package agentserver_test

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"evobgp/internal/agentserver"
)

func TestAgentHealth_requiresAuth(t *testing.T) {
	t.Parallel()
	srv := httptest.NewServer(agentserver.New(agentserver.Config{
		Secret:    "test-secret",
		SpeakerID: "sp-1",
	}).Handler())
	defer srv.Close()

	resp, err := http.Get(srv.URL + "/v1/agent/health")
	if err != nil {
		t.Fatal(err)
	}
	defer func() { _ = resp.Body.Close() }()
	if resp.StatusCode != http.StatusUnauthorized {
		t.Fatalf("want 401, got %d", resp.StatusCode)
	}

	req, _ := http.NewRequest(http.MethodGet, srv.URL+"/v1/agent/health", nil)
	req.Header.Set("Authorization", "Bearer test-secret")
	resp2, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatal(err)
	}
	defer func() { _ = resp2.Body.Close() }()
	if resp2.StatusCode != http.StatusOK {
		t.Fatalf("want 200, got %d", resp2.StatusCode)
	}
}

func TestAgentSync_badAuth(t *testing.T) {
	t.Parallel()
	srv := httptest.NewServer(agentserver.New(agentserver.Config{
		Secret:          "right",
		SpeakerID:       "sp-1",
		ControlPlaneURL: "http://127.0.0.1:1",
		NodeToken:       "tok",
		PubKeyB64:       "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
		ExtractDir:      t.TempDir(),
	}).Handler())
	defer srv.Close()

	req, _ := http.NewRequest(http.MethodPost, srv.URL+"/v1/agent/sync", strings.NewReader("{}"))
	req.Header.Set("Authorization", "Bearer wrong")
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatal(err)
	}
	defer func() { _ = resp.Body.Close() }()
	if resp.StatusCode != http.StatusUnauthorized {
		t.Fatalf("want 401, got %d", resp.StatusCode)
	}
}