package auth

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestTicketStoreIssueValidate(t *testing.T) {
	store := NewTicketStore(0)
	ticket, err := store.Issue()
	if err != nil || ticket == "" {
		t.Fatal("expected valid ticket")
	}
	if !store.Validate(ticket) {
		t.Fatal("expected valid ticket")
	}
	if store.Validate("invalid") {
		t.Fatal("expected invalid ticket to fail")
	}
}

func TestTicketStoreConsume(t *testing.T) {
	store := NewTicketStore(0)
	ticket, err := store.Issue()
	if err != nil || !store.Consume(ticket) {
		t.Fatal("expected consume to succeed")
	}
	if store.Validate(ticket) {
		t.Fatal("consumed ticket should be invalid")
	}
}

func TestBasicAuthMiddleware(t *testing.T) {
	handler := BasicAuthMiddleware("admin", "secret")(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))

	req := httptest.NewRequest(http.MethodGet, "/", nil)
	rec := httptest.NewRecorder()
	handler.ServeHTTP(rec, req)
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("expected 401, got %d", rec.Code)
	}

	req = httptest.NewRequest(http.MethodGet, "/", nil)
	req.SetBasicAuth("admin", "secret")
	rec = httptest.NewRecorder()
	handler.ServeHTTP(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("expected 200, got %d", rec.Code)
	}
}

func TestFleetSecretMiddleware(t *testing.T) {
	handler := FleetSecretMiddleware("fleet-secret", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))

	req := httptest.NewRequest(http.MethodPost, "/beacon", nil)
	rec := httptest.NewRecorder()
	handler.ServeHTTP(rec, req)
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("expected 401, got %d", rec.Code)
	}

	req = httptest.NewRequest(http.MethodPost, "/beacon", nil)
	req.Header.Set("Authorization", "Bearer fleet-secret")
	rec = httptest.NewRecorder()
	handler.ServeHTTP(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("expected 200, got %d", rec.Code)
	}
}

func TestExtractBearer(t *testing.T) {
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.Header.Set("Authorization", "Bearer abc123")
	if got := ExtractBearer(req); got != "abc123" {
		t.Fatalf("expected abc123, got %q", got)
	}
}