using System.Net;
using ClawdDotNet.Core.Deploymentcenter;
using Shouldly;

namespace ClawdDotNet.Core.Tests.Deploymentcenter;

public sealed class DeploymentcenterApiTests
{
    [Fact]
    public async Task Token_is_sent_as_bearer()
    {
        var handler = new CapturingHandler();
        using var api = new DeploymentcenterApi("https://dc.example", "tok-1", new HttpClient(handler));

        await api.PostAsync("/api/health", new { }, default);

        handler.LastRequest!.Headers.Authorization!.ToString().ShouldBe("Bearer tok-1");
    }

    [Fact]
    public async Task Error_envelope_becomes_an_exception_with_code()
    {
        var handler = new CapturingHandler(HttpStatusCode.Unauthorized,
            """{"status":"error","error":{"code":"unauthorized","message":"Kein gueltiges Token."}}""");

        using var api = new DeploymentcenterApi("https://dc.example", "tok", new HttpClient(handler));

        var ex = await Should.ThrowAsync<DeploymentcenterException>(
            () => api.PostAsync("/api/watchdog/v1/ping", new { }, default));

        ex.Code.ShouldBe("unauthorized");
        ex.IsAuthorizationProblem.ShouldBeTrue();
    }

    /// <summary>
    /// An error envelope counts even if the status code is 200 — the server
    /// does not answer with a matching HTTP code everywhere.
    /// </summary>
    [Fact]
    public async Task Error_envelope_with_HTTP_200_still_counts()
    {
        var handler = new CapturingHandler(HttpStatusCode.OK,
            """{"status":"error","error":{"code":"rate_limited","message":"Zu viele."}}""");

        using var api = new DeploymentcenterApi("https://dc.example", "tok", new HttpClient(handler));

        var ex = await Should.ThrowAsync<DeploymentcenterException>(
            () => api.PostAsync("/x", new { }, default));

        ex.Code.ShouldBe("rate_limited");
        ex.IsAuthorizationProblem.ShouldBeFalse();
    }

    [Fact]
    public void Non_HTTPS_is_rejected()
    {
        // Over an unsecured connection the token would go in plain text.
        Should.Throw<ArgumentException>(() => new DeploymentcenterApi("http://dc.example", "tok"));
    }

    [Fact]
    public void Localhost_is_allowed_without_TLS()
    {
        // A local test installation rarely has a certificate, and nobody can listen in
        // on the own machine.
        using var api = new DeploymentcenterApi("http://localhost:8080", "tok");
        api.BaseUrl.ShouldBe("http://localhost:8080");
    }
}