using System.Net;

namespace WordVersioning.Api.IntegrationTests;

/// <summary>FR-8 ฝั่ง backend + AC-3 — ทุก endpoint ต้อง [Authorize]: ไม่แนบ token → 401 ทั้งหมด</summary>
[Collection(IntegrationTestCollection.Name)]
public sealed class AuthTests(IntegrationTestFixture fixture)
{
    [Theory]
    [InlineData("GET", "api/templates")]
    [InlineData("POST", "api/templates")]
    [InlineData("GET", "api/templates/{0}/documents")]
    [InlineData("POST", "api/documents/generate")]
    [InlineData("GET", "api/documents/{0}/versions")]
    [InlineData("POST", "api/documents/{0}/versions")]
    [InlineData("GET", "api/documents/{0}/versions/{1}/download")]
    [InlineData("GET", "api/documents/{0}")]
    public async Task WithoutToken_AllEndpoints_Return401(string method, string routeTemplate)
    {
        using var client = fixture.CreateAnonymousClient();
        var route = routeTemplate
            .Replace("{0}", Guid.NewGuid().ToString())
            .Replace("{1}", Guid.NewGuid().ToString());

        using var request = new HttpRequestMessage(new HttpMethod(method), route);
        using var response = await client.SendAsync(request);

        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }

    [Fact]
    public async Task WithGarbageToken_Returns401()
    {
        using var client = fixture.CreateAnonymousClient();
        client.DefaultRequestHeaders.Authorization =
            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", "not-a-real-jwt");

        using var response = await client.GetAsync("api/templates");

        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }

    [Fact]
    public async Task WithValidToken_Returns200()
    {
        using var client = fixture.CreateClient();
        using var response = await client.GetAsync("api/templates");

        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
    }
}