using System.Net;
using System.Net.Http.Json;

namespace VolcanicCore.Tests;

public class AuthTests : IClassFixture<WebFactory>
{
    private readonly WebFactory _factory;
    public AuthTests(WebFactory f) => _factory = f;

    private HttpClient Fresh() => _factory.CreateClient(new()
    {
        HandleCookies = true,
        AllowAutoRedirect = false,
    });

    [Fact]
    public async Task Me_without_cookie_is_401()
    {
        var res = await Fresh().GetAsync("/api/session/me");
        Assert.Equal(HttpStatusCode.Unauthorized, res.StatusCode);
    }

    [Fact]
    public async Task Bad_password_is_401()
    {
        var res = await Fresh().PostAsJsonAsync("/api/session",
            new { password = "nope" });
        Assert.Equal(HttpStatusCode.Unauthorized, res.StatusCode);
    }

    [Fact]
    public async Task Good_password_sets_cookie_and_me_returns_200()
    {
        var c = Fresh();
        var login = await c.PostAsJsonAsync("/api/session", new { password = _factory.AdminPassword });
        Assert.Equal(HttpStatusCode.NoContent, login.StatusCode);
        var me = await c.GetAsync("/api/session/me");
        Assert.Equal(HttpStatusCode.OK, me.StatusCode);
    }

    [Fact]
    public async Task Logout_clears_the_session()
    {
        var c = Fresh();
        await c.PostAsJsonAsync("/api/session", new { password = _factory.AdminPassword });
        var logout = await c.DeleteAsync("/api/session");
        Assert.Equal(HttpStatusCode.NoContent, logout.StatusCode);
        var me = await c.GetAsync("/api/session/me");
        Assert.Equal(HttpStatusCode.Unauthorized, me.StatusCode);
    }
}