using System.Net;
using System.Net.Http.Json;

namespace ItWorx.KnowledgeHub.Api.Tests;

public sealed class HealthEndpointTests : IClassFixture<KnowledgeHubApiFactory>
{
    private readonly HttpClient _client;

    public HealthEndpointTests(KnowledgeHubApiFactory factory)
    {
        _client = factory.CreateClient();
    }

    [Fact]
    public async Task Liveness_returns_healthy_product_response()
    {
        using var response = await _client.GetAsync("/health/live");

        Assert.Equal(HttpStatusCode.OK, response.StatusCode);

        var payload = await response.Content.ReadFromJsonAsync<LivenessResponse>();
        Assert.NotNull(payload);
        Assert.Equal("healthy", payload.Status);
        Assert.Equal("ItWorx Knowledge Hub", payload.Product);
    }

    [Fact]
    public async Task System_info_requires_administrator_authentication()
    {
        // docs/19-observability.md: "/api/v1/system/info" is "Permissioned
        // information", distinct from the two anonymous-by-design health endpoints
        // above (docs/23-deployment-unraid.md "Operational checks" lists
        // "authenticated system info" separately from /health/live and
        // /health/ready). An anonymous caller must never see product/schema/version
        // detail. Full authenticated-payload coverage (schemaVersion etc.) lives in
        // the real-PostgreSQL integration tests, since this lightweight factory has
        // no working login flow.
        using var response = await _client.GetAsync("/api/v1/system/info");

        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }

    private sealed record LivenessResponse(string Status, string Product);
}