package httpapi

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/easyai/easyai-ai-gateway/apps/api/internal/config"
)

func TestSecurityEventConnectionWriteHeaders(t *testing.T) {
	request := httptest.NewRequest(http.MethodPost, "/connection/verify", nil)
	recorder := httptest.NewRecorder()
	if _, ok := requiredConnectionIdempotencyKey(recorder, request); ok || recorder.Code != http.StatusBadRequest {
		t.Fatalf("missing Idempotency-Key status=%d", recorder.Code)
	}

	request = httptest.NewRequest(http.MethodPost, "/connection/verify", nil)
	request.Header.Set("If-Match", `W/"7"`)
	recorder = httptest.NewRecorder()
	if !matchConnectionVersion(recorder, request, 7) {
		t.Fatalf("valid weak ETag was rejected: status=%d", recorder.Code)
	}

	request.Header.Set("If-Match", `"6"`)
	recorder = httptest.NewRecorder()
	if matchConnectionVersion(recorder, request, 7) || recorder.Code != http.StatusPreconditionFailed {
		t.Fatalf("stale ETag status=%d", recorder.Code)
	}
	if normalizedConnectionETag(`W/"7"`) != "7" ||
		securityEventOperationHash("verify", "7") == securityEventOperationHash("verify", "8") {
		t.Fatal("security event idempotency request fingerprint is not stable")
	}
}

func TestSecurityEventPrerequisitesNeverExposeSecrets(t *testing.T) {
	server := &Server{cfg: config.Config{
		OIDCEnabled: true, OIDCIssuer: "https://auth.example/issuer/shared", OIDCTenantID: "stable-tenant",
		OIDCIntrospectionClientID: "gateway-machine", OIDCIntrospectionClientSecret: "must-not-escape",
		PublicBaseURL: "https://gateway.example",
	}}
	payload, err := json.Marshal(server.securityEventPrerequisites())
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(payload), "must-not-escape") || strings.Contains(strings.ToLower(string(payload)), "secret") {
		t.Fatalf("secret escaped in prerequisites: %s", payload)
	}
}