package auth

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"gitea.perlbach24.de/scripte/nexarch/internal/user"
)

func TestProfileMe_ReturnsOwnData(t *testing.T) {
	pool := setupTenantDB(t, "profile_test_me")
	store := user.NewTenantUserStore(pool)
	u := createUserWithPassword(t, store, "profil@example.com", "irgendein-passwort")

	issuer := NewTokenIssuer("test-session-secret")
	sessionToken, err := issuer.Issue(u.ID, "acme")
	if err != nil {
		t.Fatalf("session-token ausstellen: %v", err)
	}

	h := NewProfileHandler(store)
	req := httptest.NewRequest(http.MethodGet, "/account/me", nil)
	req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionToken})
	rec := httptest.NewRecorder()

	RequireAuth(issuer, h.Me)(rec, req)

	if rec.Code != http.StatusOK {
		t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
	}
}

func TestProfileMe_RejectsWithoutSession(t *testing.T) {
	pool := setupTenantDB(t, "profile_test_noauth")
	store := user.NewTenantUserStore(pool)

	issuer := NewTokenIssuer("test-session-secret")
	h := NewProfileHandler(store)
	req := httptest.NewRequest(http.MethodGet, "/account/me", nil)
	rec := httptest.NewRecorder()

	RequireAuth(issuer, h.Me)(rec, req)

	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("status = %d, want 401 ohne session-cookie", rec.Code)
	}
}