package httpapi

import (
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"mixmaker/backend/internal/application"
	"mixmaker/backend/internal/domain"
	"mixmaker/backend/internal/realtime"
)

func TestCreateEventRequestDefaultsEveryonePing(t *testing.T) {
	if !((createEventRequest{}).options().PingEveryone) {
		t.Fatal("legacy create requests without pingEveryone must keep @everyone enabled")
	}
}

func TestCreateEventRequestCanDisableEveryonePing(t *testing.T) {
	disabled := false
	if (createEventRequest{PingEveryone: &disabled}).options().PingEveryone {
		t.Fatal("explicit false pingEveryone must disable the ping")
	}
}

type profileHTTPStore struct {
	application.Store
	account domain.Account
	player  domain.Player
}

func (s *profileHTTPStore) AccountBySession(context.Context, string) (domain.Account, domain.Player, error) {
	return s.account, s.player, nil
}

func (s *profileHTTPStore) GetPlayer(context.Context, string) (domain.Player, error) {
	return s.player, nil
}

func (s *profileHTTPStore) ListEvents(context.Context, time.Time) ([]domain.Event, error) {
	return []domain.Event{}, nil
}

func TestPlayerProfileHTTPResponseIsPublicSafe(t *testing.T) {
	store := &profileHTTPStore{
		account: domain.Account{ID: "account", Role: domain.RolePlayer},
		player: domain.Player{
			ID: "player", AccountID: "account", DisplayName: "Ana", BattleTag: "Ana#1234",
			Ratings:            domain.Ratings{Tank: 10, Damage: 20, Support: 30},
			PreferredPlayerIDs: []string{"secret-preference"}, AvoidedPlayerIDs: []string{"secret-avoid"},
		},
	}
	hub := realtime.New()
	handler := New(application.New(store, hub, nil), store, hub, Config{CookieName: "session"})
	request := httptest.NewRequest(http.MethodGet, "/api/players/player", nil)
	request.AddCookie(&http.Cookie{Name: "session", Value: "valid"})
	response := httptest.NewRecorder()
	handler.ServeHTTP(response, request)

	if response.Code != http.StatusOK {
		t.Fatalf("unexpected status %d: %s", response.Code, response.Body.String())
	}
	var body map[string]any
	if err := json.Unmarshal(response.Body.Bytes(), &body); err != nil {
		t.Fatal(err)
	}
	encoded := response.Body.String()
	if strings.Contains(encoded, "preferred") || strings.Contains(encoded, "avoid") || strings.Contains(encoded, "accountId") {
		t.Fatalf("profile leaked private fields: %s", encoded)
	}
}

func TestModeratorCannotUpdateCommunitySettings(t *testing.T) {
	store := &profileHTTPStore{
		account: domain.Account{ID: "moderator", Role: domain.RoleModerator},
		player:  domain.Player{ID: "player", AccountID: "moderator"},
	}
	hub := realtime.New()
	handler := New(application.New(store, hub, nil), store, hub, Config{CookieName: "session"})
	request := httptest.NewRequest(http.MethodPut, "/api/community/settings", strings.NewReader(`{"discordInviteUrl":""}`))
	request.AddCookie(&http.Cookie{Name: "session", Value: "valid"})
	response := httptest.NewRecorder()
	handler.ServeHTTP(response, request)

	if response.Code != http.StatusForbidden {
		t.Fatalf("moderator update returned %d: %s", response.Code, response.Body.String())
	}
}