package liveview

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"github.com/gin-gonic/gin"
)

func TestPlayerUsesShortLivedCapabilityAndRestrictiveHeaders(t *testing.T) {
	gin.SetMode(gin.TestMode)
	store := NewStore()
	now := time.Date(2026, 8, 14, 10, 0, 0, 0, time.UTC)
	store.now = func() time.Time { return now }
	previous := defaultStore
	defaultStore = store
	t.Cleanup(func() { defaultStore = previous })
	store.put(sessionRecord{ID: "view_test", OwnerID: 7, RouteID: "route-1", TargetURL: "http://127.0.0.1:8889/sense_test?controls=true", ExpiresAt: now.Add(sessionTTL)})

	router := gin.New()
	api := &API{}
	router.GET("/api/v1/liveview/player/:id", api.Player)
	recorder := httptest.NewRecorder()
	router.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/api/v1/liveview/player/view_test", nil))
	if recorder.Code != http.StatusOK || recorder.Header().Get("Cache-Control") != "no-store" || recorder.Header().Get("X-Frame-Options") != "SAMEORIGIN" {
		t.Fatalf("status=%d headers=%v", recorder.Code, recorder.Header())
	}
	if !strings.Contains(recorder.Body.String(), "http://127.0.0.1:8889/sense_test?controls=true") || !strings.Contains(recorder.Header().Get("Content-Security-Policy"), "frame-ancestors 'self'") {
		t.Fatalf("unexpected wrapper response: %s", recorder.Body.String())
	}

	now = now.Add(sessionTTL)
	expired := httptest.NewRecorder()
	router.ServeHTTP(expired, httptest.NewRequest(http.MethodGet, "/api/v1/liveview/player/view_test", nil))
	if expired.Code != http.StatusGone {
		t.Fatalf("expired capability status=%d", expired.Code)
	}
}