package sresponse

import (
	customermodel "git.sendico.io/tech/sxchnge/product/customers/model"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"git.sendico.io/tech/sxchnge/product/sessions/browser"
	"github.com/stretchr/testify/require"
	"go.uber.org/zap"
)

func TestBrowserLoginMovesRefreshCredentialToHttpOnlyCookie(t *testing.T) {
	refresh := &TokenData{Token: "refresh-secret", Expiration: time.Now().Add(time.Hour)}
	access := &TokenData{Token: "access-secret", Expiration: time.Now().Add(time.Minute)}
	req := httptest.NewRequest(http.MethodPost, "http://app.sendico.io/api/v1/accounts/login", nil)
	req.Header.Set(browser.TransportHeader, browser.TransportCookie)
	req.Header.Set("X-Forwarded-Proto", "https")
	recorder := httptest.NewRecorder()

	Login(zap.NewNop(), &customermodel.Account{}, access, refresh).ServeHTTP(recorder, req)

	require.Equal(t, http.StatusOK, recorder.Code)
	require.NotContains(t, recorder.Body.String(), refresh.Token)
	require.Contains(t, recorder.Body.String(), access.Token)
	setCookie := recorder.Header().Get("Set-Cookie")
	require.True(t, strings.HasPrefix(setCookie, browser.RefreshCookie+"="))
	require.Contains(t, setCookie, "HttpOnly")
	require.Contains(t, setCookie, "Secure")
	require.Contains(t, setCookie, "SameSite=Strict")
}

func TestNativeLoginKeepsRefreshCredentialInResponse(t *testing.T) {
	refresh := &TokenData{Token: "native-refresh", Expiration: time.Now().Add(time.Hour)}
	access := &TokenData{Token: "native-access", Expiration: time.Now().Add(time.Minute)}
	req := httptest.NewRequest(http.MethodPost, "http://native.test/api/v1/accounts/login", nil)
	recorder := httptest.NewRecorder()

	Login(zap.NewNop(), &customermodel.Account{}, access, refresh).ServeHTTP(recorder, req)

	require.Contains(t, recorder.Body.String(), refresh.Token)
	require.Empty(t, recorder.Header().Get("Set-Cookie"))
}

func TestCustomerResponseExcludesStorageAndPlatformFields(t *testing.T) {
	account := &customermodel.Account{Password: "private-password-hash", Status: customermodel.AccountActive}
	account.Login = "customer@example.test"
	account.Name = "Customer"
	recorder := httptest.NewRecorder()
	Account(zap.NewNop(), account, &TokenData{}).ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/accounts/me", nil))
	require.Contains(t, recorder.Body.String(), "customer@example.test")
	for _, field := range []string{"private-password-hash", "password", "status\":\"active", "organization", "role", "policy", "isAnonymous", "createdAt", "isArchived"} {
		require.NotContains(t, recorder.Body.String(), field)
	}
}