defmodule PinchflatWeb.ApiAuthPlugTest do
  use PinchflatWeb.ConnCase

  import Pinchflat.ProfilesFixtures

  setup do
    # Ensure api_token is not set by default in tests
    Application.put_env(:pinchflat, :api_token, nil)
    :ok
  end

  describe "when no api_token is configured" do
    test "allows access without Authorization header", %{conn: conn} do
      conn = get(conn, ~p"/api/v1/media_profiles")
      assert %{status: 200} = conn
    end
  end

  describe "when api_token is configured" do
    setup do
      Application.put_env(:pinchflat, :api_token, "secret-token-123")
      on_exit(fn -> Application.put_env(:pinchflat, :api_token, nil) end)
      :ok
    end

    test "allows access with correct Bearer token", %{conn: conn} do
      conn =
        conn
        |> put_req_header("authorization", "Bearer secret-token-123")
        |> get(~p"/api/v1/media_profiles")

      assert %{status: 200} = conn
    end

    test "returns 401 without Authorization header", %{conn: conn} do
      conn = get(conn, ~p"/api/v1/media_profiles")

      assert %{status: 401} = conn
      assert json_response(conn, 401)["errors"]["detail"] == "Unauthorized"
    end

    test "returns 401 with incorrect token", %{conn: conn} do
      conn =
        conn
        |> put_req_header("authorization", "Bearer wrong-token")
        |> get(~p"/api/v1/media_profiles")

      assert %{status: 401} = conn
    end

    test "returns 401 with malformed Authorization header", %{conn: conn} do
      conn =
        conn
        |> put_req_header("authorization", "secret-token-123")
        |> get(~p"/api/v1/media_profiles")

      assert %{status: 401} = conn
    end

    test "healthcheck endpoint does not require auth", %{conn: conn} do
      conn = get(conn, ~p"/healthcheck")
      assert %{status: 200} = conn
    end
  end
end