package sresponse

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"git.sendico.io/tech/sxchnge/bff/edge/shared/auth/browser"
	"git.sendico.io/tech/sxchnge/bff/pkg/model"
	"github.com/stretchr/testify/require"
	"go.uber.org/zap"
)

func TestBrowserLoginMovesRefreshCredentialToHttpOnlyCookie(t *testing.T) {
	refresh := &TokenData{Token: "refresh-secret", Expiration: time.Now().Add(time.Hour)}
	access := &TokenData{Token: "access-secret", Expiration: time.Now().Add(time.Minute)}
	req := httptest.NewRequest(http.MethodPost, "http://app.sendico.io/api/v1/accounts/login", nil)
	req.Header.Set(browser.TransportHeader, browser.TransportCookie)
	req.Header.Set("X-Forwarded-Proto", "https")
	recorder := httptest.NewRecorder()

	Login(zap.NewNop(), &model.Account{}, access, refresh).ServeHTTP(recorder, req)

	require.Equal(t, http.StatusOK, recorder.Code)
	require.NotContains(t, recorder.Body.String(), refresh.Token)
	require.Contains(t, recorder.Body.String(), access.Token)
	setCookie := recorder.Header().Get("Set-Cookie")
	require.True(t, strings.HasPrefix(setCookie, browser.RefreshCookie+"="))
	require.Contains(t, setCookie, "HttpOnly")
	require.Contains(t, setCookie, "Secure")
	require.Contains(t, setCookie, "SameSite=Strict")
}

func TestNativeLoginKeepsRefreshCredentialInResponse(t *testing.T) {
	refresh := &TokenData{Token: "native-refresh", Expiration: time.Now().Add(time.Hour)}
	access := &TokenData{Token: "native-access", Expiration: time.Now().Add(time.Minute)}
	req := httptest.NewRequest(http.MethodPost, "http://native.test/api/v1/accounts/login", nil)
	recorder := httptest.NewRecorder()

	Login(zap.NewNop(), &model.Account{}, access, refresh).ServeHTTP(recorder, req)

	require.Contains(t, recorder.Body.String(), refresh.Token)
	require.Empty(t, recorder.Header().Get("Set-Cookie"))
}