package api

import (
	"testing"

	"vpn-platform/backend/internal/model"
	"vpn-platform/backend/internal/store"
)

func TestAuthGatewayPortFollowsRunningOIDCTunnel(t *testing.T) {
	oldDB := store.DB
	t.Cleanup(func() { store.DB = oldDB })
	if err := store.Init(t.TempDir()); err != nil {
		t.Fatal(err)
	}
	line := model.Tunnel{Name: "oauth-line", Protocol: "openvpn", State: "stopped", Config: `{"auth_mode":"oidc","oidc_base_url":"https://vpn.example.com","oidc_http_port":19090}`}
	if err := store.DB.Create(&line).Error; err != nil {
		t.Fatal(err)
	}
	check := func(want int) {
		t.Helper()
		got, err := authGatewayPort("https://vpn.example.com")
		if err != nil || got != want {
			t.Fatalf("gateway port = %d, %v; want %d", got, err, want)
		}
	}
	check(0)
	if err := store.DB.Model(&line).Update("state", "running").Error; err != nil {
		t.Fatal(err)
	}
	check(19090)
	if err := checkAuthGatewayChange("https://vpn.example.com", "http://vpn.example.com"); err == nil {
		t.Fatal("active OIDC callback must block public entry change")
	}
	if err := checkAuthGatewayChange("https://vpn.example.com", "https://vpn.example.com"); err != nil {
		t.Fatalf("unchanged public entry should be allowed: %v", err)
	}
	if port, err := authGatewayPort("https://other.example.com"); err != nil || port != 0 {
		t.Fatalf("wrong domain routed: %d, %v", port, err)
	}
	if err := store.DB.Model(&line).Update("state", "stopped").Error; err != nil {
		t.Fatal(err)
	}
	check(0)
	if err := checkAuthGatewayChange("https://vpn.example.com", "http://vpn.example.com"); err != nil {
		t.Fatalf("stopped OIDC tunnel should allow change: %v", err)
	}
}