package middleware

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"hfb_sys/backend/internal/modules/auth"

	"github.com/gin-gonic/gin"
)

func TestUserAuthRejectsQueryToken(t *testing.T) {
	gin.SetMode(gin.TestMode)
	manager := auth.NewJWTManager("test-jwt-secret-for-query-token-rejection")
	pair, err := manager.GenerateSubjectPairWithVersion(1, "13800000000", "user", 1)
	if err != nil {
		t.Fatalf("GenerateSubjectPairWithVersion() error = %v", err)
	}

	engine := gin.New()
	engine.GET("/protected", Auth(manager), func(c *gin.Context) {
		c.Status(http.StatusNoContent)
	})

	queryRequest := httptest.NewRequest(http.MethodGet, "/protected?token="+pair.AccessToken, nil)
	queryResponse := httptest.NewRecorder()
	engine.ServeHTTP(queryResponse, queryRequest)
	if queryResponse.Code != http.StatusUnauthorized {
		t.Fatalf("query token status = %d, want %d", queryResponse.Code, http.StatusUnauthorized)
	}

	bearerRequest := httptest.NewRequest(http.MethodGet, "/protected", nil)
	bearerRequest.Header.Set("Authorization", "Bearer "+pair.AccessToken)
	bearerResponse := httptest.NewRecorder()
	engine.ServeHTTP(bearerResponse, bearerRequest)
	if bearerResponse.Code != http.StatusNoContent {
		t.Fatalf("bearer token status = %d, want %d", bearerResponse.Code, http.StatusNoContent)
	}
}