package auth

import (
	"net/http"
	"os"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// TestRealAAMOSIntegration validates a real RS256 token from ouroboros-identity
func TestRealAAMOSIntegration(t *testing.T) {
	if os.Getenv("CI") == "true" {
		t.Skip("Skipping integration test in CI")
	}

	// Load the real AAMOS public key
	svc, err := NewRS256Service("jwt-public.pem")
	require.NoError(t, err)

	// This is a real token structure from ouroboros-identity
	// In production, this would come from /api/auth/token
	t.Run("validate_real_token", func(t *testing.T) {
		// Note: This test requires a real token from ouroboros-identity
		// Run: curl -X POST http://localhost:3208/api/auth/token \
		//   -H "Content-Type: application/json" \
		//   -d '{"sub":"test","email":"test@example.com","roles":["admin"]}'
		// Then paste the token here for testing
		t.Skip("Requires real token from ouroboros-identity - run manually")
	})

	t.Run("validate_with_real_key", func(t *testing.T) {
		// Just verify the service was created with the real key
		assert.NotNil(t, svc.publicKey)
	})
}

// TestAAMOSIdentityService checks if the identity service is reachable
func TestAAMOSIdentityService(t *testing.T) {
	if os.Getenv("CI") == "true" {
		t.Skip("Skipping integration test in CI")
	}

	// Try to connect to ouroboros-identity
	resp, err := http.Get("http://localhost:3208/health")
	if err != nil {
		t.Skipf("ouroboros-identity not reachable: %v", err)
	}
	defer resp.Body.Close()

	assert.Equal(t, http.StatusOK, resp.StatusCode)
}