package com.xuqm.tenant.controller;

import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;

import com.xuqm.tenant.service.ApiKeyService;
import com.xuqm.tenant.service.FeatureServiceManager;
import com.xuqm.tenant.service.InternalRequestAuthorizer;
import com.xuqm.tenant.service.SdkAppProvisioningService;
import org.junit.jupiter.api.Test;

class InternalSdkControllerTest {

    @Test
    void validatesApiKeyFromProtectedPostBody() {
        ApiKeyService apiKeyService = mock(ApiKeyService.class);
        when(apiKeyService.validateApiKey("secret-api-token")).thenReturn("ak_test");
        InternalSdkController controller = new InternalSdkController(
                mock(SdkAppProvisioningService.class),
                mock(FeatureServiceManager.class),
                apiKeyService,
                mock(com.xuqm.tenant.service.ConfigFileSigningService.class),
                mock(com.xuqm.tenant.repository.AppRepository.class),
                new com.fasterxml.jackson.databind.ObjectMapper(),
                new InternalRequestAuthorizer("internal-only"));

        var response = controller.validateApiKey(
                new InternalSdkController.ApiKeyValidationRequest("secret-api-token"),
                "internal-only");

        assertThat(response.getStatusCode().value()).isEqualTo(200);
        assertThat(response.getBody()).isNotNull();
        assertThat(response.getBody().data()).containsEntry("appKey", "ak_test");
        verify(apiKeyService).validateApiKey("secret-api-token");
    }
}