package main

import (
	"context"
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"github.com/coder/websocket"
	"github.com/itworx/pulse/internal/auth"
	"github.com/itworx/pulse/internal/live"
)

func TestClearingSessionClosesAuthenticatedLiveConnection(t *testing.T) {
	manager := auth.NewSlidingSessionManager("pulse_test_session", time.Minute, time.Hour, false)
	issued := httptest.NewRecorder()
	if err := manager.Issue(issued, auth.Principal{Subject: "viewer", Role: auth.RoleViewer}, time.Now().UTC()); err != nil {
		t.Fatal(err)
	}
	cookie := issued.Result().Cookies()[0]
	server := httptest.NewServer(withSession(manager, auth.Require(auth.PermissionView, live.Handler{})))
	defer server.Close()
	options := &websocket.DialOptions{HTTPHeader: http.Header{"Cookie": []string{cookie.String()}}}
	conn, _, err := websocket.Dial(context.Background(), "ws"+server.URL[4:]+"/api/v1/live", options)
	if err != nil {
		t.Fatal(err)
	}
	defer conn.CloseNow()
	clearRequest := httptest.NewRequest(http.MethodPost, "/auth/logout", nil)
	clearRequest.AddCookie(cookie)
	manager.Clear(httptest.NewRecorder(), clearRequest)
	readCtx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	if _, _, err := conn.Read(readCtx); err == nil {
		t.Fatal("live connection survived session revocation")
	}
}