PR-Helper/handlers/middleware_test.go

package handlers

import (
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"github.com/HoHD/PR-Helper/models"
	"github.com/gin-gonic/gin"
)

func init() {
	gin.SetMode(gin.TestMode)
}

func TestGetCurrentUser_WithUser(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)

	user := &models.User{
		ID:        42,
		Email:     "test@example.com",
		CreatedAt: time.Now(),
		UpdatedAt: time.Now(),
	}
	c.Set("user", user)

	got := GetCurrentUser(c)
	if got == nil {
		t.Fatal("GetCurrentUser() returned nil")
	}
	if got.ID != 42 {
		t.Errorf("ID = %d, want 42", got.ID)
	}
	if got.Email != "test@example.com" {
		t.Errorf("Email = %q, want %q", got.Email, "test@example.com")
	}
}

func TestGetCurrentUser_NoUser(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)

	got := GetCurrentUser(c)
	if got != nil {
		t.Errorf("GetCurrentUser() = %v, want nil", got)
	}
}

func TestGetCurrentUser_WrongType(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)

	// Set a non-User value — should panic or return nil
	defer func() {
		if r := recover(); r == nil {
			// If it doesn't panic, GetCurrentUser should still work somehow
			// This documents the current behavior
		}
	}()
	c.Set("user", "not-a-user")

	// This will panic because of type assertion — that's expected behavior
	GetCurrentUser(c)
}

func TestAuthRequired_NoSession_APIRequest(t *testing.T) {
	// AuthRequired needs a *sql.DB, but for the no-session case
	// it should respond 401 before hitting the DB.
	// We can't easily test this without a session store setup,
	// so we test the path detection logic instead.

	// Test that /api/ prefix is correctly detected
	apiPaths := []string{"/api/repos", "/api/settings", "/api/repos/1/graph"}
	pagePaths := []string{"/", "/login", "/register", "/settings"}

	for _, path := range apiPaths {
		if !isAPIPath(path) {
			t.Errorf("isAPIPath(%q) = false, want true", path)
		}
	}
	for _, path := range pagePaths {
		if isAPIPath(path) {
			t.Errorf("isAPIPath(%q) = true, want false", path)
		}
	}
}

// isAPIPath replicates the path check logic from AuthRequired for testing.
func isAPIPath(path string) bool {
	return len(path) > 4 && path[:5] == "/api/"
}

func TestUserData_WithUser(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)

	user := &models.User{
		ID:    1,
		Email: "user@test.com",
	}
	c.Set("user", user)

	data := userData(c)
	if data["User"] == nil {
		t.Error("expected User in data")
	}
	u := data["User"].(*models.User)
	if u.ID != 1 {
		t.Errorf("User.ID = %d, want 1", u.ID)
	}
}

func TestUserData_NoUser(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)

	data := userData(c)
	if data["User"] != nil {
		t.Error("expected nil User in data")
	}
}

func TestNewSettingsHandler(t *testing.T) {
	h := NewSettingsHandler(nil)
	if h == nil {
		t.Fatal("NewSettingsHandler() returned nil")
	}
}

func TestNewPageHandler(t *testing.T) {
	h := NewPageHandler(nil)
	if h == nil {
		t.Fatal("NewPageHandler() returned nil")
	}
}

func TestNewReposHandler(t *testing.T) {
	h := NewReposHandler(nil, "/tmp/repos")
	if h == nil {
		t.Fatal("NewReposHandler() returned nil")
	}
}

func TestNewGenerateHandler(t *testing.T) {
	h := NewGenerateHandler(nil)
	if h == nil {
		t.Fatal("NewGenerateHandler() returned nil")
	}
}

func TestNewReviewHandler(t *testing.T) {
	h := NewReviewHandler(nil)
	if h == nil {
		t.Fatal("NewReviewHandler() returned nil")
	}
}

func TestNewAuthHandler(t *testing.T) {
	h := NewAuthHandler(nil)
	if h == nil {
		t.Fatal("NewAuthHandler() returned nil")
	}
}

// TestDirSize_Handlers tests the handlers package's own dirSize function.
func TestDirSize_Handlers(t *testing.T) {
	tmpDir := t.TempDir()

	size := dirSize(tmpDir)
	if size != 0 {
		t.Errorf("dirSize() = %d, want 0", size)
	}
}

// TestHandlerListRepos_Unauthorized tests that ListRepos returns 401 without user.
func TestHandlerListRepos_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodGet, "/api/repos", nil)

	h := NewReposHandler(nil, "/tmp/repos")
	h.ListRepos(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerDeleteRepo_Unauthorized tests that DeleteRepo returns 401 without user.
func TestHandlerDeleteRepo_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodDelete, "/api/repos/1", nil)

	h := NewReposHandler(nil, "/tmp/repos")
	h.DeleteRepo(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerGetSettings_Unauthorized tests that GetSettings returns 401 without user.
func TestHandlerGetSettings_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodGet, "/api/settings", nil)

	h := NewSettingsHandler(nil)
	h.GetSettings(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerUpdateSettings_Unauthorized tests that UpdateSettings returns 401 without user.
func TestHandlerUpdateSettings_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodPut, "/api/settings", nil)

	h := NewSettingsHandler(nil)
	h.UpdateSettings(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerGenerate_Unauthorized tests that Generate returns 401 without user.
func TestHandlerGenerate_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodPost, "/api/repos/1/generate", nil)

	h := NewGenerateHandler(nil)
	h.Generate(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerReview_Unauthorized tests that Review returns 401 without user.
func TestHandlerReview_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodPost, "/api/repos/1/review", nil)

	h := NewReviewHandler(nil)
	h.Review(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerSaveNotes_Unauthorized tests that SaveNotes returns 401 without user.
func TestHandlerSaveNotes_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodPost, "/api/repos/1/review/notes", nil)

	h := NewReviewHandler(nil)
	h.SaveNotes(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerGetNotes_Unauthorized tests that GetNotes returns 401 without user.
func TestHandlerGetNotes_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodGet, "/api/repos/1/review/notes", nil)

	h := NewReviewHandler(nil)
	h.GetNotes(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerListReviews_Unauthorized tests that ListReviews returns 401 without user.
func TestHandlerListReviews_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodGet, "/api/repos/1/review/analyses", nil)

	h := NewReviewHandler(nil)
	h.ListReviews(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerGetReview_Unauthorized tests that GetReview returns 401 without user.
func TestHandlerGetReview_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodGet, "/api/repos/1/review/analyses/1", nil)

	h := NewReviewHandler(nil)
	h.GetReview(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerGetGraph_Unauthorized tests that GetGraph returns 401 without user.
func TestHandlerGetGraph_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodGet, "/api/repos/1/graph", nil)

	h := NewReposHandler(nil, "/tmp/repos")
	h.GetGraph(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerGetDiff_Unauthorized tests that GetDiff returns 401 without user.
func TestHandlerGetDiff_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodGet, "/api/repos/1/diff", nil)

	h := NewReposHandler(nil, "/tmp/repos")
	h.GetDiff(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerGetRefs_Unauthorized tests that GetRefs returns 401 without user.
func TestHandlerGetRefs_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodGet, "/api/repos/1/refs", nil)

	h := NewReposHandler(nil, "/tmp/repos")
	h.GetRefs(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}

// TestHandlerGetCommits_Unauthorized tests that GetCommits returns 401 without user.
func TestHandlerGetCommits_Unauthorized(t *testing.T) {
	w := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(w)
	c.Request = httptest.NewRequest(http.MethodGet, "/api/repos/1/commits", nil)

	h := NewReposHandler(nil, "/tmp/repos")
	h.GetCommits(c)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status = %d, want %d", w.Code, http.StatusUnauthorized)
	}
}