package middleware

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func init() {
	gin.SetMode(gin.TestMode)
}

// --- CSRF tests ---

func TestDefaultCSRFConfig_Cov2(t *testing.T) {
	cfg := DefaultCSRFConfig()
	assert.True(t, cfg.Enabled)
	assert.Equal(t, "_gochat_csrf", cfg.CookieName)
	assert.Equal(t, "X-CSRF-Token", cfg.HeaderName)
	assert.Equal(t, 32, cfg.TokenLength)
}

func TestGenerateCSRFSecret_Cov2(t *testing.T) {
	s := generateCSRFSecret()
	assert.NotEmpty(t, s)
	assert.Len(t, s, 64) // 32 bytes hex = 64 chars
}

func TestGenerateCSRFToken_Cov2(t *testing.T) {
	tok := generateCSRFToken("secret", 16)
	assert.NotEmpty(t, tok)
}

// --- SecurityHeaders tests ---

func TestDefaultSecurityHeadersConfig_Cov2(t *testing.T) {
	cfg := DefaultSecurityHeadersConfig()
	assert.NotZero(t, cfg.HSTSMaxAge)
}

func TestSecurityHeaders_Cov2(t *testing.T) {
	cfg := DefaultSecurityHeadersConfig()
	router := gin.New()
	router.Use(SecurityHeaders(cfg))
	router.GET("/test", func(c *gin.Context) { c.String(200, "ok") })

	w := httptest.NewRecorder()
	req := httptest.NewRequest("GET", "/test", nil)
	router.ServeHTTP(w, req)
	assert.Equal(t, 200, w.Code)
	assert.NotEmpty(t, w.Header().Get("X-Frame-Options"))
}

func TestItoa_Cov2(t *testing.T) {
	assert.Equal(t, "42", itoa(42))
}

// --- RoleCheck tests ---

func TestRoleCheck_NoPolicyContext_Cov2(t *testing.T) {
	router := gin.New()
	router.Use(RoleCheck("admin"))
	router.GET("/test", func(c *gin.Context) { c.String(200, "ok") })

	w := httptest.NewRecorder()
	req := httptest.NewRequest("GET", "/test", nil)
	router.ServeHTTP(w, req)
	assert.Equal(t, http.StatusForbidden, w.Code)
}

func TestRoleCheckAny_NoPolicyContext_Cov2(t *testing.T) {
	router := gin.New()
	router.Use(RoleCheckAny("admin", "agent"))
	router.GET("/test", func(c *gin.Context) { c.String(200, "ok") })

	w := httptest.NewRecorder()
	req := httptest.NewRequest("GET", "/test", nil)
	router.ServeHTTP(w, req)
	assert.Equal(t, http.StatusForbidden, w.Code)
}

func TestFormatRoles_Cov2(t *testing.T) {
	s := formatRoles([]string{"admin", "agent"})
	assert.Contains(t, s, "admin")
	assert.Contains(t, s, "agent")
}

// --- SuperAdmin tests ---

func TestIsSuperAdminType_Cov2(t *testing.T) {
	assert.True(t, isSuperAdminType("super_admin"))
	assert.True(t, isSuperAdminType("SuperAdmin"))
	assert.False(t, isSuperAdminType("admin"))
	assert.False(t, isSuperAdminType(123))
}

// --- UploadSecurity tests ---

func TestDefaultUploadSecurityConfig_Cov2(t *testing.T) {
	cfg := DefaultUploadSecurityConfig()
	assert.NotNil(t, cfg)
	assert.NotEmpty(t, cfg.AllowedExtensions)
}

func TestSanitizeFilename_Cov2(t *testing.T) {
	assert.Equal(t, "test.txt", sanitizeFilename("test.txt"))
	assert.NotContains(t, sanitizeFilename("../../etc/passwd"), "..")
}

func TestValidateFileExtension_Cov2(t *testing.T) {
	cfg := DefaultUploadSecurityConfig()
	assert.True(t, validateFileExtension("test.png", cfg))
	assert.False(t, validateFileExtension("test.exe", cfg))
}

func TestValidateMIMEType_Cov2(t *testing.T) {
	cfg := DefaultUploadSecurityConfig()
	assert.True(t, validateMIMEType("image/png", cfg))
	assert.False(t, validateMIMEType("application/x-msdownload", cfg))
}

func TestDetectMIMEType_Cov2(t *testing.T) {
	// PNG magic bytes
	pngHeader := []byte{0x89, 0x50, 0x4E, 0x47}
	mime := detectMIMEType(pngHeader)
	assert.NotEmpty(t, mime)
}

// --- XSSProtection tests ---

func TestDefaultXSSProtectionConfig_Cov2(t *testing.T) {
	cfg := DefaultXSSProtectionConfig()
	assert.NotNil(t, cfg)
}

func TestSanitizeHTML_Cov2(t *testing.T) {
	policy := UGCPolicy()
	result := SanitizeHTML("<script>alert('xss')</script><p>hello</p>", policy)
	assert.NotContains(t, result, "<script>")
	assert.Contains(t, result, "hello")
}

func TestEscapeJSONHTML_Cov2(t *testing.T) {
	data := map[string]string{"key": "<script>alert('xss')</script>"}
	result, err := EscapeJSONHTML(data)
	require.NoError(t, err)
	assert.NotContains(t, string(result), "<script>")
}

// --- PolicyMiddleware tests ---

func TestPolicyMiddleware_Cov2(t *testing.T) {
	router := gin.New()
	router.Use(func(c *gin.Context) { c.Set("user_id", uint(1)); c.Next() })
	router.Use(PolicyMiddleware("conversation", "read"))
	router.GET("/test", func(c *gin.Context) { c.String(200, "ok") })

	w := httptest.NewRecorder()
	req := httptest.NewRequest("GET", "/test", nil)
	router.ServeHTTP(w, req)
	// May return 200 or 403 depending on policy evaluation
	assert.NotEmpty(t, w.Code)
}

// --- SessionMiddleware tests ---

func TestDefaultSessionMiddlewareConfig_Cov2(t *testing.T) {
	cfg := DefaultSessionMiddlewareConfig()
	assert.NotEmpty(t, cfg.SessionHeader)
}