package authorization

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"proxui/backend/internal/membership"
	"proxui/backend/internal/rbac"
)

func TestRequireAllowsRoleWithPermission(t *testing.T) {
	middleware := NewMiddleware()
	handler := middleware.Require(rbac.ActionProjectManage, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusNoContent)
	}))

	req := requestWithMembership(rbac.RoleAdmin)
	rec := httptest.NewRecorder()

	handler.ServeHTTP(rec, req)

	if rec.Code != http.StatusNoContent {
		t.Fatalf("status = %d, want %d", rec.Code, http.StatusNoContent)
	}
}

func TestRequireRejectsRoleWithoutPermission(t *testing.T) {
	middleware := NewMiddleware()
	handler := middleware.Require(rbac.ActionProjectManage, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusNoContent)
	}))

	req := requestWithMembership(rbac.RoleViewer)
	rec := httptest.NewRecorder()

	handler.ServeHTTP(rec, req)

	if rec.Code != http.StatusForbidden {
		t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
	}
}

func TestRequireRejectsMissingMembership(t *testing.T) {
	middleware := NewMiddleware()
	handler := middleware.Require(rbac.ActionProjectRead, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusNoContent)
	}))

	req := httptest.NewRequest(http.MethodGet, "/tenants/tenant-1/projects", nil)
	rec := httptest.NewRecorder()

	handler.ServeHTTP(rec, req)

	if rec.Code != http.StatusForbidden {
		t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
	}
}

func requestWithMembership(role rbac.Role) *http.Request {
	req := httptest.NewRequest(http.MethodGet, "/tenants/tenant-1/projects", nil)
	return req.WithContext(membership.ContextWithMembership(req.Context(), membership.Membership{
		TenantID: "tenant-1",
		Role:     role,
	}))
}