package auth

import (
	"database/sql"
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"testing"

	"git.noroutes.net/NoRoutes/vibetunes/internal/database"
)

func openTestDB(t *testing.T) *sql.DB {
	t.Helper()
	db, err := database.Open(filepath.Join(t.TempDir(), "test.db"))
	if err != nil {
		t.Fatalf("database.Open: %v", err)
	}
	t.Cleanup(func() { db.Close() })
	return db
}

func TestSessionIssueAndCurrentUser(t *testing.T) {
	db := openTestDB(t)
	user, err := database.CreateUser(db, "alice", "alice@example.com", "", false)
	if err != nil {
		t.Fatalf("CreateUser: %v", err)
	}

	sessions := &Sessions{DB: db, CookieSecure: false}
	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	if err := sessions.Issue(rec, req, user.ID); err != nil {
		t.Fatalf("Issue: %v", err)
	}

	req2 := httptest.NewRequest(http.MethodGet, "/", nil)
	for _, c := range rec.Result().Cookies() {
		req2.AddCookie(c)
	}
	got := sessions.CurrentUser(req2)
	if got == nil || got.ID != user.ID {
		t.Fatalf("CurrentUser = %v, want %s", got, user.ID)
	}
}

func TestSessionClearRevokesCookie(t *testing.T) {
	db := openTestDB(t)
	user, err := database.CreateUser(db, "bob", "", "", false)
	if err != nil {
		t.Fatalf("CreateUser: %v", err)
	}
	sessions := &Sessions{DB: db, CookieSecure: false}
	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	if err := sessions.Issue(rec, req, user.ID); err != nil {
		t.Fatalf("Issue: %v", err)
	}
	var cookies []*http.Cookie
	for _, c := range rec.Result().Cookies() {
		cookies = append(cookies, c)
	}

	logoutReq := httptest.NewRequest(http.MethodPost, "/logout", nil)
	for _, c := range cookies {
		logoutReq.AddCookie(c)
	}
	logoutRec := httptest.NewRecorder()
	sessions.Clear(logoutRec, logoutReq)

	req2 := httptest.NewRequest(http.MethodGet, "/", nil)
	for _, c := range cookies {
		req2.AddCookie(c)
	}
	if got := sessions.CurrentUser(req2); got != nil {
		t.Fatalf("CurrentUser after Clear = %v, want nil", got)
	}
}

func TestSessionRejectsUnknownCookie(t *testing.T) {
	db := openTestDB(t)
	sessions := &Sessions{DB: db, CookieSecure: false}
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.AddCookie(&http.Cookie{Name: SessionCookieName, Value: "does-not-exist"})
	if got := sessions.CurrentUser(req); got != nil {
		t.Fatalf("CurrentUser = %v, want nil for unknown session", got)
	}
}

func TestSessionRejectsDisabledUser(t *testing.T) {
	db := openTestDB(t)
	user, err := database.CreateUser(db, "carol", "", "", false)
	if err != nil {
		t.Fatalf("CreateUser: %v", err)
	}
	if err := database.SetUserDisabled(db, user.ID, true); err != nil {
		t.Fatalf("SetUserDisabled: %v", err)
	}
	sessions := &Sessions{DB: db, CookieSecure: false}
	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	if err := sessions.Issue(rec, req, user.ID); err != nil {
		t.Fatalf("Issue: %v", err)
	}
	req2 := httptest.NewRequest(http.MethodGet, "/", nil)
	for _, c := range rec.Result().Cookies() {
		req2.AddCookie(c)
	}
	if got := sessions.CurrentUser(req2); got != nil {
		t.Fatalf("CurrentUser = %v, want nil for disabled user", got)
	}
}