gochat/backend/internal/middleware/platform_app_auth_test.go

package middleware

import (
	"crypto/sha256"
	"encoding/hex"
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	"github.com/gochat/gochat/internal/model"
	"github.com/gochat/gochat/pkg/testutil"
	"gorm.io/gorm"
)

// newPlatformTestDB creates a test DB with PlatformApp, AccessToken, and Permissible tables.
func newPlatformTestDB(t *testing.T) *gorm.DB {
	t.Helper()
	return testutil.NewTestDBWithModels(t,
		&model.PlatformApp{},
		&model.AccessToken{},
		&model.Permissible{},
	)
}

func TestPlatformAppAuth_ValidToken(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	// Create a PlatformApp
	pa := model.PlatformApp{Name: "TestApp", Active: ptrBool(true)}
	require.NoError(t, db.Create(&pa).Error)

	// Create AccessToken for the PlatformApp
	rawToken := "test-platform-token-12345"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		appID, exists := c.Get("platform_app_id")
		assert.True(t, exists)
		assert.Equal(t, pa.ID, appID)
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 200, w.Code)
}

func TestPlatformAppAuth_MissingToken(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	router.ServeHTTP(w, req)

	assert.Equal(t, 401, w.Code)
}

func TestPlatformAppAuth_InvalidToken(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", "invalid-token")
	router.ServeHTTP(w, req)

	assert.Equal(t, 401, w.Code)
}

func TestPlatformAppAuth_InactiveOrDisabledAppRejected(t *testing.T) {
	for _, tc := range []struct {
		name   string
		active *bool
		status string
	}{
		{name: "inactive", active: ptrBool(false), status: "active"},
		{name: "disabled", active: ptrBool(true), status: "disabled"},
	} {
		t.Run(tc.name, func(t *testing.T) {
			db := newPlatformTestDB(t)
			pa := model.PlatformApp{Name: tc.name, Active: tc.active, Status: tc.status}
			require.NoError(t, db.Create(&pa).Error)

			rawToken := "inactive-platform-token"
			hash := sha256.Sum256([]byte(rawToken))
			require.NoError(t, db.Create(&model.AccessToken{
				OwnerType:   model.AccessTokenOwnerTypePlatformApp,
				OwnerID:     pa.ID,
				Token:       hex.EncodeToString(hash[:]),
				TokenPrefix: rawToken[:8],
			}).Error)

			router := gin.New()
			router.Use(PlatformAppAuth(db))
			router.GET("/test", func(c *gin.Context) { c.Status(http.StatusOK) })

			w := httptest.NewRecorder()
			req := httptest.NewRequest(http.MethodGet, "/test", nil)
			req.Header.Set("api_access_token", rawToken)
			router.ServeHTTP(w, req)

			assert.Equal(t, http.StatusUnauthorized, w.Code)
		})
	}
}

func TestPlatformAppAuth_ExpiredTokenRejected(t *testing.T) {
	db := newPlatformTestDB(t)
	pa := model.PlatformApp{Name: "ExpiredTokenApp", Active: ptrBool(true), Status: "active"}
	require.NoError(t, db.Create(&pa).Error)

	rawToken := "expired-platform-token"
	hash := sha256.Sum256([]byte(rawToken))
	expiresAt := time.Now().Add(-time.Minute)
	require.NoError(t, db.Create(&model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       hex.EncodeToString(hash[:]),
		TokenPrefix: rawToken[:8],
		ExpiresAt:   &expiresAt,
	}).Error)

	router := gin.New()
	router.Use(PlatformAppAuth(db))
	router.GET("/test", func(c *gin.Context) { c.Status(http.StatusOK) })

	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, http.StatusUnauthorized, w.Code)
}

func TestPlatformAppAuth_UserTokenRejected(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	// Create a User-type AccessToken (should be rejected by PlatformAuth)
	rawToken := "user-personal-token"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypeUser,
		OwnerID:     999,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 401, w.Code)
}

func TestPlatformAppAuth_HTTP_API_ACCESS_TOKEN_Header(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	pa := model.PlatformApp{Name: "TestApp2", Active: ptrBool(true)}
	require.NoError(t, db.Create(&pa).Error)

	rawToken := "test-http-header-token"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("HTTP_API_ACCESS_TOKEN", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 200, w.Code)
}

func TestPlatformAppAuth_ContextValues(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	pa := model.PlatformApp{Name: "ContextTestApp", Active: ptrBool(true)}
	require.NoError(t, db.Create(&pa).Error)

	rawToken := "context-test-token"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		// Verify all context values are set correctly
		platformApp, exists := c.Get("platform_app")
		assert.True(t, exists)
		app := platformApp.(model.PlatformApp)
		assert.Equal(t, pa.ID, app.ID)
		assert.Equal(t, pa.Name, app.Name)

		appID, exists := c.Get("platform_app_id")
		assert.True(t, exists)
		assert.Equal(t, pa.ID, appID)

		tokenID, exists := c.Get("access_token_id")
		assert.True(t, exists)
		assert.Equal(t, at.ID, tokenID)

		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 200, w.Code)
}

func ptrBool(b bool) *bool { return &b }