package app

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"
)

func TestAdminRefreshCookieSecurityModes(t *testing.T) {
	production := &App{config: Config{Environment: "production"}}
	recorder := httptest.NewRecorder()
	production.setAdminRefreshCookie(recorder, "token", time.Now().Add(time.Hour))
	cookies := recorder.Result().Cookies()
	if len(cookies) != 1 || !cookies[0].HttpOnly || !cookies[0].Secure || cookies[0].SameSite != http.SameSiteNoneMode {
		t.Fatalf("unexpected production cookie: %#v", cookies)
	}

	development := &App{config: Config{Environment: "development"}}
	recorder = httptest.NewRecorder()
	development.setAdminRefreshCookie(recorder, "token", time.Now().Add(time.Hour))
	cookies = recorder.Result().Cookies()
	if len(cookies) != 1 || cookies[0].Secure || cookies[0].SameSite != http.SameSiteLaxMode {
		t.Fatalf("unexpected development cookie: %#v", cookies)
	}
}

func TestAdminRefreshTokenRequestFallback(t *testing.T) {
	application := &App{}
	request := httptest.NewRequest(http.MethodPost, "/admin/v1/auth/refresh", strings.NewReader(`{"refreshToken":"body-token"}`))
	request.Header.Set("Content-Type", "application/json")
	if token := application.adminRefreshTokenFromRequest(request); token != "body-token" {
		t.Fatalf("unexpected body token %q", token)
	}

	request = httptest.NewRequest(http.MethodPost, "/admin/v1/auth/refresh", strings.NewReader(`{"refreshToken":"body-token"}`))
	request.AddCookie(&http.Cookie{Name: adminRefreshCookieKey, Value: "cookie-token"})
	if token := application.adminRefreshTokenFromRequest(request); token != "cookie-token" {
		t.Fatalf("cookie token must take priority, got %q", token)
	}
}