package identity

import (
	"bytes"
	"io"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"yovision.local/sense/internal/platform"
)

func TestHTTPLoginCookieAndProductBoundary(t *testing.T) {
	store := NewMemoryStore()
	cfg := Config{SigningKey: []byte("0123456789abcdef0123456789abcdef"), BootstrapToken: "bootstrap-test", SessionTTL: time.Hour}
	service, err := NewService(store, cfg)
	if err != nil {
		t.Fatal(err)
	}
	app := platform.NewApp(platform.Config{DatabaseMode: platform.DatabaseModeMemory}, nil, slog.New(slog.NewTextHandler(io.Discard, nil)))
	NewModule(service, cfg).Register(app)

	bootstrap := httptest.NewRequest(http.MethodPost, "/api/v1/identity/bootstrap", bytes.NewBufferString(`{"username":"admin","display_name":"管理员","password":"StrongPass2026"}`))
	bootstrap.Header.Set("X-Sense-Bootstrap-Token", "bootstrap-test")
	bootstrapResult := httptest.NewRecorder()
	app.Handler().ServeHTTP(bootstrapResult, bootstrap)
	if bootstrapResult.Code != http.StatusCreated {
		t.Fatalf("bootstrap status = %d, body = %s", bootstrapResult.Code, bootstrapResult.Body.String())
	}

	login := httptest.NewRequest(http.MethodPost, "/api/v1/identity/login", bytes.NewBufferString(`{"username":"admin","password":"StrongPass2026"}`))
	loginResult := httptest.NewRecorder()
	app.Handler().ServeHTTP(loginResult, login)
	if loginResult.Code != http.StatusOK {
		t.Fatalf("login status = %d, body = %s", loginResult.Code, loginResult.Body.String())
	}
	cookies := loginResult.Result().Cookies()
	if len(cookies) != 1 || cookies[0].Name != sessionCookieName || !cookies[0].HttpOnly || cookies[0].SameSite != http.SameSiteStrictMode {
		t.Fatalf("unexpected session cookies: %#v", cookies)
	}

	me := httptest.NewRequest(http.MethodGet, "/api/v1/identity/me", nil)
	me.AddCookie(cookies[0])
	me.Header.Set("X-Product", "bell")
	foreignResult := httptest.NewRecorder()
	app.Handler().ServeHTTP(foreignResult, me)
	if foreignResult.Code != http.StatusUnauthorized {
		t.Fatalf("Bell product header status = %d", foreignResult.Code)
	}

	me.Header.Set("X-Product", "sense")
	senseResult := httptest.NewRecorder()
	app.Handler().ServeHTTP(senseResult, me)
	if senseResult.Code != http.StatusOK {
		t.Fatalf("Sense product header status = %d", senseResult.Code)
	}
}