package auth_test

import (
	"io"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/stretchr/testify/require"

	"pipu/api/internal/auth"
)

func TestSignedUploadStreamReachesSignatureHandlerWithoutBearer(t *testing.T) {
	const file = "/api/v1/admin/uploads/files/01a18459-32bc-7589-a83d-635292a7a4e2"
	for _, tc := range []struct {
		method, path string
		want         int
	}{
		{http.MethodGet, file + "/stream?exp=1&sig=invalid", http.StatusForbidden},
		{http.MethodHead, file + "/stream?exp=1&sig=invalid", http.StatusForbidden},
		{http.MethodGet, file, http.StatusUnauthorized},
		{http.MethodPatch, file + "/stream", http.StatusUnauthorized},
		{http.MethodGet, file + "/stream/other", http.StatusUnauthorized},
		{http.MethodGet, "/api/v1/admin/uploads", http.StatusUnauthorized},
	} {
		t.Run(tc.method+" "+tc.path, func(t *testing.T) {
			h := auth.Middleware(nil, slog.New(slog.NewTextHandler(io.Discard, nil)))(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				// A signed media route still delegates authorization to its signature handler.
				w.WriteHeader(http.StatusForbidden)
			}))
			rec := httptest.NewRecorder()
			h.ServeHTTP(rec, httptest.NewRequest(tc.method, tc.path, nil))
			require.Equal(t, tc.want, rec.Code)
		})
	}
}