package api

import (
	"encoding/json"
	"net/http/httptest"
	"strings"
	"testing"
)

func TestBurnAfterRead(t *testing.T) {
	s := testServer(t)
	h := s.routes()

	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"vanish","burn_after_read":true}`))
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != 201 {
		t.Fatalf("create: %d", rec.Code)
	}
	var created struct{ ID string `json:"id"` }
	json.Unmarshal(rec.Body.Bytes(), &created)

	// first read ok
	req = httptest.NewRequest("GET", "/api/pastes/"+created.ID, nil)
	rec = httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != 200 {
		t.Fatalf("first read: %d", rec.Code)
	}

	// second read gone
	req = httptest.NewRequest("GET", "/api/pastes/"+created.ID, nil)
	rec = httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != 404 {
		t.Fatalf("second read expected 404, got %d", rec.Code)
	}
}

func TestDeletionTokenRedeem(t *testing.T) {
	s := testServer(t)
	h := s.routes()

	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"x"}`))
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	var created struct {
		ID            string `json:"id"`
		DeletionToken string `json:"deletion_token"`
	}
	json.Unmarshal(rec.Body.Bytes(), &created)
	if created.DeletionToken == "" {
		t.Fatal("no deletion token in create response")
	}

	// wrong token (#143: token goes in the Authorization header, not the URL)
	req = httptest.NewRequest("DELETE", "/api/pastes/"+created.ID+"/redeem", nil)
	req.Header.Set("Authorization", "Bearer wrong")
	rec = httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != 403 {
		t.Fatalf("wrong token: %d", rec.Code)
	}

	// right token: hard delete
	req = httptest.NewRequest("DELETE", "/api/pastes/"+created.ID+"/redeem", nil)
	req.Header.Set("Authorization", "Bearer "+created.DeletionToken)
	rec = httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != 200 {
		t.Fatalf("redeem: %d", rec.Code)
	}

	// gone for good: even soft-deleted lookup returns nothing, and row count is 0
	var n int
	n = s.store.QueryInt(`SELECT COUNT(*) FROM pastes WHERE id=?`, created.ID)
	if n != 0 {
		t.Fatal("row still exists after redeem")
	}
}

func TestNonBurnPasteUnaffectedByRead(t *testing.T) {
	s := testServer(t)
	h := s.routes()

	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"normal"}`))
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	var created struct{ ID string `json:"id"` }
	json.Unmarshal(rec.Body.Bytes(), &created)

	for i := 0; i < 3; i++ {
		req = httptest.NewRequest("GET", "/api/pastes/"+created.ID, nil)
		rec = httptest.NewRecorder()
		h.ServeHTTP(rec, req)
		if rec.Code != 200 {
			t.Fatalf("read %d: %d", i, rec.Code)
		}
	}
}