using System.Net;
using BigRegister.Domain.Authorization;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.TestHost;
using Microsoft.Extensions.DependencyInjection;

namespace BigRegister.Tests;

/// RB-15/BIO-015: `app.UseSwagger()`/`app.UseSwaggerUI()` used to run unconditionally — the
/// OpenAPI document (every route + request/response shape) and SwaggerUI's "Try it out" were
/// reachable in every environment, including a real deployment. Both are now gated behind
/// `app.Environment.IsDevelopment()`.
public class SwaggerGateTests(TestWebApplicationFactory factory) : IClassFixture<TestWebApplicationFactory>
{
  [Fact]
  public async Task Swagger_document_is_served_in_development()
  {
    // The default test environment (WebApplicationFactory<T> defaults to "Development" when
    // nothing overrides it — same fact RB-09's implementation note relies on) — this is the
    // regression guard that the gate didn't also break the documented `npm run gen:api` /
    // local-dev-Swagger-UI experience.
    var res = await factory.CreateClient().GetAsync("/swagger/v1/swagger.json");
    Assert.Equal(HttpStatusCode.OK, res.StatusCode);
  }

  /// Production cannot boot at all today (RB-09: no real IIdentityProvider exists yet), which
  /// is a *stronger* guarantee than "no Swagger in Production" — but it also means a plain
  /// `UseEnvironment("Production")` host never reaches this middleware to prove the gate
  /// itself works, only that the whole app refuses to start. This uses a third environment
  /// name (neither "Development" nor "Production") with a test-supplied `IIdentityProvider` —
  /// the one thing Program.cs doesn't register outside those two branches — so the host
  /// actually boots and this test exercises the real gate, not RB-09's unrelated startup throw.
  [Fact]
  public async Task Swagger_document_is_not_served_outside_development()
  {
    // Built on top of the shared `factory` fixture (via WithWebHostBuilder), not a bare `new
    // WebApplicationFactory<Program>()` — that keeps this host on the fixture's own per-class
    // isolated AppDb temp path (see TestWebApplicationFactory's doc comment; RB-12's
    // implementation note records the "table already exists" collision a bare factory hits
    // by sharing the mutable static Db.ConnectionString instead).
    using var staging = factory.WithWebHostBuilder(builder => builder
        .UseEnvironment("Staging")
        .ConfigureTestServices(services => services.AddSingleton<IIdentityProvider, StubIdentityProvider>()));

    var res = await staging.CreateClient().GetAsync("/swagger/v1/swagger.json");
    Assert.Equal(HttpStatusCode.NotFound, res.StatusCode);
  }
}