package handler

import (
	"net/http/httptest"
	"reflect"
	"strings"
	"testing"

	"github.com/gin-gonic/gin"
)

func TestLoginAcceptsCredentialsWithoutCaptcha(t *testing.T) {
	gin.SetMode(gin.TestMode)
	ctx, _ := gin.CreateTestContext(httptest.NewRecorder())
	ctx.Request = httptest.NewRequest("POST", "/api/v1/login", strings.NewReader(`{"username":"operator","password":"valid-password"}`))
	ctx.Request.Header.Set("Content-Type", "application/json")

	var login Login
	if err := ctx.ShouldBindJSON(&login); err != nil {
		t.Fatalf("bind credentials-only login: %v", err)
	}
	if login.Username != "operator" || login.Password != "valid-password" {
		t.Fatalf("unexpected login payload: username=%q", login.Username)
	}

	typeOfLogin := reflect.TypeOf(login)
	if typeOfLogin.NumField() != 2 {
		t.Fatalf("login payload must only expose username and password, got %d fields", typeOfLogin.NumField())
	}
	for _, removed := range []string{"Code", "UUID"} {
		if _, ok := typeOfLogin.FieldByName(removed); ok {
			t.Fatalf("captcha field %s must not be part of the login payload", removed)
		}
	}
}