package auth

import (
	"context"
	"errors"
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestAPIKeyStoreFailureReturnsRetryableServiceUnavailable(t *testing.T) {
	authenticator := New("test-secret", "", "")
	authenticator.LocalAPIKeyVerifier = func(context.Context, string) (*User, error) {
		return nil, errors.New("database unavailable")
	}
	handler := authenticator.Require(PermissionBasic, http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
		t.Fatal("unavailable authentication store must not call the protected handler")
	}))
	request := httptest.NewRequest(http.MethodGet, "/protected", nil)
	request.Header.Set("Authorization", "Bearer sk-gw-local")
	recorder := httptest.NewRecorder()

	handler.ServeHTTP(recorder, request)

	if recorder.Code != http.StatusServiceUnavailable {
		t.Fatalf("status=%d, want 503; body=%s", recorder.Code, recorder.Body.String())
	}
	if recorder.Header().Get("Retry-After") != "2" {
		t.Fatalf("Retry-After=%q, want 2", recorder.Header().Get("Retry-After"))
	}
}