PnvPanel/backend/tests/PnvPanel.Application.Tests/Auth/RefreshCommandHandlerTests.cs

using NSubstitute;
using PnvPanel.Application.Auth;
using PnvPanel.Application.Auth.Refresh;
using PnvPanel.Application.Common.Interfaces;
using PnvPanel.Application.Common.Models;
using Xunit;

namespace PnvPanel.Application.Tests.Auth;

public class RefreshCommandHandlerTests
{
    private readonly IIdentityService _identityService = Substitute.For<IIdentityService>();
    private readonly IJwtTokenService _jwtTokenService = Substitute.For<IJwtTokenService>();
    private readonly IRefreshTokenService _refreshTokenService =
        Substitute.For<IRefreshTokenService>();

    private RefreshCommandHandler CreateHandler() =>
        new(_identityService, _jwtTokenService, _refreshTokenService);

    [Fact]
    public async Task Handle_WithValidToken_RotatesAndReturnsNewAuthResult()
    {
        var userId = Guid.NewGuid();
        var profile = new CurrentUserProfile(
            userId,
            "alice",
            Guid.NewGuid(),
            "user",
            IsActivated: true,
            IsBlocked: false,
            MaxConfigs: 3,
            MaxIpLimit: RoleQuota.Unlimited,
            SubscriptionToken: "sub-token",
            BillingEnabled: false,
            BillingPaidUntil: null,
            BillingSuspended: false
        );
        var rotated = new RotatedRefreshToken(
            userId,
            "new-refresh-token",
            DateTimeOffset.UtcNow.AddDays(30)
        );

        _refreshTokenService
            .RotateAsync("old-token", Arg.Any<CancellationToken>())
            .Returns(Result.Success(rotated));
        _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(profile);
        _identityService
            .GetTelegramLinkInfoAsync(userId, Arg.Any<CancellationToken>())
            .Returns(new TelegramLinkInfo(false, null, null));
        _jwtTokenService
            .GenerateAccessToken(Arg.Any<AuthenticatedUser>())
            .Returns(("new-access-token", DateTimeOffset.UtcNow.AddMinutes(15)));

        var result = await CreateHandler()
            .Handle(new RefreshCommand("old-token"), CancellationToken.None);

        Assert.True(result.IsSuccess);
        Assert.Equal("new-access-token", result.Value.AccessToken);
        Assert.Equal("new-refresh-token", result.Value.RefreshToken);
    }

    [Fact]
    public async Task Handle_WithInvalidOrReusedToken_ReturnsFailure()
    {
        _refreshTokenService
            .RotateAsync("stolen-token", Arg.Any<CancellationToken>())
            .Returns(Result.Failure<RotatedRefreshToken>(AuthErrors.InvalidRefreshToken));

        var result = await CreateHandler()
            .Handle(new RefreshCommand("stolen-token"), CancellationToken.None);

        Assert.False(result.IsSuccess);
        Assert.Equal(AuthErrors.InvalidRefreshToken, result.Error);
        await _identityService
            .DidNotReceive()
            .GetProfileAsync(Arg.Any<Guid>(), Arg.Any<CancellationToken>());
    }

    [Fact]
    public async Task Handle_WhenProfileNoLongerExists_ReturnsInvalidRefreshToken()
    {
        var userId = Guid.NewGuid();
        var rotated = new RotatedRefreshToken(
            userId,
            "new-refresh-token",
            DateTimeOffset.UtcNow.AddDays(30)
        );

        _refreshTokenService
            .RotateAsync("old-token", Arg.Any<CancellationToken>())
            .Returns(Result.Success(rotated));
        _identityService
            .GetProfileAsync(userId, Arg.Any<CancellationToken>())
            .Returns((CurrentUserProfile?)null);

        var result = await CreateHandler()
            .Handle(new RefreshCommand("old-token"), CancellationToken.None);

        Assert.False(result.IsSuccess);
        Assert.Equal(AuthErrors.InvalidRefreshToken, result.Error);
    }

    [Fact]
    public async Task Handle_WhenUserBlocked_ReturnsUserBlocked()
    {
        var userId = Guid.NewGuid();
        var profile = new CurrentUserProfile(
            userId,
            "alice",
            Guid.NewGuid(),
            "user",
            IsActivated: true,
            IsBlocked: true,
            MaxConfigs: 3,
            MaxIpLimit: RoleQuota.Unlimited,
            SubscriptionToken: "sub-token",
            BillingEnabled: false,
            BillingPaidUntil: null,
            BillingSuspended: false
        );
        var rotated = new RotatedRefreshToken(
            userId,
            "new-refresh-token",
            DateTimeOffset.UtcNow.AddDays(30)
        );

        _refreshTokenService
            .RotateAsync("old-token", Arg.Any<CancellationToken>())
            .Returns(Result.Success(rotated));
        _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(profile);

        var result = await CreateHandler()
            .Handle(new RefreshCommand("old-token"), CancellationToken.None);

        Assert.False(result.IsSuccess);
        Assert.Equal(AuthErrors.UserBlocked, result.Error);
        _jwtTokenService.DidNotReceive().GenerateAccessToken(Arg.Any<AuthenticatedUser>());
    }
}