package identity

import (
	"errors"
	"fmt"
	"net/http"
	"net/http/httptest"
	"testing"

	"server/pkg/jwtutil"

	"github.com/golang-jwt/jwt/v5"
)

// 这些用例只覆盖不依赖数据库的身份判定：端归属、令牌错误分类、状态码映射。

func mint(t *testing.T, userType string) string {
	t.Helper()
	tok, err := jwtutil.GenerateToken(4, "hero920103", 2, userType)
	if err != nil {
		t.Fatalf("签发测试令牌失败: %v", err)
	}
	return tok
}

func requestWith(auth string) *http.Request {
	r := httptest.NewRequest(http.MethodGet, "/backend/modules/getTenantList", nil)
	if auth != "" {
		r.Header.Set("Authorization", auth)
	}
	return r
}

func TestRequireAcceptsMatchingEnd(t *testing.T) {
	id, err := Require(requestWith("Bearer "+mint(t, string(EndBackend))), EndBackend)
	if err != nil {
		t.Fatalf("backend 令牌应放行，实际报错 %v", err)
	}
	if id.End != EndBackend || id.UserID != 4 || id.TenantID != 2 || id.Username != "hero920103" {
		t.Fatalf("身份解析结果不符：%+v", id)
	}
}

func TestRequireRejectsForeignEnd(t *testing.T) {
	// 认证中心换码路径曾签发 user_type=tenant，落到这里就是「令牌有效但端不匹配」。
	// 这类失败续期救不回来，必须是 403，不能触发前端静默续期重放。
	for _, userType := range []string{"tenant", "user", "employee", "platform", ""} {
		_, err := Require(requestWith("Bearer "+mint(t, userType)), EndBackend)
		if !errors.Is(err, ErrWrongEnd) {
			t.Fatalf("user_type=%q 应判为端不匹配，实际 %v", userType, err)
		}
		if got := Status(err); got != http.StatusForbidden {
			t.Fatalf("user_type=%q 期望 403，实际 %d", userType, got)
		}
	}
}

func TestRequireAllowsMultipleEnds(t *testing.T) {
	r := requestWith("Bearer " + mint(t, string(EndApp)))
	if _, err := Require(r, EndBackend, EndApp); err != nil {
		t.Fatalf("跨端接口应接受 app 令牌，实际 %v", err)
	}
	if _, err := Require(requestWith("Bearer "+mint(t, string(EndApp))), EndBackend); !errors.Is(err, ErrWrongEnd) {
		t.Fatalf("单端接口不应接受 app 令牌，实际 %v", err)
	}
}

func TestRequireTokenErrorsAreUnauthorized(t *testing.T) {
	cases := []struct {
		name string
		auth string
		want error
	}{
		{"无令牌", "", ErrNoToken},
		{"非 Bearer", "Token abc", ErrBadFormat},
		{"缺载荷", "Bearer", ErrBadFormat},
		{"乱码令牌", "Bearer aaa.bbb.ccc", ErrInvalid},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			_, err := Require(requestWith(c.auth), EndBackend)
			if !errors.Is(err, c.want) {
				t.Fatalf("期望 %v，实际 %v", c.want, err)
			}
			if got := Status(err); got != http.StatusUnauthorized {
				t.Fatalf("令牌类错误应返 401 让前端续期，实际 %d", got)
			}
		})
	}
}

func TestClassifyExpired(t *testing.T) {
	// SignToken/GenerateToken 都把非正数 TTL 钳成默认值，造不出真实过期令牌，
	// 因此这里直接验证错误分类：被包装的过期错误也要认出来。
	wrapped := fmt.Errorf("parse token: %w", jwt.ErrTokenExpired)
	if got := classify(wrapped); !errors.Is(got, ErrExpired) {
		t.Fatalf("包装后的过期错误应归类为 ErrExpired，实际 %v", got)
	}
	if got := classify(errors.New("token is expired by 1h")); !errors.Is(got, ErrExpired) {
		t.Fatalf("裸字符串过期错误应归类为 ErrExpired，实际 %v", got)
	}
	if got := classify(jwt.ErrTokenSignatureInvalid); !errors.Is(got, ErrInvalid) {
		t.Fatalf("签名错误应归类为 ErrInvalid，实际 %v", got)
	}
	if got := Status(ErrExpired); got != http.StatusUnauthorized {
		t.Fatalf("过期应返 401，实际 %d", got)
	}
}

func TestRequireNilRequest(t *testing.T) {
	if _, err := Require(nil, EndBackend); !errors.Is(err, ErrNoToken) {
		t.Fatalf("空请求应判为未提供认证信息，实际 %v", err)
	}
}