package bm_test

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	userclasses "git.golem15.com/golem15/sm-user-plugin/classes"
	"git.golem15.com/golem15/summercms/modules/surf"
)

func TestManagementAPIUsesSharedTokenAndCurrentUserPermissions(t *testing.T) {
	app, plugins, db := migrated(t)

	var userID uint
	if err := db.Raw(`
INSERT INTO users (email, password, must_change_password)
VALUES ('bm-shared-token@example.test', '', false)
RETURNING id`).Scan(&userID).Error; err != nil {
		t.Fatal(err)
	}
	var groupID uint
	if err := db.Raw(`
INSERT INTO user_groups (name, code, permissions, created_at, updated_at)
VALUES ('BM API', 'bm-api', '{"jz.bm.access_courses":1}', NOW(), NOW())
RETURNING id`).Scan(&groupID).Error; err != nil {
		t.Fatal(err)
	}
	if err := db.Exec(`INSERT INTO users_groups (user_id, user_group_id) VALUES (?, ?)`, userID, groupID).Error; err != nil {
		t.Fatal(err)
	}
	secret, token, err := userclasses.MintAPIToken("usr_", userID, "BM integration", []string{"read"}, nil, nil)
	if err != nil {
		t.Fatal(err)
	}
	if err := db.Create(token).Error; err != nil {
		t.Fatal(err)
	}

	handler, err := surf.Assemble(app, plugins)
	if err != nil {
		t.Fatal(err)
	}
	request := func(path string) *httptest.ResponseRecorder {
		req := httptest.NewRequest(http.MethodGet, path, nil)
		req.Header.Set("Authorization", "Bearer "+secret)
		rec := httptest.NewRecorder()
		handler.ServeHTTP(rec, req)
		return rec
	}

	if rec := request("/api/v1/bm/courses"); rec.Code != http.StatusOK {
		t.Fatalf("permitted courses request = %d %s", rec.Code, rec.Body.String())
	}
	if rec := request("/api/v1/bm/materials"); rec.Code != http.StatusForbidden {
		t.Fatalf("ungranted materials request = %d %s", rec.Code, rec.Body.String())
	}
	if err := db.Model(&struct{}{}).Table("user_groups").Where("id = ?", groupID).Update("permissions", `{}`).Error; err != nil {
		t.Fatal(err)
	}
	if rec := request("/api/v1/bm/courses"); rec.Code != http.StatusForbidden || !strings.Contains(rec.Body.String(), "Forbidden") {
		t.Fatalf("request after permission revocation = %d %s", rec.Code, rec.Body.String())
	}
}