use std::collections::HashMap;
use std::sync::Arc;

use axum::body::Body;
use axum::http::{Request, StatusCode};
use tower::util::ServiceExt;

use doctate_server::config::{Config, User};

fn test_config() -> Arc<Config> {
    Arc::new(Config {
        data_path: "/tmp/doctate-test".into(),
        log_path: "/tmp/doctate-test/logs".into(),
        users: vec![User {
            slug: "dr_test".into(),
            api_key: "test-key-123".into(),
            web_password: "unused".into(),
            role: "doctor".into(),
            whisper: Default::default(),
            retention: Default::default(),
            window_hours: 72,
        }],
        api_keys: HashMap::from([("test-key-123".into(), "dr_test".into())]),
        ..Config::test_default()
    })
}

#[tokio::test]
async fn valid_api_key_returns_user() {
    let app = doctate_server::create_router(test_config());

    let response = app
        .oneshot(
            Request::builder()
                .uri("/api/debug/whoami")
                .header("X-API-Key", "test-key-123")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();

    assert_eq!(response.status(), StatusCode::OK);

    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
        .await
        .unwrap();
    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();

    assert_eq!(json["slug"], "dr_test");
    assert_eq!(json["role"], "doctor");
}

#[tokio::test]
async fn invalid_api_key_returns_401() {
    let app = doctate_server::create_router(test_config());

    let response = app
        .oneshot(
            Request::builder()
                .uri("/api/debug/whoami")
                .header("X-API-Key", "wrong-key")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();

    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
}

#[tokio::test]
async fn missing_api_key_returns_401() {
    let app = doctate_server::create_router(test_config());

    let response = app
        .oneshot(
            Request::builder()
                .uri("/api/debug/whoami")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();

    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
}