package httpapi

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"data-terminal-cloud/internal/identity"
)

func TestOpsFirmwareHandlersRejectInvalidBoundariesBeforeService(t *testing.T) {
	principal := identity.Principal{Issuer: "https://issuer.example", Subject: "ops-user"}
	tenantID := "10000000-0000-0000-0000-000000000010"
	tests := []struct {
		name    string
		handler http.Handler
		method  string
		path    string
		body    string
		tenant  string
	}{
		{name: "tenant required", handler: ListOpsFirmwareReleasesHandler(nil), method: http.MethodGet, path: "/api/v1/ops/firmware-releases"},
		{name: "status allowlist", handler: ListOpsFirmwareReleasesHandler(nil), method: http.MethodGet, path: "/api/v1/ops/firmware-releases?status=deleted", tenant: tenantID},
		{name: "public key exact length", handler: RegisterOpsFirmwareSigningKeyHandler(nil), method: http.MethodPost, path: "/api/v1/ops/firmware-signing-keys", body: `{"key_id":"ops-key","public_key_base64":"YQ=="}`, tenant: tenantID},
		{name: "release id uuid", handler: OpsFirmwareReleaseActionHandler(nil, "pause"), method: http.MethodPost, path: "/api/v1/ops/firmware-releases/not-a-uuid/pause", tenant: tenantID},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			request := httptest.NewRequest(test.method, test.path, strings.NewReader(test.body))
			request = request.WithContext(identity.WithPrincipal(request.Context(), principal))
			if test.tenant != "" {
				request.Header.Set("X-Tenant-Id", test.tenant)
			}
			if strings.Contains(test.path, "not-a-uuid") {
				request.SetPathValue("id", "not-a-uuid")
			}
			recorder := httptest.NewRecorder()
			test.handler.ServeHTTP(recorder, request)
			if recorder.Code != http.StatusBadRequest {
				t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
			}
		})
	}
}