package forwarder

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/require"

	"github.com/tidbcloud/AgentTeam/internal/api"
	"github.com/tidbcloud/AgentTeam/internal/store/identity"
	"github.com/tidbcloud/AgentTeam/internal/store/model"
	"github.com/tidbcloud/AgentTeam/internal/store/workspace"
)

func TestForwarderMeshXTrustedJWTUsesAutomationWildcardForAdmins(t *testing.T) {
	gin.SetMode(gin.ReleaseMode)

	var seenAuthorization string
	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		seenAuthorization = r.Header.Get("Authorization")
		w.WriteHeader(http.StatusNoContent)
	}))
	defer upstream.Close()

	router := gin.New()
	RegisterRoutes(router, Dependencies{
		AuthStore:      fakeAuthStore{authenticated: identity.AuthenticatedUser{User: model.User{ID: "usr_1"}}},
		WorkspaceStore: fakeWorkspaceStore{workspace: workspace.Summary{WorkspaceID: "wsp_1", WorkspaceRole: "admin"}},
		BaseURL:        upstream.URL,
		MeshXEnabled:   true,
	})
	server := httptest.NewServer(router)
	defer server.Close()

	request, err := http.NewRequest(http.MethodGet, server.URL+expectedWorkspacePath("/api/v1/automations/repositories/pingcap/agentteam/secrets"), nil)
	require.NoError(t, err)
	request.Header.Set("Authorization", "Bearer agentteam-session")
	request.Header.Set(api.HeaderWorkspaceID, "wsp_1")
	response, err := server.Client().Do(request)
	require.NoError(t, err)
	defer response.Body.Close()

	require.Equal(t, http.StatusNoContent, response.StatusCode)
	claims := decodeClaims(t, strings.TrimPrefix(seenAuthorization, "Bearer "))
	require.ElementsMatch(t, []any{"wsp_1"}, claims["workspace_ids"])
	require.ElementsMatch(t, []any{"automation:*"}, claims["automation_permissions"])
}