package api

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
)

func TestTLSStatusRequiresAdmin(t *testing.T) {
	gin.SetMode(gin.TestMode)
	router := gin.New()
	router.GET("/api/system/tls", func(c *gin.Context) {
		c.Set("role", c.GetHeader("X-Test-Role"))
		c.Next()
	}, requireRole("admin"), (&Server{}).tlsStatus)

	for _, role := range []string{"", "viewer", "operator"} {
		req := httptest.NewRequest(http.MethodGet, "/api/system/tls", nil)
		req.Header.Set("X-Test-Role", role)
		resp := httptest.NewRecorder()
		router.ServeHTTP(resp, req)
		if resp.Code != http.StatusForbidden {
			t.Errorf("role %q received HTTP %d", role, resp.Code)
		}
	}

	req := httptest.NewRequest(http.MethodGet, "/api/system/tls", nil)
	req.Header.Set("X-Test-Role", "admin")
	resp := httptest.NewRecorder()
	router.ServeHTTP(resp, req)
	if resp.Code != http.StatusOK {
		t.Fatalf("admin received HTTP %d", resp.Code)
	}
	var data map[string]any
	if err := json.Unmarshal(resp.Body.Bytes(), &data); err != nil {
		t.Fatal(err)
	}
	if _, ok := data["configured_domain"]; !ok {
		t.Fatal("admin response missing configured domain")
	}
	for _, secret := range []string{"private_key", "account_key", "certificate_pem"} {
		if _, ok := data[secret]; ok {
			t.Errorf("response exposes %s", secret)
		}
	}
}