gochat/internal/handler/api/v1/account_saml_settings_handler_test.go

package v1

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/suite"
	"gorm.io/driver/sqlite"
	"gorm.io/gorm"

	"github.com/gochat/gochat/internal/model"
	"github.com/gochat/gochat/internal/repository"
)

type AccountSamlSettingsHandlerTestSuite struct {
	suite.Suite
	db      *gorm.DB
	handler *AccountSamlSettingsHandler
	router  *gin.Engine
	account *model.Account
}

func (s *AccountSamlSettingsHandlerTestSuite) SetupSuite() {
	s.db, _ = gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
	s.db.AutoMigrate(&model.Account{}, &model.AccountSamlSettings{})

	repo := repository.NewAccountSamlSettingsRepo(s.db)
	s.handler = NewAccountSamlSettingsHandler(repo)

	gin.SetMode(gin.TestMode)
	r := gin.New()
	RegisterAccountSamlSettingsRoutes(r.Group("/api/v1/accounts/:account_id/saml_settings"), s.handler)
	s.router = r

	s.account = &model.Account{Name: "TestAccount"}
	s.db.Create(s.account)
}

func (s *AccountSamlSettingsHandlerTestSuite) SetupTest() {
	s.db.Exec("DELETE FROM account_saml_settings")
}

func TestAccountSamlSettingsHandlerTestSuite(t *testing.T) {
	suite.Run(t, new(AccountSamlSettingsHandlerTestSuite))
}

func (s *AccountSamlSettingsHandlerTestSuite) TestGet_InvalidAccountID() {
	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/v1/accounts/abc/saml_settings", nil)
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusBadRequest, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestGet_NotFound() {
	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), nil)
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusNotFound, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestGet_Success() {
	settings := &model.AccountSamlSettings{
		AccountID:       s.account.ID,
		IdpEntityID:     "entity-id",
		IdpSsoTargetURL: "https://sso.example.com",
	}
	s.db.Create(settings)

	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), nil)
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusOK, w.Code)

	var payload map[string]interface{}
	s.Require().NoError(json.Unmarshal(w.Body.Bytes(), &payload))
	s.Equal("https://sso.example.com", payload["sso_url"])
	s.Equal("https://sso.example.com", payload["idp_sso_target_url"])
	s.Equal("entity-id", payload["idp_entity_id"])
	s.NotContains(payload, "data")
}

func (s *AccountSamlSettingsHandlerTestSuite) TestChatwootFrontendCollectionCRUDPayloads() {
	createBody := bytes.NewBufferString(`{"saml_settings":{"sso_url":"https://idp.example.com/saml","certificate":"-----BEGIN CERTIFICATE-----chatwoot-----END CERTIFICATE-----","idp_entity_id":"chatwoot-idp","role_mappings":{}}}`)
	createReq := httptest.NewRequest(http.MethodPost, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), createBody)
	createReq.Header.Set("Content-Type", "application/json")
	createRecorder := httptest.NewRecorder()
	s.router.ServeHTTP(createRecorder, createReq)
	s.Equal(http.StatusCreated, createRecorder.Code)

	var created map[string]interface{}
	s.Require().NoError(json.Unmarshal(createRecorder.Body.Bytes(), &created))
	s.NotZero(created["id"])
	s.Equal("https://idp.example.com/saml", created["sso_url"])
	s.Equal("https://idp.example.com/saml", created["idp_sso_target_url"])
	s.Equal("-----BEGIN CERTIFICATE-----chatwoot-----END CERTIFICATE-----", created["certificate"])
	s.Equal("-----BEGIN CERTIFICATE-----chatwoot-----END CERTIFICATE-----", created["idp_certificate"])
	s.Equal("chatwoot-idp", created["idp_entity_id"])
	s.NotEmpty(created["fingerprint"])
	s.NotContains(created, "data")
	s.NotContains(created, "success")

	getReq := httptest.NewRequest(http.MethodGet, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), nil)
	getRecorder := httptest.NewRecorder()
	s.router.ServeHTTP(getRecorder, getReq)
	s.Equal(http.StatusOK, getRecorder.Code)

	var fetched map[string]interface{}
	s.Require().NoError(json.Unmarshal(getRecorder.Body.Bytes(), &fetched))
	s.Equal(created["id"], fetched["id"])
	s.Equal("https://idp.example.com/saml", fetched["sso_url"])

	updateBody := bytes.NewBufferString(`{"saml_settings":{"sso_url":"https://idp.example.com/updated","certificate":"updated-certificate","idp_entity_id":"updated-idp"}}`)
	updateReq := httptest.NewRequest(http.MethodPut, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), updateBody)
	updateReq.Header.Set("Content-Type", "application/json")
	updateRecorder := httptest.NewRecorder()
	s.router.ServeHTTP(updateRecorder, updateReq)
	s.Equal(http.StatusOK, updateRecorder.Code)

	var updated map[string]interface{}
	s.Require().NoError(json.Unmarshal(updateRecorder.Body.Bytes(), &updated))
	s.Equal(created["id"], updated["id"])
	s.Equal("https://idp.example.com/updated", updated["sso_url"])
	s.Equal("https://idp.example.com/updated", updated["idp_sso_target_url"])
	s.Equal("updated-certificate", updated["certificate"])
	s.Equal("updated-certificate", updated["idp_certificate"])
	s.Equal("updated-idp", updated["idp_entity_id"])
	s.NotContains(updated, "data")

	deleteReq := httptest.NewRequest(http.MethodDelete, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), nil)
	deleteRecorder := httptest.NewRecorder()
	s.router.ServeHTTP(deleteRecorder, deleteReq)
	s.Equal(http.StatusOK, deleteRecorder.Code)

	afterDeleteReq := httptest.NewRequest(http.MethodGet, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), nil)
	afterDeleteRecorder := httptest.NewRecorder()
	s.router.ServeHTTP(afterDeleteRecorder, afterDeleteReq)
	s.Equal(http.StatusNotFound, afterDeleteRecorder.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestCreate_InvalidAccountID() {
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"idp_entity_id":"eid","idp_sso_target_url":"https://sso.example.com"}`)
	req := httptest.NewRequest(http.MethodPost, "/api/v1/accounts/abc/saml_settings", body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusBadRequest, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestCreate_Success() {
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(fmt.Sprintf(`{"account_id":%d,"idp_entity_id":"eid","idp_sso_target_url":"https://sso.example.com","idp_certificate":"cert"}`, s.account.ID))
	req := httptest.NewRequest(http.MethodPost, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusCreated, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestCreate_MissingRequiredFields() {
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"account_id":0}`)
	req := httptest.NewRequest(http.MethodPost, fmt.Sprintf("/api/v1/accounts/%d/saml_settings", s.account.ID), body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.True(w.Code == http.StatusBadRequest || w.Code == http.StatusUnprocessableEntity, "expected 400 or 500, got %d", w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestUpdate_InvalidAccountID() {
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"idp_entity_id":"updated-eid"}`)
	req := httptest.NewRequest(http.MethodPut, "/api/v1/accounts/abc/saml_settings", body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusBadRequest, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestUpdate_Success() {
	settings := &model.AccountSamlSettings{
		AccountID:       s.account.ID,
		IdpEntityID:     "entity-id",
		IdpSsoTargetURL: "https://sso.example.com",
	}
	s.db.Create(settings)

	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"idp_entity_id":"updated-eid"}`)
	req := httptest.NewRequest(http.MethodPut, fmt.Sprintf("/api/v1/accounts/%d/saml_settings/%d", s.account.ID, settings.ID), body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusOK, w.Code)

	var payload map[string]interface{}
	s.Require().NoError(json.Unmarshal(w.Body.Bytes(), &payload))
	s.Equal("updated-eid", payload["idp_entity_id"])
	s.NotContains(payload, "data")
}

func (s *AccountSamlSettingsHandlerTestSuite) TestUpdate_NotFound() {
	// account_id valid, but no settings exist for this account → repo returns "record not found" → 404
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"idp_entity_id":"updated-eid"}`)
	req := httptest.NewRequest(http.MethodPut, fmt.Sprintf("/api/v1/accounts/%d/saml_settings/999", s.account.ID), body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusNotFound, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestDelete_InvalidAccountID() {
	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodDelete, "/api/v1/accounts/abc/saml_settings", nil)
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusBadRequest, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestDelete_Success() {
	settings := &model.AccountSamlSettings{
		AccountID:       s.account.ID,
		IdpEntityID:     "entity-id",
		IdpSsoTargetURL: "https://sso.example.com",
	}
	s.db.Create(settings)

	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodDelete, fmt.Sprintf("/api/v1/accounts/%d/saml_settings/%d", s.account.ID, settings.ID), nil)
	s.router.ServeHTTP(w, req)
	// Handler returns 200 OK with message, not 204 NoContent
	s.Equal(http.StatusOK, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestToggleActive_InvalidAccountID() {
	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"active":true}`)
	req := httptest.NewRequest(http.MethodPost, "/api/v1/accounts/abc/saml_settings/1/toggle_active", body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusBadRequest, w.Code)
}

func (s *AccountSamlSettingsHandlerTestSuite) TestToggleActive_Success() {
	settings := &model.AccountSamlSettings{
		AccountID:       s.account.ID,
		IdpEntityID:     "entity-id",
		IdpSsoTargetURL: "https://sso.example.com",
		Active:          false,
	}
	s.db.Create(settings)

	w := httptest.NewRecorder()
	body := bytes.NewBufferString(`{"active":true}`)
	req := httptest.NewRequest(http.MethodPost, fmt.Sprintf("/api/v1/accounts/%d/saml_settings/%d/toggle_active", s.account.ID, settings.ID), body)
	req.Header.Set("Content-Type", "application/json")
	s.router.ServeHTTP(w, req)
	s.Equal(http.StatusOK, w.Code)
}