package handlers

import (
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"strings"
	"testing"

	"teraclone/internal/service"
)

func TestAccountRoleSelectorsExcludeViewer(t *testing.T) {
	app, err := service.NewAppService(filepath.Join(t.TempDir(), "frontend.db"))
	if err != nil {
		t.Fatal(err)
	}
	defer app.Close()
	handler, err := NewDeviceHandler(app, "http://127.0.0.1:1")
	if err != nil {
		t.Fatal(err)
	}
	handler.sessions["admin-session"] = browserSession{Username: "admin", BackendToken: "test-token", Role: "administrator"}
	mux := http.NewServeMux()
	handler.RegisterRoutes(mux)
	for _, path := range []string{"/admin/users", "/admin/groups", "/admin/auth/radius", "/admin/auth/tacacs"} {
		t.Run(path, func(t *testing.T) {
			request := httptest.NewRequest(http.MethodGet, path, nil)
			request.AddCookie(&http.Cookie{Name: sessionCookieName, Value: "admin-session"})
			response := httptest.NewRecorder()
			mux.ServeHTTP(response, request)
			if path == "/admin/groups" {
				if response.Code != http.StatusSeeOther || response.Header().Get("Location") != "/admin/users" {
					t.Fatalf("removed group page must redirect to users: status=%d location=%q", response.Code, response.Header().Get("Location"))
				}
				return
			}
			if response.Code != http.StatusOK {
				t.Fatalf("page status = %d", response.Code)
			}
			body := response.Body.String()
			if strings.Contains(body, `href="/admin/groups"`) {
				t.Error("page still links to removed group management")
			}
			for _, removed := range []string{`value="viewer"`, `value="viewers"`, "조회 사용자"} {
				if strings.Contains(body, removed) {
					t.Errorf("page still offers removed viewer role: %s", removed)
				}
			}
			for _, required := range []string{`value="administrator"`, `value="port_operator"`, "integration.js?v=20260909-config-read-1"} {
				if !strings.Contains(body, required) {
					t.Errorf("page is missing %s", required)
				}
			}
		})
	}
}