package api_test

import (
	"net/http"
	"testing"
	"time"

	"atlas9.dev/c/core/assert"
	"atlas9.dev/c/core/iam"
	"atlas9.dev/c/demo/api"
)

// Sessions expire server-side, not just via cookie MaxAge: a request with an
// expired session token is treated as anonymous and gets 401, so clients know
// to re-authenticate.
func TestIdentityApi_ExpiredSession_Unauthorized(t *testing.T) {
	s := startServer(t)

	var saved api.Tenants_CreateRes
	res := s.call(t, "/Tenants_Create", api.Tenants_CreateReq{Tenant: iam.Tenant{Name: "Acme"}}, &saved)
	assert.Eq(t, res.StatusCode, http.StatusOK)

	// Expire the session row directly; the browser still sends the cookie.
	_, err := s.DB.ExecContext(t.Context(),
		`UPDATE sessions SET expiration = $1`, time.Now().Add(-time.Minute).Unix())
	assert.Ok(t, err)

	var body api.ErrorResponse
	res = s.call(t, "/Tenants_Create", api.Tenants_CreateReq{Tenant: iam.Tenant{Name: "Acme"}}, &body)
	assert.Eq(t, res.StatusCode, http.StatusUnauthorized)
}