package middleware

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/require"
)

func TestCSRFSkipsChatwootAuthRoutes(t *testing.T) {
	gin.SetMode(gin.TestMode)
	router := gin.New()
	router.Use(CSRF(CSRFConfig{
		Enabled:        true,
		Secret:         "test-secret",
		CookieName:     "_gochat_csrf",
		HeaderName:     "X-CSRF-Token",
		TokenLength:    32,
		SafeMethods:    []string{"GET", "HEAD", "OPTIONS"},
		SkipPaths:      []string{"/auth/"},
		CookiePath:     "/",
		CookieSameSite: "Lax",
	}))
	router.POST("/auth/sign_in", func(c *gin.Context) { c.Status(http.StatusOK) })

	recorder := httptest.NewRecorder()
	request := httptest.NewRequest(http.MethodPost, "/auth/sign_in", nil)
	router.ServeHTTP(recorder, request)

	require.Equal(t, http.StatusOK, recorder.Code)
}

func TestCSRFSkipsTokenAuthenticatedAPIRoutes(t *testing.T) {
	gin.SetMode(gin.TestMode)
	router := gin.New()
	router.Use(CSRF(CSRFConfig{
		Enabled:        true,
		Secret:         "test-secret",
		CookieName:     "_gochat_csrf",
		HeaderName:     "X-CSRF-Token",
		TokenLength:    32,
		SafeMethods:    []string{"GET", "HEAD", "OPTIONS"},
		SkipPaths:      []string{"/api/v1/"},
		CookiePath:     "/",
		CookieSameSite: "Lax",
	}))
	router.POST("/api/v1/accounts/:account_id/conversations/:conversation_id/messages", func(c *gin.Context) { c.Status(http.StatusOK) })

	recorder := httptest.NewRecorder()
	request := httptest.NewRequest(http.MethodPost, "/api/v1/accounts/1/conversations/1/messages", nil)
	router.ServeHTTP(recorder, request)

	require.Equal(t, http.StatusOK, recorder.Code)
}