package services

import (
	"context"
	"errors"
	"net/http/httptest"
	"testing"

	"code.tczkiot.com/wlw/ai-agent/identity"
	"code.tczkiot.com/wlw/ai-agent/internal/pkg/constants"

	"github.com/gin-gonic/gin"
)

func TestExternalAuthDelegatesOperationToHost(t *testing.T) {
	SetQuerySubjects(func(_ context.Context, query identity.Query) ([]identity.Subject, error) {
		if !query.Current {
			return nil, nil
		}
		return []identity.Subject{{
			Type:     identity.SubjectAdmin,
			Category: identity.CategorySystem,
			ID:       9,
			Username: "admin",
			Name:     "Admin",
			Enabled:  true,
		}}, nil
	})

	var gotOperation string
	SetAuthorize(func(_ context.Context, operation string) error {
		gotOperation = operation
		return nil
	})

	ctx, _ := gin.CreateTestContext(httptest.NewRecorder())
	ctx.Request = httptest.NewRequest("GET", "/api/dashboard/conversation/list", nil)
	principal, err := AuthService.RequirePermission(ctx, constants.PermissionConversationView)
	if err != nil {
		t.Fatalf("RequirePermission() error = %v", err)
	}
	if principal.UserID != 9 || principal.SubjectType != identity.SubjectAdmin {
		t.Fatalf("principal = %#v", principal)
	}
	if gotOperation != constants.PermissionConversationView.Code {
		t.Fatalf("operation = %q, want %q", gotOperation, constants.PermissionConversationView.Code)
	}
}

func TestExternalAuthRejectsHostDeniedOperation(t *testing.T) {
	SetQuerySubjects(func(_ context.Context, query identity.Query) ([]identity.Subject, error) {
		if !query.Current {
			return nil, nil
		}
		return []identity.Subject{{
			Type: identity.SubjectAgent, Category: identity.CategorySystem, ID: 10, Enabled: true,
		}}, nil
	})
	SetAuthorize(func(_ context.Context, _ string) error {
		return errors.New("denied by host")
	})

	ctx, _ := gin.CreateTestContext(httptest.NewRecorder())
	ctx.Request = httptest.NewRequest("POST", "/api/dashboard/ai-config/delete", nil)
	if _, err := AuthService.RequirePermission(ctx, constants.PermissionAIConfigDelete); err == nil {
		t.Fatal("RequirePermission() error = nil, want forbidden")
	}
}