package callerauth

import (
	"context"
	"errors"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"testing"
)

func TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated(t *testing.T) {
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/apis/authentication.k8s.io/v1/tokenreviews" {
			t.Fatalf("TokenReview path = %q", r.URL.Path)
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_, _ = w.Write([]byte(`{
  "apiVersion": "authentication.k8s.io/v1",
  "kind": "TokenReview",
  "status": {
    "authenticated": false,
    "error": "invalid bearer token"
  }
}`))
	}))
	defer server.Close()

	tokenFile := filepath.Join(t.TempDir(), "reviewer-token")
	if err := os.WriteFile(tokenFile, []byte("reviewer-token\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	reviewer := &KubernetesTokenReviewer{
		endpoint:          server.URL + "/apis/authentication.k8s.io/v1/tokenreviews",
		audience:          "flex-auth",
		reviewerTokenFile: tokenFile,
		client:            server.Client(),
	}

	_, err := reviewer.Review(context.Background(), "malformed")
	if !errors.Is(err, ErrUnauthenticated) {
		t.Fatalf("Review error = %v; want unauthenticated", err)
	}
}