towerops/test/towerops_web/controllers/api/mobile_controller_test.exs

defmodule ToweropsWeb.Api.MobileControllerTest do
  use ToweropsWeb.ConnCase, async: true

  import Towerops.AccountsFixtures

  alias Towerops.MobileSessions
  alias Towerops.Organizations

  setup do
    user = user_fixture()
    {:ok, organization} = Organizations.create_organization(%{name: "Test Org"}, user.id)

    {:ok, session} =
      MobileSessions.create_mobile_session(%{
        user_id: user.id,
        device_name: "Test iPhone"
      })

    conn = put_req_header(build_conn(), "authorization", "Bearer #{session.raw_token}")

    %{conn: conn, user: user, organization: organization, session: session}
  end

  describe "list_organizations" do
    test "returns user organizations", %{conn: conn} do
      conn = get(conn, ~p"/api/v1/mobile/organizations")

      assert %{"organizations" => orgs} = json_response(conn, 200)
      assert orgs != []
      assert hd(orgs)["name"] == "Test Org"
    end
  end

  describe "list_sites" do
    test "returns sites for organization", %{conn: conn, organization: org} do
      {:ok, _site} =
        Towerops.Sites.create_site(%{
          name: "Test Site",
          organization_id: org.id
        })

      conn = get(conn, ~p"/api/v1/mobile/organizations/#{org.id}/sites")

      assert %{"sites" => sites} = json_response(conn, 200)
      assert length(sites) == 1
      assert hd(sites)["name"] == "Test Site"
    end

    test "returns forbidden for non-member organization", %{conn: conn} do
      other_user = user_fixture()
      {:ok, other_org} = Organizations.create_organization(%{name: "Other Org"}, other_user.id)

      conn = get(conn, ~p"/api/v1/mobile/organizations/#{other_org.id}/sites")

      assert json_response(conn, 403)["error"] =~ "Access denied"
    end
  end

  describe "list_alerts" do
    test "returns alerts for organization", %{conn: conn, organization: org} do
      conn = get(conn, ~p"/api/v1/mobile/organizations/#{org.id}/alerts")

      assert %{"alerts" => _alerts} = json_response(conn, 200)
    end

    test "handles malformed limit parameter without crashing", %{conn: conn, organization: org} do
      # Non-numeric limit should default to 50 instead of crashing
      conn = get(conn, ~p"/api/v1/mobile/organizations/#{org.id}/alerts?limit=abc")

      assert %{"alerts" => _alerts} = json_response(conn, 200)
    end

    test "respects limit parameter boundaries", %{conn: conn, organization: org} do
      # Limit above 200 should be capped at 200
      conn = get(conn, ~p"/api/v1/mobile/organizations/#{org.id}/alerts?limit=500")

      assert %{"alerts" => _alerts} = json_response(conn, 200)
    end

    test "handles negative limit parameter", %{conn: conn, organization: org} do
      # Negative limit should default to 50
      conn = get(conn, ~p"/api/v1/mobile/organizations/#{org.id}/alerts?limit=-10")

      assert %{"alerts" => _alerts} = json_response(conn, 200)
    end
  end

  describe "format_alert_status/1" do
    alias ToweropsWeb.Api.MobileController

    test "resolved wins over acknowledged" do
      alert = %{resolved_at: ~U[2026-01-01 00:00:00Z], acknowledged_at: ~U[2026-01-01 00:00:00Z]}
      assert "resolved" == MobileController.format_alert_status(alert)
    end

    test "acknowledged when not resolved" do
      alert = %{resolved_at: nil, acknowledged_at: ~U[2026-01-01 00:00:00Z]}
      assert "acknowledged" == MobileController.format_alert_status(alert)
    end

    test "active when neither" do
      alert = %{resolved_at: nil, acknowledged_at: nil}
      assert "active" == MobileController.format_alert_status(alert)
    end
  end

  describe "timeticks_to_string/1" do
    alias ToweropsWeb.Api.MobileController

    test "days when over a day" do
      timeticks = (2 * 86_400 + 3 * 3600) * 100
      assert "2d 3h" == MobileController.timeticks_to_string(timeticks)
    end

    test "hours when less than a day" do
      timeticks = (5 * 3600 + 30 * 60) * 100
      assert "5h 30m" == MobileController.timeticks_to_string(timeticks)
    end

    test "minutes when less than an hour" do
      timeticks = 45 * 60 * 100
      assert "45m" == MobileController.timeticks_to_string(timeticks)
    end

    test "zero timeticks = 0m" do
      assert "0m" == MobileController.timeticks_to_string(0)
    end
  end

  describe "list_devices and get_device" do
    test "list_devices returns 200 with empty list when no devices exist", %{conn: conn, organization: org} do
      conn = get(conn, ~p"/api/v1/mobile/organizations/#{org.id}/devices")
      assert %{"device" => []} = json_response(conn, 200)
    end

    test "list_devices forbidden for non-member", %{conn: conn} do
      other_user = user_fixture()
      {:ok, other_org} = Organizations.create_organization(%{name: "Other"}, other_user.id)

      conn = get(conn, ~p"/api/v1/mobile/organizations/#{other_org.id}/devices")
      assert json_response(conn, 403)["error"] =~ "Access denied"
    end

    test "get_device handler 404s on unknown id (direct call)" do
      alias ToweropsWeb.Api.MobileController

      user = user_fixture()
      conn = Plug.Conn.assign(build_conn(), :current_user, user)
      conn = MobileController.get_device(conn, %{"id" => Ecto.UUID.generate()})
      assert conn.status == 404
    end

    test "get_device handler returns 403 for cross-org device (direct call)" do
      alias ToweropsWeb.Api.MobileController

      user = user_fixture()
      other_user = user_fixture()
      {:ok, other_org} = Organizations.create_organization(%{name: "Other2"}, other_user.id)
      {:ok, other_site} = Towerops.Sites.create_site(%{name: "Site Other", organization_id: other_org.id})

      {:ok, device} =
        Towerops.Devices.create_device(%{
          name: "Forbidden",
          ip_address: "10.99.0.1",
          site_id: other_site.id,
          organization_id: other_org.id
        })

      conn = Plug.Conn.assign(build_conn(), :current_user, user)
      conn = MobileController.get_device(conn, %{"id" => device.id})
      assert conn.status == 403
    end
  end
end