using System.Net;
using System.Net.Http.Json;

namespace Baya.Test.Api;

public class RefundStatusApiTests(BayaApiFactory factory) : IClassFixture<BayaApiFactory>
{
    [Fact]
    public async Task RefundStatus_is_visible_to_owner_and_hidden_from_another_customer()
    {
        var admin = factory.CreateClient();
        await AdminTestClient.AuthenticateAsync(factory, admin, "09131901601");
        var bookingId = await AdminRefundsApiTests.SeedCapturedBookingAsync(factory, "09131901602");

        var create = await admin.PostAsJsonAsync("/api/v1/admin_refunds", new { bookingId, refundPercentage = 1m });
        Assert.Equal(HttpStatusCode.OK, create.StatusCode);
        var refundId = (await AuthTestClient.ReadDataAsync(create)).GetProperty("refundId").GetInt64();

        // The owning customer sees their refund status + amount.
        var owner = factory.CreateClient();
        await ProfileTestClient.AuthenticateAsync(factory, owner, "09131901602", "customer");
        var ownerResponse = await owner.GetAsync($"/api/v1/refunds/{refundId}/status");
        Assert.Equal(HttpStatusCode.OK, ownerResponse.StatusCode);
        var ownerData = await AuthTestClient.ReadDataAsync(ownerResponse);
        Assert.Equal("10000000", ownerData.GetProperty("amount").GetString());

        // A different customer cannot — a cross-customer read is a clean not-found.
        var other = factory.CreateClient();
        await ProfileTestClient.AuthenticateAsync(factory, other, "09131901603", "customer");
        var otherResponse = await other.GetAsync($"/api/v1/refunds/{refundId}/status");
        Assert.Equal(HttpStatusCode.NotFound, otherResponse.StatusCode);
    }

    [Fact]
    public async Task RefundStatus_Unauthenticated_Returns401()
    {
        var client = factory.CreateClient();
        var response = await client.GetAsync("/api/v1/refunds/1/status");
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }
}
