.NoError(t, err)
	defer response.Body.Close()
	body, _ := io.ReadAll(response.Body)
	require.Equal(t, http.StatusForbidden, response.StatusCode, string(body))
	require.Contains(t, string(body), `"code":"meshx_gate_required"`)
	require.Zero(t, upstreamHits)
}

func TestRoleForwarderRequiresMeshXGate(t *testing.T) {
	gin.SetMode(gin.ReleaseMode)

	var upstreamHits int
	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		upstreamHits++
		w.WriteHeader(http.StatusNoContent)
	}))
	defer upstream.Close()

	router := gin.New()
	RegisterRoutes(router, Dependencies{
		AuthStore:      fakeAuthStore{authenticated: identity.AuthenticatedUser{User: model.User{ID: "usr_1"}}},
		WorkspaceStore: fakeWorkspaceStore{workspace: workspace.Summary{WorkspaceID: "wsp_1", WorkspaceRole: "member"}},
		BaseURL:        upstream.URL,
		MeshXEnabled:   false,
	})
	server := httptest.NewServer(router)
	defer server.Close()

	request, err := http.NewRequest(http.MethodGet, server.URL+expectedWorkspacePath("/api/v1/roles/presets"), nil)
	require.NoError(t, err)
	request.Header.Set("Authorization", "Bearer agentteam-session")
	request.Header.Set(api.HeaderWorkspaceID, "wsp_1")
	response, err := server.Client().Do(request)
	require.NoError(t, err)
	defer response.Body.Close()
	body, _ := io.ReadAll(response.Body)
	require.Equal(t, http.StatusForbidden, response.StatusCode, string(body))
	require.Contains(t, string(body), `"code":"meshx_gate_required"`)
	require.Zero(t, upstreamHits)
}