package main

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
)

func TestInternalCultivateRequiresSignedServiceRequest(t *testing.T) {
	previous := internalAPI
	defer func() { internalAPI = previous }()
	internalAPI = internalAPIRuntime{config: internalAPIConfig{Enabled: true, Services: map[string]internalAPIServiceConfig{"cultivate-server": {Secret: "secret", Allow: []string{internalCapabilityCultivate}}}}}
	req := httptest.NewRequest(http.MethodPost, "/internal/cultivate/tenants/default/users/batch", strings.NewReader(`{"user_ids":[1]}`))
	rec := httptest.NewRecorder()
	serveInternalCultivate(rec, req, "/internal/cultivate/")
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
	}
}

func TestInternalCultivateRejectsWrongCapability(t *testing.T) {
	previous := internalAPI
	defer func() { internalAPI = previous }()
	internalAPI = internalAPIRuntime{config: internalAPIConfig{Enabled: true, Services: map[string]internalAPIServiceConfig{"cultivate-server": {Secret: "secret", Allow: []string{internalCapabilityAdminQuery}}}}}
	req := httptest.NewRequest(http.MethodPost, "/internal/cultivate/tenants/default/users/batch", strings.NewReader(`{"user_ids":[1]}`))
	req.Header.Set(internalHeaderService, "cultivate-server")
	req.Header.Set(internalHeaderTimestamp, "1")
	req.Header.Set(internalHeaderNonce, "nonce")
	req.Header.Set(internalHeaderSignature, "signature")
	rec := httptest.NewRecorder()
	serveInternalCultivate(rec, req, "/internal/cultivate/")
	if rec.Code != http.StatusForbidden {
		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
	}
}