gochat/internal/handler/api/v1/account_saml_settings_handler_test.go

package v1

import (
	"bytes"
	"fmt"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/suite"
	"gorm.io/driver/sqlite"
	"gorm.io/gorm"

	"github.com/gochat/gochat/internal/model"
	"github.com/gochat/gochat/internal/repository"
)

type AccountSamlSettingsHandlerTestSuite struct {
	suite.Suite
	db      *gorm.DB
	handler *AccountSamlSettingsHandler
	router  *gin.Engine
	account *model.Account
}

func (s *AccountSamlSettingsHandlerTestSuite) SetupSuite() {
	s.db, _ = gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
	s.db.AutoMigrate(&model.Account{}, &model.AccountSamlSettings{})

	repo := repository.NewAccountSamlSettingsRepo(s.db)
	s.handler = NewAccountSamlSettingsHandler(repo)

	gin.SetMode(gin.TestMode)
	r := gin.New()
	accountGroup := r.Group("/api/v1/accounts/:account_id")
	accountGroup.GET("/saml_settings", s.handler.Get)
	accountGroup.POST("/saml_settings", s.handler.Create)
	accountGroup.PUT("/saml_settings/:saml_setting_id", s.handler.Update)
	accountGroup.DELETE("/saml_settings/:saml_setting_id", s.handler.Delete)
	accountGroup.POST("/saml_settings/:saml_setting_id/toggle_active", s.handler.ToggleActive)
	s.router = r

	s.account = &model.Account{Name: "TestAccount"}
	s.db.Create(s.account)
}

func (s *AccountSamlSettingsHandlerTestSuite) SetupTest() {
	s.db.Exec("DELETE FROM account_saml_settings")
}

func TestAccountSamlSettingsHandlerTestSuite(t *testing.T) {
	suite.Run(t, new(AccountSamlSettingsHandlerTestSuite))
}

func (s *AccountSamlSettingsHandlerTestSuite) TestGet_InvalidAccountID() {
	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/v1/accounts/abc/saml_settings", nil)
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusBadRequest, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestGet_NotFound() {
	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), nil)
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusNotFound, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestGet_Success() {
	settings := &model.AccountSamlSettings{
		AccountID:       s.account.ID,
		IdpEntityID:     "entity-id",
		IdpSsoTargetURL: "https://sso.example.com",
	}
	s.db.Create(settings)

	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), nil)
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusOK, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestCreate_InvalidAccountID() {
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"idp_entity_id":"eid","idp_sso_target_url":"https://sso.example.com"}`)
	req := httptest.NewRequest(http.MethodPost, "/api/v1/accounts/abc/saml_settings", body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusBadRequest, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestCreate_Success() {
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(fmt.Sprintf(`{"account_id":%d,"idp_entity_id":"eid","idp_sso_target_url":"https://sso.example.com","idp_certificate":"cert"}`, s.account.ID))
	req := httptest.NewRequest(http.MethodPost, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusCreated, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestCreate_MissingRequiredFields() {
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"account_id":0}`)
	req := httptest.NewRequest(http.MethodPost, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.True(w.Code == http.StatusBadRequest || w.Code == http.StatusUnprocessableEntity, "expected 400 or 500, got %d", w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestUpdate_InvalidAccountID() {
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"idp_entity_id":"updated-eid"}`)
	req := httptest.NewRequest(http.MethodPut, "/api/v1/accounts/abc/saml_settings/1", body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusBadRequest, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestUpdate_Success() {
	settings := &model.AccountSamlSettings{
		AccountID:       s.account.ID,
		IdpEntityID:     "entity-id",
		IdpSsoTargetURL: "https://sso.example.com",
	}
	s.db.Create(settings)

	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"idp_entity_id":"updated-eid"}`)
	req := httptest.NewRequest(http.MethodPut, fmt.Sprintf("/api/v1/accounts/%d/saml_settings/%d", s.account.ID, settings.ID), body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusOK, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestUpdate_NotFound() {
	// account_id valid, but no settings exist for this account → repo returns "record not found" → 404
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"idp_entity_id":"updated-eid"}`)
	req := httptest.NewRequest(http.MethodPut, fmt.Sprintf("/api/v1/accounts/%d/saml_settings/999", s.account.ID), body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusNotFound, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestDelete_InvalidAccountID() {
	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodDelete, "/api/v1/accounts/abc/saml_settings/1", nil)
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusBadRequest, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestDelete_Success() {
	settings := &model.AccountSamlSettings{
		AccountID:       s.account.ID,
		IdpEntityID:     "entity-id",
		IdpSsoTargetURL: "https://sso.example.com",
	}
	s.db.Create(settings)

	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodDelete, fmt.Sprintf("/api/v1/accounts/%d/saml_settings/%d", s.account.ID, settings.ID), nil)
	s.router.ServeHTTP(w, req)
	// Handler returns 200 OK with message, not 204 NoContent
	s.Equal(http.StatusOK, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestToggleActive_InvalidAccountID() {
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"active":true}`)
	req := httptest.NewRequest(http.MethodPost, "/api/v1/accounts/abc/saml_settings/1/toggle_active", body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusBadRequest, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestToggleActive_Success() {
	settings := &model.AccountSamlSettings{
		AccountID:       s.account.ID,
		IdpEntityID:     "entity-id",
		IdpSsoTargetURL: "https://sso.example.com",
		Active:          false,
	}
	s.db.Create(settings)

	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"active":true}`)
	req := httptest.NewRequest(http.MethodPost, fmt.Sprintf("/api/v1/accounts/%d/saml_settings/%d/toggle_active", s.account.ID, settings.ID), body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusOK, w.Code)
}