SIG-CM2.0/tests/SIGCM2.Api.Tests/Auth/AuthControllerTests.cs

using System.Net;
using System.Net.Http.Json;
using System.Text.Json;
using SIGCM2.TestSupport;

namespace SIGCM2.Api.Tests.Auth;

[Collection("ApiIntegration")]
public class AuthControllerTests
{
    private readonly HttpClient _client;

    public AuthControllerTests(TestWebAppFactory factory)
    {
        _client = factory.CreateClient();
    }

    // Scenario: happy path — valid admin credentials return 200 with token shape + usuario
    [Fact]
    public async Task Login_ValidCredentials_Returns200WithTokenShape()
    {
        var response = await _client.PostAsJsonAsync("/api/v1/auth/login", new
        {
            username = "admin",
            password = "@Diego550@"
        });

        Assert.Equal(HttpStatusCode.OK, response.StatusCode);

        var json = await response.Content.ReadFromJsonAsync<JsonElement>();
        Assert.True(json.TryGetProperty("accessToken", out var token), "Response missing 'accessToken'");
        Assert.True(json.TryGetProperty("refreshToken", out var refresh), "Response missing 'refreshToken'");
        Assert.True(json.TryGetProperty("expiresIn", out var expires), "Response missing 'expiresIn'");

        Assert.False(string.IsNullOrWhiteSpace(token.GetString()), "'accessToken' must not be empty");
        Assert.False(string.IsNullOrWhiteSpace(refresh.GetString()), "'refreshToken' must not be empty");
        Assert.Equal(3600, expires.GetInt32());

        // Contract: response must include usuario object
        Assert.True(json.TryGetProperty("usuario", out var usuario), "Response missing 'usuario'");
        Assert.True(usuario.TryGetProperty("id", out var id), "usuario missing 'id'");
        Assert.True(usuario.TryGetProperty("nombre", out var nombre), "usuario missing 'nombre'");
        Assert.True(usuario.TryGetProperty("rol", out var rol), "usuario missing 'rol'");
        Assert.True(usuario.TryGetProperty("permisos", out var permisos), "usuario missing 'permisos'");

        Assert.True(id.GetInt32() > 0, "'usuario.id' must be positive");
        Assert.False(string.IsNullOrWhiteSpace(nombre.GetString()), "'usuario.nombre' must not be empty");
        Assert.False(string.IsNullOrWhiteSpace(rol.GetString()), "'usuario.rol' must not be empty");
        Assert.Equal(JsonValueKind.Array, permisos.ValueKind);
        // V011 (ADM-001) adds 'administracion:secciones:gestionar' → 22
        // V013 (ADM-008) adds 'administracion:puntos_de_venta:gestionar' → 23
        // V014 (ADM-009) adds 'administracion:fiscal:gestionar' → 24
        // V016 (CAT-001) adds 'catalogo:rubros:gestionar' → 25
        // V017 (PRD-001) adds 'catalogo:tipos:gestionar' → 26
        // V018 (PRD-002) adds 'catalogo:productos:gestionar' → 27 total
        Assert.Equal(27, permisos.GetArrayLength());
    }

    // Scenario: invalid credentials return 401 with opaque error
    [Fact]
    public async Task Login_InvalidCredentials_Returns401()
    {
        var response = await _client.PostAsJsonAsync("/api/v1/auth/login", new
        {
            username = "admin",
            password = "WrongPassword1!"
        });

        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);

        var json = await response.Content.ReadFromJsonAsync<JsonElement>();
        Assert.True(json.TryGetProperty("error", out var error));
        Assert.Equal("Credenciales inválidas", error.GetString());
    }

    // Scenario: malformed body (missing password) returns 400
    [Fact]
    public async Task Login_MissingPassword_Returns400()
    {
        var response = await _client.PostAsJsonAsync("/api/v1/auth/login", new
        {
            username = "admin"
            // password intentionally missing — JSON serializes as no field
        });

        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);

        var json = await response.Content.ReadFromJsonAsync<JsonElement>();
        Assert.True(json.TryGetProperty("errors", out var errors), "Response missing 'errors'");
    }

    // Triangulation: empty username returns 400
    [Fact]
    public async Task Login_EmptyUsername_Returns400()
    {
        var response = await _client.PostAsJsonAsync("/api/v1/auth/login", new
        {
            username = "",
            password = "@Diego550@"
        });

        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
    }

    // T-050: Refresh endpoint tests

    [Fact]
    public async Task Refresh_WithInvalidRefreshToken_Returns401()
    {
        var response = await _client.PostAsJsonAsync("/api/v1/auth/refresh", new
        {
            accessToken = "any.token.here",
            refreshToken = "nonexistent_refresh_token_value_that_is_at_least_20_chars"
        });

        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }

    [Fact]
    public async Task Refresh_MissingBody_Returns400()
    {
        var response = await _client.PostAsJsonAsync("/api/v1/auth/refresh", new
        {
            accessToken = "",
            refreshToken = ""
        });

        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
    }

    [Fact]
    public async Task Logout_WithoutBearer_Returns401()
    {
        var response = await _client.PostAsJsonAsync("/api/v1/auth/logout", new { });
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }

    [Fact]
    public async Task Login_Refresh_Logout_FullFlow()
    {
        // Step 1: Login to get tokens
        var loginResp = await _client.PostAsJsonAsync("/api/v1/auth/login", new
        {
            username = "admin",
            password = "@Diego550@"
        });

        if (loginResp.StatusCode == HttpStatusCode.InternalServerError)
        {
            // DB not available in this environment — skip gracefully
            return;
        }

        Assert.Equal(HttpStatusCode.OK, loginResp.StatusCode);
        var loginJson = await loginResp.Content.ReadFromJsonAsync<JsonElement>();
        var accessToken = loginJson.GetProperty("accessToken").GetString()!;
        var refreshToken = loginJson.GetProperty("refreshToken").GetString()!;

        // Step 2: Use access token to call logout
        using var logoutRequest = new HttpRequestMessage(HttpMethod.Post, "/api/v1/auth/logout");
        logoutRequest.Headers.Authorization =
            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken);
        logoutRequest.Content = JsonContent.Create(new { });

        var logoutResp = await _client.SendAsync(logoutRequest);
        Assert.Equal(HttpStatusCode.OK, logoutResp.StatusCode);

        var logoutJson = await logoutResp.Content.ReadFromJsonAsync<JsonElement>();
        Assert.True(logoutJson.GetProperty("success").GetBoolean());

        // Step 3: After logout, refresh should fail (token revoked)
        var refreshResp = await _client.PostAsJsonAsync("/api/v1/auth/refresh", new
        {
            accessToken = accessToken,
            refreshToken = refreshToken
        });

        Assert.Equal(HttpStatusCode.Unauthorized, refreshResp.StatusCode);
    }
}