package com.baiyue.audit.controller;

import com.baiyue.audit.service.AuditIngestService;
import jakarta.annotation.Resource;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.boot.test.mock.mockito.MockBean;
import org.springframework.http.MediaType;
import org.springframework.test.context.TestPropertySource;
import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.setup.MockMvcBuilders;

import static org.mockito.ArgumentMatchers.any;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.verify;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

@SpringJUnitConfig(AuditIngestController.class)
@TestPropertySource(properties = "baiyue.security.internal-service-token=0123456789abcdef0123456789abcdef")
class AuditIngestControllerTest {
    private static final String TOKEN = "0123456789abcdef0123456789abcdef";

    @MockBean
    private AuditIngestService service;

    @Resource
    private AuditIngestController controller;

    private MockMvc mockMvc;

    @BeforeEach
    void setUp() {
        mockMvc = MockMvcBuilders.standaloneSetup(controller).build();
    }

    @Test
    void rejectsInvalidInternalToken() throws Exception {
        mockMvc.perform(post("/internal/audit/events")
                        .header("X-Internal-Service-Token", "wrong-token")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(validRequest()))
                .andExpect(status().isForbidden())
                .andExpect(jsonPath("$.code").value("A0403"));

        verify(service, never()).ingest(any());
    }

    @Test
    void acceptsEventWithInternalToken() throws Exception {
        mockMvc.perform(post("/internal/audit/events")
                        .header("X-Internal-Service-Token", TOKEN)
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(validRequest()))
                .andExpect(status().isAccepted())
                .andExpect(jsonPath("$.code").value("200"));

        verify(service).ingest(any());
    }

    private String validRequest() {
        return """
                {
                  "eventType":"ROLE_UPDATE",
                  "resourceType":"ROLE",
                  "durationMs":0,
                  "success":true,
                  "occurredAt":"2026-08-05T00:00:00Z"
                }
                """;
    }
}