package api

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"tera-clone/services/tera-api/internal/adapters/mock"
)

func TestDestructiveActionsRequireCurrentAccountPassword(t *testing.T) {
	for _, path := range []string{"/api/v1/logs/system/clear", "/api/v1/logs/links/clear", "/api/v1/logs/port/clear", "/api/v1/system/factory-reset"} {
		t.Run(path, func(t *testing.T) {
			store := mock.NewStore(fixedClock)
			defer store.Close()
			handler := NewRouter(store)
			body := `{"password":"wrong"}`
			if strings.Contains(path, "/port/") {
				body = `{"password":"wrong","channel":"ALL"}`
			}
			if strings.Contains(path, "factory-reset") {
				body = `{"password":"wrong","confirmed":true}`
			}
			req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(body))
			req.Header.Set("X-Mock-Actor", "mock-admin")
			response := httptest.NewRecorder()
			handler.ServeHTTP(response, req)
			if response.Code != http.StatusForbidden {
				t.Fatalf("wrong password accepted: %d %s", response.Code, response.Body.String())
			}
			body = strings.Replace(body, "wrong", "mock-admin-secret", 1)
			req = httptest.NewRequest(http.MethodPost, path, strings.NewReader(body))
			req.Header.Set("X-Mock-Actor", "mock-admin")
			response = httptest.NewRecorder()
			handler.ServeHTTP(response, req)
			if response.Code != http.StatusOK {
				t.Fatalf("correct password rejected: %d %s", response.Code, response.Body.String())
			}
		})
	}
}