package privacyidea_test

import (
	"context"
	"keycape/internal/adapters/privacyidea"
	"net/http"
	"testing"
)

func TestEnrollmentLookupRejectsIndeterminateResponses(t *testing.T) {
	for _, body := range []string{
		`{}`, `{"result":{"status":true,"value":{"tokens":[{}],"count":1}}}`, `{"result":{"status":false,"value":{"tokens":[],"count":0}}}`,
		`{"result":{"status":true,"value":{"count":0}}}`,
		`{"result":{"status":true,"value":{"tokens":[]}}}`,
		`{"result":{"status":true,"value":{"tokens":null,"count":0}}}`,
		`{"result":{"status":true,"value":{"tokens":[],"count":1}}}`,
		`{"result":{"status":true,"value":{"tokens":[],"count":-1}}}`,
	} {
		t.Run(body, func(t *testing.T) {
			adapter := privacyidea.New(testConfig(), &mockHTTPClient{doFn: func(*http.Request) (*http.Response, error) { return jsonResponse(body), nil }})
			required, err := adapter.HasEnrolledFactor(context.Background(), "alice")
			if err == nil || required {
				t.Fatalf("indeterminate lookup accepted: required=%v error=%v", required, err)
			}
		})
	}
}
func TestEnrollmentLookupFiltersBeforePagination(t *testing.T) {
	adapter := privacyidea.New(testConfig(), &mockHTTPClient{doFn: func(req *http.Request) (*http.Response, error) {
		q := req.URL.Query()
		if q.Get("user") != "alice" || q.Get("realm") != "netkingdom" || q.Get("active") != "True" {
			t.Fatalf("incorrect filter: %v", q)
		}
		if req.Header.Get("Authorization") != "service-jwt" {
			t.Fatal("provider requires raw JWT")
		}
		return jsonResponse(`{"result":{"status":true,"value":{"tokens":[{"active":true}],"count":20}}}`), nil
	}})
	required, err := adapter.HasEnrolledFactor(context.Background(), "alice")
	if err != nil || !required {
		t.Fatalf("active factor missed: %v %v", required, err)
	}
}