using System.Net;

namespace Baya.Test.Api;

/// <summary>HTTP-pipeline coverage for the b14 review + care-record surface: public reads are anonymous, admin
/// and patient reads are auth-gated (401 without a token).</summary>
public class ReviewsApiTests(BayaApiFactory factory) : IClassFixture<BayaApiFactory>
{
    [Fact]
    public async Task PublicReviews_UnknownNurse_Returns200WithEmptyAggregate()
    {
        var anon = factory.CreateClient();
        var response = await anon.GetAsync("/api/v1/nurses/999999/reviews");
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);

        var data = await AuthTestClient.ReadDataAsync(response);
        Assert.Equal(0, data.GetProperty("aggregate").GetProperty("publishedCount").GetInt32());
        Assert.Empty(data.GetProperty("reviews").GetProperty("items").EnumerateArray());
    }

    [Fact]
    public async Task PublicReviewTags_UnknownNurse_Returns200()
    {
        var anon = factory.CreateClient();
        var response = await anon.GetAsync("/api/v1/nurses/999999/review_tags");
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);

        // The seeded active tag vocabulary is always returned (with zero counts for an unknown nurse).
        var data = await AuthTestClient.ReadDataAsync(response);
        Assert.NotEmpty(data.GetProperty("tags").EnumerateArray());
    }

    [Fact]
    public async Task ModerationQueue_Unauthenticated_Returns401()
    {
        var anon = factory.CreateClient();
        var response = await anon.GetAsync("/api/v1/admin/reviews/moderation_queue");
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }

    [Fact]
    public async Task PatientCareRecords_Unauthenticated_Returns401()
    {
        var anon = factory.CreateClient();
        var response = await anon.GetAsync("/api/v1/patients/1/care_records");
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }
}
