using System.Net;
using System.Net.Http.Json;

namespace Baya.Test.Api;

public class BookingSessionsApiTests(BayaApiFactory factory) : IClassFixture<BayaApiFactory>
{
    [Fact]
    public async Task CheckIn_Unauthenticated_Returns401()
    {
        var client = factory.CreateClient();
        var response = await client.PostAsJsonAsync("/api/v1/booking_sessions/check_in/1", new { latitude = 35.6m, longitude = 51.3m });
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }

    [Fact]
    public async Task Today_AsNurse_ReturnsEmptyPagedEnvelope()
    {
        var client = factory.CreateClient();
        await ProfileTestClient.AuthenticateAsync(factory, client, "09131900201", "nurse");

        var response = await client.GetAsync("/api/v1/booking_sessions/today");

        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        var data = await AuthTestClient.ReadDataAsync(response);
        Assert.Equal(0, data.GetProperty("total").GetInt32());
    }

    [Fact]
    public async Task CheckIn_UnknownSession_ReturnsNotFound()
    {
        var client = factory.CreateClient();
        await ProfileTestClient.AuthenticateAsync(factory, client, "09131900202", "nurse");

        // The role-selected nurse has no nurse profile yet (403) and the session is absent (404) — either
        // way the check-in never succeeds and never leaks another booking's session.
        var response = await client.PostAsJsonAsync("/api/v1/booking_sessions/check_in/999999", new { latitude = 35.6m, longitude = 51.3m });
        Assert.True(response.StatusCode is HttpStatusCode.NotFound or HttpStatusCode.Forbidden);
    }
}
