package auth

import (
	"crypto/sha256"
	"net/http"
	"testing"

	"aigw/internal/domain"
)

func TestStaticAuthenticator(t *testing.T) {
	raw := `[{"key":"sk-client","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","scopes":["inference"]}]`
	authenticator, err := NewStatic(raw, false)
	if err != nil {
		t.Fatal(err)
	}

	request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
	request.Header.Set("Authorization", "Bearer sk-client")
	principal, err := authenticator.Authenticate(request)
	if err != nil {
		t.Fatal(err)
	}
	if principal.TenantID != "tenant-1" || principal.ProjectID != "project-1" || principal.KeyID != "key-1" {
		t.Fatalf("unexpected principal: %+v", principal)
	}

	request.Header.Set("Authorization", "Bearer wrong")
	if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
		t.Fatalf("expected ErrUnauthorized, got %v", err)
	}
}

func TestDynamicAuthenticatorReplacesSnapshot(t *testing.T) {
	oldHash := sha256.Sum256([]byte("sk-old"))
	newHash := sha256.Sum256([]byte("sk-new"))
	authenticator := NewDynamic([]HashedKeyRecord{{
		Hash: oldHash,
		Principal: domain.Principal{
			KeyID: "old", TenantID: "tenant-1", ProjectID: "project-1", Scopes: []string{"inference"},
		},
	}}, false)

	request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
	request.Header.Set("Authorization", "Bearer sk-old")
	if _, err := authenticator.Authenticate(request); err != nil {
		t.Fatalf("old key should initially authenticate: %v", err)
	}

	authenticator.ReplaceHashed([]HashedKeyRecord{{
		Hash: newHash,
		Principal: domain.Principal{
			KeyID: "new", TenantID: "tenant-1", ProjectID: "project-1", Scopes: []string{"inference"},
		},
	}})
	if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
		t.Fatalf("old key remained valid after snapshot replacement: %v", err)
	}
	request.Header.Set("Authorization", "Bearer sk-new")
	principal, err := authenticator.Authenticate(request)
	if err != nil || principal.KeyID != "new" {
		t.Fatalf("new key was not loaded: principal=%+v err=%v", principal, err)
	}
}

func TestStaticAuthenticatorAcceptsAnthropicHeader(t *testing.T) {
	authenticator, err := NewStatic(`[{"key":"sk-client","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1"}]`, false)
	if err != nil {
		t.Fatal(err)
	}
	request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/anthropic/v1/models", nil)
	request.Header.Set("x-api-key", "sk-client")
	if _, err := authenticator.Authenticate(request); err != nil {
		t.Fatal(err)
	}
}