package web

import (
	"io"
	"log"
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"testing"

	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
	"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
)

// R-970 (v0.322.0): the box's hub API key is no CSRF exemption any more — no route accepts it, so a POST that carries
// it and no session CSRF token is refused like any other.
// RED-PROOF (2026-10-16, REPORT): with the Bearer exemption put back in CsrfProtect, this failed at „passed CSRF".
func TestR970_HubKeyIsNoCSRFExemption(t *testing.T) {
	cfg := config.Default()
	cfg.Hub.APIKey = "TESTONLY-hub-key-csrf"
	lg := log.New(io.Discard, "", 0)
	sett, err := settings.Load(filepath.Join(t.TempDir(), "settings.json"), lg)
	if err != nil {
		t.Fatal(err)
	}
	if err := sett.SetPasswordHash("$2a$10$abcdefghijklmnopqrstuuJ1A9pDq6s9F2x1H3bQb0v8Y3wq6z2Om"); err != nil {
		t.Fatal(err)
	}
	s := &Server{cfg: cfg, settings: sett, logger: lg}
	if !s.authEnabled() {
		t.Fatal("control: auth is not on, so CSRF would pass everything and this test would measure nothing")
	}
	reached := false
	h := s.CsrfProtect(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { reached = true }))
	req := httptest.NewRequest(http.MethodPost, "/api/selfupdate/update", nil)
	req.Header.Set("Authorization", "Bearer "+cfg.Hub.APIKey)
	w := httptest.NewRecorder()
	h.ServeHTTP(w, req)
	if reached || w.Code/100 == 2 {
		t.Fatalf("a POST carrying the hub key passed CSRF (code %d)", w.Code)
	}
}