using System.Net;
using System.Net.Http.Json;
using Bff.Api;

namespace Bff.Tests;

public class OpenbaarEndpointTests
{
    [Fact]
    public async Task Serves_public_safe_rows_anonymously()
    {
        using var factory = new BffFactory();
        factory.Projection.Entries.Add(new ProjectionEntry("abc-111", "INGEDIEND", "REG-abc", "123456782", "Jan"));

        // No Authorization header — the openbaar register is a public lookup (ADR-0010/S-09).
        var response = await factory.CreateClient().GetAsync("/openbaar/register");

        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        var body = await response.Content.ReadAsStringAsync();
        Assert.Contains("abc-111", body);
        Assert.Contains("INGEDIEND", body);
        // The public reference is surfaced (matches the submit confirmation, #78)...
        Assert.Contains("REG-abc", body);
        // ...but the bsn must never appear in a public response.
        Assert.DoesNotContain("123456782", body);
    }

    [Fact]
    public async Task Filters_by_the_query_parameter()
    {
        using var factory = new BffFactory();
        factory.Projection.Entries.Add(new ProjectionEntry("abc-111", "INGEDIEND", "REG-abc", null, null));
        factory.Projection.Entries.Add(new ProjectionEntry("def-222", "INGEDIEND", "REG-def", null, null));

        var rows = await factory.CreateClient()
            .GetFromJsonAsync<List<OpenbaarEntry>>("/openbaar/register?q=abc");

        Assert.Equal("abc-111", Assert.Single(rows!).Id);
    }
}