defmodule PinchflatWeb.ApiAuthPlugTest do
  use PinchflatWeb.ConnCase

  import Pinchflat.ProfilesFixtures
  alias Pinchflat.Settings

  setup do
    # Ensure api_token is cleared in DB for each test
    Settings.set(api_token: nil)
    :ok
  end

  describe "when no api_token is configured" do
    test "returns 401 without Authorization header", %{conn: conn} do
      conn = get(conn, ~p"/api/v1/media_profiles")

      assert %{status: 401} = conn
    end

    test "returns 401 even with a Bearer token", %{conn: conn} do
      conn =
        conn
        |> put_req_header("authorization", "Bearer some-token")
        |> get(~p"/api/v1/media_profiles")

      assert %{status: 401} = conn
    end
  end

  describe "when api_token is configured" do
    setup do
      Settings.set(api_token: "secret-token-123")
      :ok
    end

    test "allows access with correct Bearer token", %{conn: conn} do
      conn =
        conn
        |> put_req_header("authorization", "Bearer secret-token-123")
        |> get(~p"/api/v1/media_profiles")

      assert %{status: 200} = conn
    end

    test "returns 401 without Authorization header", %{conn: conn} do
      conn = get(conn, ~p"/api/v1/media_profiles")

      assert %{status: 401} = conn
      assert json_response(conn, 401)["errors"]["detail"] == "Unauthorized"
    end

    test "returns 401 with incorrect token", %{conn: conn} do
      conn =
        conn
        |> put_req_header("authorization", "Bearer wrong-token")
        |> get(~p"/api/v1/media_profiles")

      assert %{status: 401} = conn
    end

    test "returns 401 with malformed Authorization header", %{conn: conn} do
      conn =
        conn
        |> put_req_header("authorization", "secret-token-123")
        |> get(~p"/api/v1/media_profiles")

      assert %{status: 401} = conn
    end

    test "healthcheck endpoint does not require auth", %{conn: conn} do
      conn = get(conn, ~p"/healthcheck")
      assert %{status: 200} = conn
    end
  end
end