package cabana_test

import (
	"errors"
	"fmt"
	"net/http"
	"net/http/httptest"

	"git.golem15.com/golem15/summercms/modules/backpack"
	"git.golem15.com/golem15/summercms/modules/cabana"
)

// ExampleResolveBackend shows a plugin handler that accepts an admin JWT or
// personal API token through cabana.ResolveBackend. The resolver reads only
// the Authorization Bearer header (never the admin cookie).
func ExampleResolveBackend() {
	handler := func(app *backpack.App, w http.ResponseWriter, r *http.Request) {
		_, _, err := cabana.ResolveBackend(app, r, "acme.blog.*")
		if err != nil {
			if errors.Is(err, cabana.ErrTokenScope) {
				w.Header().Set("Content-Type", "application/json")
				w.WriteHeader(http.StatusForbidden)
				fmt.Fprint(w, `{"error":"Insufficient permissions"}`)
				return
			}
			w.Header().Set("Content-Type", "application/json")
			w.WriteHeader(http.StatusUnauthorized)
			fmt.Fprint(w, `{"error":"Authentication required"}`)
			return
		}
		w.WriteHeader(http.StatusOK)
	}

	rec := httptest.NewRecorder()
	r := httptest.NewRequest(http.MethodPost, "/_blog/api/v1/posts", nil)
	r.Header.Set("Authorization", "Bearer unused")
	handler(nil, rec, r)
	fmt.Println(rec.Code, rec.Body.String())
	// Output:
	// 401 {"error":"Authentication required"}
}