using System.Net;
using System.Net.Http.Json;

namespace Baya.Test.Api;

public class BookingsApiTests(BayaApiFactory factory) : IClassFixture<BayaApiFactory>
{
    [Fact]
    public async Task Convert_Unauthenticated_Returns401()
    {
        var client = factory.CreateClient();
        var response = await client.PostAsJsonAsync("/api/v1/bookings/convert", new { bookingRequestId = 1 });
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }

    [Fact]
    public async Task Convert_InvalidId_Returns400()
    {
        var client = factory.CreateClient();
        await ProfileTestClient.AuthenticateAsync(factory, client, "09131900101", "customer");

        var response = await client.PostAsJsonAsync("/api/v1/bookings/convert", new { bookingRequestId = 0 });
        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
    }

    [Fact]
    public async Task List_Authenticated_ReturnsEmptyPagedEnvelope()
    {
        var client = factory.CreateClient();
        await ProfileTestClient.AuthenticateAsync(factory, client, "09131900102", "customer");

        var response = await client.GetAsync("/api/v1/bookings/list");

        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        var data = await AuthTestClient.ReadDataAsync(response);
        Assert.Equal(0, data.GetProperty("total").GetInt32());
    }

    [Fact]
    public async Task CareInstructions_UnauthorizedCaller_DoesNotLeak()
    {
        var client = factory.CreateClient();
        await ProfileTestClient.AuthenticateAsync(factory, client, "09131900103", "customer");

        // The two-stage disclosure boundary: a caller who is not the assigned nurse/admin gets a clean
        // not-found for a booking they cannot read (here, a non-existent one) — never the clinical fields.
        var response = await client.GetAsync("/api/v1/bookings/care_instructions/999999");
        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
    }
}
