prop/test/microwaveprop_web/controllers/api/v1/auth_controller_test.exs

defmodule MicrowavepropWeb.Api.V1.AuthControllerTest do
  use MicrowavepropWeb.ConnCase, async: true

  alias Microwaveprop.AccountsFixtures
  alias MicrowavepropWeb.Api.RateLimiter

  @password AccountsFixtures.valid_user_password()

  setup do
    RateLimiter.reset()
    user = AccountsFixtures.user_fixture()
    %{user: user}
  end

  describe "POST /api/v1/auth/tokens" do
    test "issues a bearer token for valid credentials", %{conn: conn, user: user} do
      conn =
        post(conn, ~p"/api/v1/auth/tokens", %{
          "email" => user.email,
          "password" => @password,
          "name" => "Test laptop"
        })

      assert %{"token" => token, "data" => data} = json_response(conn, 201)
      assert String.starts_with?(token, "mwp_")
      assert data["name"] == "Test laptop"
      assert is_nil(data["last_used_at"])
      assert is_nil(data["revoked_at"])
    end

    test "rejects bad credentials with 401", %{conn: conn, user: user} do
      conn =
        post(conn, ~p"/api/v1/auth/tokens", %{
          "email" => user.email,
          "password" => "wrong",
          "name" => "x"
        })

      assert %{"detail" => "Invalid email or password.", "status" => 401} = json_response(conn, 401)
    end

    test "rejects bad credentials when user does not exist", %{conn: conn} do
      conn =
        post(conn, ~p"/api/v1/auth/tokens", %{
          "email" => "ghost@nope.example",
          "password" => "anything",
          "name" => "x"
        })

      assert json_response(conn, 401)
    end

    for missing <- ["email", "password", "name"] do
      test "rejects missing #{missing} with 400", %{conn: conn, user: user} do
        body = Map.delete(%{"email" => user.email, "password" => @password, "name" => "x"}, unquote(missing))

        conn = post(conn, ~p"/api/v1/auth/tokens", body)
        assert %{"status" => 400} = json_response(conn, 400)
      end
    end

    test "accepts an ISO 8601 expires_at", %{conn: conn, user: user} do
      future = DateTime.utc_now() |> DateTime.add(3600, :second) |> DateTime.to_iso8601()

      conn =
        post(conn, ~p"/api/v1/auth/tokens", %{
          "email" => user.email,
          "password" => @password,
          "name" => "x",
          "expires_at" => future
        })

      assert %{"data" => %{"expires_at" => exp}} = json_response(conn, 201)
      assert byte_size(exp) > 0
    end

    test "rejects malformed expires_at via changeset 422", %{conn: conn, user: user} do
      conn =
        post(conn, ~p"/api/v1/auth/tokens", %{
          "email" => user.email,
          "password" => @password,
          "name" => "x",
          "expires_at" => "garbage"
        })

      assert %{"status" => 422} = json_response(conn, 422)
    end

    test "treats blank expires_at as no expiry", %{conn: conn, user: user} do
      conn =
        post(conn, ~p"/api/v1/auth/tokens", %{
          "email" => user.email,
          "password" => @password,
          "name" => "x",
          "expires_at" => ""
        })

      assert %{"data" => %{"expires_at" => nil}} = json_response(conn, 201)
    end

    test "rejects non-string expires_at via changeset 422", %{conn: conn, user: user} do
      conn =
        post(conn, ~p"/api/v1/auth/tokens", %{
          "email" => user.email,
          "password" => @password,
          "name" => "x",
          "expires_at" => 123
        })

      assert %{"status" => 422} = json_response(conn, 422)
    end

    test "rejects expires_at in the past via changeset 422", %{conn: conn, user: user} do
      past = DateTime.utc_now() |> DateTime.add(-1, :second) |> DateTime.to_iso8601()

      conn =
        post(conn, ~p"/api/v1/auth/tokens", %{
          "email" => user.email,
          "password" => @password,
          "name" => "x",
          "expires_at" => past
        })

      assert %{"errors" => %{"expires_at" => _}} = json_response(conn, 422)
    end
  end
end