defmodule AprsmeWeb.Plugs.ApiCSRFTest do
  use AprsmeWeb.ConnCase, async: true

  alias AprsmeWeb.Plugs.ApiCSRF

  test "allows JSON requests with XMLHttpRequest header", %{conn: conn} do
    conn =
      conn
      |> init_test_session(%{})
      |> put_req_header("content-type", "application/json")
      |> put_req_header("x-requested-with", "XMLHttpRequest")
      |> ApiCSRF.call([])

    refute conn.halted
  end

  test "rejects JSON requests with arbitrary bearer token", %{conn: conn} do
    conn =
      conn
      |> init_test_session(%{})
      |> put_req_header("content-type", "application/json")
      |> put_req_header("authorization", "Bearer definitely-not-valid")
      |> ApiCSRF.call([])

    assert conn.halted
    assert conn.status == 403
    assert Jason.decode!(conn.resp_body)["error"] == "CSRF protection failed"
  end

  test "allows non-JSON requests without CSRF headers", %{conn: conn} do
    conn =
      conn
      |> init_test_session(%{})
      |> put_req_header("content-type", "text/plain")
      |> ApiCSRF.call([])

    refute conn.halted
  end

  test "allows JSON with utf-8 content type and XHR header", %{conn: conn} do
    conn =
      conn
      |> init_test_session(%{})
      |> put_req_header("content-type", "application/json; charset=utf-8")
      |> put_req_header("x-requested-with", "XMLHttpRequest")
      |> ApiCSRF.call([])

    refute conn.halted
  end

  test "rejects JSON request with empty csrf-token header", %{conn: conn} do
    conn =
      conn
      |> init_test_session(%{})
      |> put_req_header("content-type", "application/json")
      |> put_req_header("x-csrf-token", "")
      |> ApiCSRF.call([])

    assert conn.halted
    assert conn.status == 403
  end

  test "rejects JSON request with token but no session token", %{conn: conn} do
    conn =
      conn
      |> init_test_session(%{})
      |> put_req_header("content-type", "application/json")
      |> put_req_header("x-csrf-token", "any-token")
      |> ApiCSRF.call([])

    assert conn.halted
  end

  test "rejects JSON request with mismatched csrf token", %{conn: conn} do
    conn =
      conn
      |> init_test_session(%{"_csrf_token" => "a-session-token"})
      |> put_req_header("content-type", "application/json")
      |> put_req_header("x-csrf-token", "wrong-token")
      |> ApiCSRF.call([])

    assert conn.halted
  end

  test "init/1 returns opts unchanged" do
    assert ApiCSRF.init([]) == []
    assert ApiCSRF.init(foo: :bar) == [foo: :bar]
  end
end