package httpapi

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

// supportAuthPaths are the session-gated support CRUD / notification probes.
// Skip the suite when none are mounted yet (sibling HTTP wiring in progress).
var supportAuthPaths = []struct {
	method string
	path   string
}{
	{http.MethodGet, "/api/support/tickets"},
	{http.MethodPost, "/api/support/tickets"},
	{http.MethodGet, "/api/support/notifications"},
	{http.MethodGet, "/api/admin/support/tickets"},
	{http.MethodGet, "/api/admin/support/csat"},
	{http.MethodGet, "/api/admin/support/kb/articles"},
	{http.MethodGet, "/api/admin/support/kb/categories"},
	{http.MethodGet, "/api/admin/support/templates"},
	{http.MethodGet, "/api/admin/support/auto-config"},
}

// TestRouterSupportTicketCRUDAuthRequiresSession asserts unauthenticated callers
// get 401 (not 200) on support routes when those routes are mounted.
func TestRouterSupportTicketCRUDAuthRequiresSession(t *testing.T) {
	t.Parallel()
	s := testAPIServer()
	h := s.Router()

	mounted := 0
	for _, tc := range supportAuthPaths {
		rec := httptest.NewRecorder()
		req := httptest.NewRequest(tc.method, tc.path, nil)
		h.ServeHTTP(rec, req)
		switch rec.Code {
		case http.StatusNotFound:
			continue
		case http.StatusUnauthorized, http.StatusForbidden:
			mounted++
		default:
			t.Fatalf("%s %s status=%d want 401/403 when mounted (body=%s)",
				tc.method, tc.path, rec.Code, rec.Body.String())
		}
	}
	if mounted == 0 {
		t.Skip("support ticket HTTP routes not mounted yet")
	}
}