package operator

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"proxui/backend/internal/membership"
	"proxui/backend/internal/rbac"
)

func TestRequireOperatorAcceptsConfiguredToken(t *testing.T) {
	middleware := NewMiddleware("operator-secret")
	handler := middleware.RequireOperator(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		operator, ok := membership.FromRequest(r)
		if !ok {
			t.Fatal("operator role missing from request")
		}
		if operator.Role != rbac.RoleOperator {
			t.Fatalf("role = %q, want %q", operator.Role, rbac.RoleOperator)
		}
		w.WriteHeader(http.StatusNoContent)
	}))

	req := httptest.NewRequest(http.MethodPost, "/internal/clusters", nil)
	req.Header.Set(HeaderName, "operator-secret")
	rec := httptest.NewRecorder()

	handler.ServeHTTP(rec, req)

	if rec.Code != http.StatusNoContent {
		t.Fatalf("status = %d, want %d", rec.Code, http.StatusNoContent)
	}
}

func TestRequireOperatorRejectsWrongToken(t *testing.T) {
	middleware := NewMiddleware("operator-secret")
	handler := middleware.RequireOperator(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusNoContent)
	}))

	req := httptest.NewRequest(http.MethodPost, "/internal/clusters", nil)
	req.Header.Set(HeaderName, "wrong")
	rec := httptest.NewRecorder()

	handler.ServeHTTP(rec, req)

	if rec.Code != http.StatusForbidden {
		t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
	}
}

func TestRequireOperatorRejectsMissingConfiguredToken(t *testing.T) {
	middleware := NewMiddleware("")
	handler := middleware.RequireOperator(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusNoContent)
	}))

	req := httptest.NewRequest(http.MethodPost, "/internal/clusters", nil)
	req.Header.Set(HeaderName, "operator-secret")
	rec := httptest.NewRecorder()

	handler.ServeHTTP(rec, req)

	if rec.Code != http.StatusServiceUnavailable {
		t.Fatalf("status = %d, want %d", rec.Code, http.StatusServiceUnavailable)
	}
}