package server

import (
	"encoding/json"
	"testing"
)

func TestProviderChangesAdminOnly(t *testing.T) {
	ts, _ := setupFull(t, echo{})
	ut := registerUser(t, ts.URL, "alice", "correct-horse-1")
	uh := bearerHdr(ut)
	if r := do(t, "GET", ts.URL+"/api/providers", "", uh); r.StatusCode != 200 {
		t.Fatal("users may list providers", r.StatusCode)
	}
	if r := do(t, "PUT", ts.URL+"/api/providers/active", `{"provider":"dahl"}`, uh); r.StatusCode != 403 {
		t.Fatal("user must not change global provider", r.StatusCode)
	}
	var me map[string]any
	json.NewDecoder(do(t, "GET", ts.URL+"/api/auth/me", "", uh).Body).Decode(&me)
	if me["admin"] != false {
		t.Fatalf("%v", me)
	}
	// own session: chat ok, provider change forbidden
	r := do(t, "POST", ts.URL+"/api/chat", `{"text":"hi"}`, uh)
	if r.StatusCode != 200 {
		t.Fatal("user chat", r.StatusCode)
	}
	var cr struct {
		SessionID string `json:"session_id"`
	}
	json.NewDecoder(r.Body).Decode(&cr)
	if cr.SessionID != "" {
		if r := do(t, "PUT", ts.URL+"/api/sessions/"+cr.SessionID+"/provider", `{"provider":"openai"}`, uh); r.StatusCode != 403 {
			t.Fatal("session provider", r.StatusCode)
		}
	}
	if r := do(t, "POST", ts.URL+"/api/chat", `{"text":"hi","provider":"dahl"}`, uh); r.StatusCode != 403 {
		t.Fatal("chat with provider", r.StatusCode)
	}
	if r := do(t, "PUT", ts.URL+"/api/providers/active", `{"provider":"dahl"}`, authH); r.StatusCode != 200 {
		t.Fatal("admin allowed", r.StatusCode)
	}
}