pargar/backend/internal/api/api_test.go

package api_test

import (
	"bytes"
	"context"
	"encoding/json"
	"io/fs"
	"log"
	"net/http"
	"net/http/httptest"
	"os"
	"strings"
	"testing"

	"github.com/jackc/pgx/v5/pgxpool"
	"github.com/redis/go-redis/v9"

	"pargar/backend/internal/api"
	"pargar/backend/internal/config"
	"pargar/backend/internal/db"
	"pargar/backend/internal/redisdb"
	"pargar/backend/internal/seed"
	"pargar/backend/internal/storage"
	"pargar/backend/internal/store"
)

var (
	adminURL      = testDatabaseURL("postgres")
	testURL       = testDatabaseURL("pargar_test")
	redisURL      = testRedisURL()
	integrationOK bool
)

func testRedisURL() string {
	if v := os.Getenv("REDIS_URL"); v != "" {
		return v
	}
	return "redis://localhost:6379"
}

func testDatabaseURL(database string) string {
	user := os.Getenv("POSTGRES_USER")
	if user == "" {
		user = "pargar"
	}
	password := os.Getenv("POSTGRES_PASSWORD")
	if password == "" {
		password = "pargar"
	}
	return "postgres://" + user + ":" + password + "@localhost:5432/" + database + "?sslmode=disable"
}

type testEnv struct {
	server *httptest.Server
	pool   *pgxpool.Pool
	rdb    *redis.Client
}

func TestMain(m *testing.M) {
	_ = os.Setenv("ADMIN_PASSWORD", "password123")
	// Local integration tests need captcha plaintext; production never sets this.
	_ = os.Setenv("CAPTCHA_EXPOSE_ANSWER", "true")
	_ = os.Setenv("DEV_MODE", "true")
	ctx := context.Background()
	root, err := pgxpool.New(ctx, adminURL)
	if err != nil {
		log.Printf("api integration tests disabled: %v", err)
		os.Exit(m.Run())
		return
	}
	_, _ = root.Exec(ctx, `DROP DATABASE IF EXISTS pargar_test`)
	if _, err := root.Exec(ctx, `CREATE DATABASE pargar_test`); err != nil {
		root.Close()
		log.Printf("api integration tests disabled: %v", err)
		os.Exit(m.Run())
		return
	}
	root.Close()
	integrationOK = true
	os.Exit(m.Run())
}

func setup(t *testing.T) *testEnv {
	t.Helper()
	if !integrationOK {
		t.Skip("postgres unavailable")
	}
	ctx := context.Background()
	pool, err := db.Connect(ctx, testURL)
	if err != nil {
		t.Fatalf("connect: %v", err)
	}
	sub, _ := fs.Sub(db.MigrationFiles, "migrations")
	if err := db.Migrate(ctx, pool, sub); err != nil {
		t.Fatalf("migrate: %v", err)
	}
	rdb, err := redisdb.Connect(ctx, redisURL)
	if err != nil {
		t.Fatalf("redis: %v", err)
	}
	if err := rdb.RDB().FlushDB(ctx).Err(); err != nil {
		t.Fatalf("flush redis: %v", err)
	}
	st := store.New(pool)
	if err := seed.Run(ctx, st, true); err != nil {
		t.Fatalf("seed: %v", err)
	}
	cfg := config.Load()
	srv := api.NewServer(cfg, st, rdb.RDB(), storage.NewLocal(t.TempDir(), "http://localhost:8080"))
	ts := httptest.NewServer(srv.Handler())
	t.Cleanup(func() {
		ts.Close()
		rdb.RDB().Close()
		_, _ = pool.Exec(ctx, `TRUNCATE users, lessons, chapters, mcq_questions, watch_heartbeats,
			watch_sessions, lesson_progress, quiz_attempts, xp_events, weekly_leaderboard, events,
			event_rsvps, challenges, challenge_progress, chat_messages, notifications, notification_prefs, video_assets,
			refresh_tokens, reminders_sent, certificates, certificate_physical_orders,
			unlock_requests, registration_ips, registration_invites, registration_phone_whitelist,
			registration_phone_blacklist, registration_blacklist_attempts, chat_export_tokens
			RESTART IDENTITY CASCADE`)
		_, _ = pool.Exec(ctx, `UPDATE app_settings SET value='false' WHERE key='registration_enabled'`)
		pool.Close()
	})
	return &testEnv{server: ts, pool: pool, rdb: rdb.RDB()}
}

func (e *testEnv) do(t *testing.T, method, path, token string, body any) (int, map[string]any) {
	t.Helper()
	return e.doHeaders(t, method, path, token, nil, body)
}

func (e *testEnv) doHeaders(t *testing.T, method, path, token string, headers map[string]string, body any) (int, map[string]any) {
	t.Helper()
	var buf bytes.Buffer
	if body != nil {
		_ = json.NewEncoder(&buf).Encode(body)
	}
	req, _ := http.NewRequest(method, e.server.URL+path, &buf)
	if token != "" {
		req.Header.Set("Authorization", "Bearer "+token)
	}
	req.Header.Set("Content-Type", "application/json")
	for k, v := range headers {
		req.Header.Set(k, v)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatalf("%s %s: %v", method, path, err)
	}
	defer resp.Body.Close()
	var out map[string]any
	_ = json.NewDecoder(resp.Body).Decode(&out)
	return resp.StatusCode, out
}

const bootstrapAdminEmail = "admin@example.com"

// register creates a fresh student via the admin-only endpoint, then logs in.
func register(t *testing.T, e *testEnv, name, email string) (string, int64) {
	t.Helper()
	admin := login(t, e, bootstrapAdminEmail)
	username := strings.Split(email, "@")[0]
	code, body := e.do(t, "POST", "/api/admin/users", admin, map[string]any{
		"name": name, "email": email, "username": username, "password": "password123", "role": "student",
		"phone": "", "securityQuestion": "نام حیوان خانگی؟", "securityAnswer": "rex",
	})
	if code != http.StatusCreated {
		t.Fatalf("admin create user: %d %v", code, body)
	}
	uid := int64(body["user"].(map[string]any)["id"].(float64))
	token := login(t, e, email)
	return token, uid
}

func fetchCaptcha(t *testing.T, e *testEnv) (challengeID, answer string) {
	t.Helper()
	code, body := e.do(t, "GET", "/api/auth/captcha", "", nil)
	if code != http.StatusOK {
		t.Fatalf("captcha: %d %v", code, body)
	}
	id, _ := body["challengeId"].(string)
	img, _ := body["imageBase64"].(string)
	answer, _ = body["answer"].(string)
	if id == "" || img == "" || answer == "" {
		t.Fatalf("captcha missing fields: %v", body)
	}
	return id, answer
}

func loginBody(t *testing.T, e *testEnv, identity, password string) map[string]any {
	t.Helper()
	id, answer := fetchCaptcha(t, e)
	body := map[string]any{
		"password":      password,
		"challengeId":   id,
		"captchaAnswer": answer,
	}
	if strings.Contains(identity, "@") {
		body["email"] = identity
	} else {
		body["username"] = identity
	}
	return body
}

func login(t *testing.T, e *testEnv, email string) string {
	t.Helper()
	code, body := e.do(t, "POST", "/api/auth/login", "", loginBody(t, e, email, "password123"))
	if code != http.StatusOK {
		t.Fatalf("login %s: %d %v", email, code, body)
	}
	return body["accessToken"].(string)
}

func TestAuthRateLimit(t *testing.T) {
	e := setup(t)
	hitLimit := false
	for i := 0; i < 40; i++ {
		code, body := e.do(t, "POST", "/api/auth/login", "", loginBody(t, e, "missing@test.dev", "wrong"))
		if code == http.StatusTooManyRequests {
			if body["error"] != "تعداد تلاش‌ها بیش از حد مجاز است؛ کمی بعد دوباره تلاش کنید" {
				t.Fatalf("unexpected rate limit message: %v", body)
			}
			hitLimit = true
			break
		}
		if code != http.StatusUnauthorized {
			t.Fatalf("request %d expected unauthorized or rate limit, got %d %v", i+1, code, body)
		}
	}
	if !hitLimit {
		t.Fatal("expected adaptive rate limit after repeated failed logins")
	}
}

// watchToUnlock pumps heartbeats until the quiz unlocks.
// Wall-clock anti-cheat caps delta by real elapsed time, so each pulse first
// rewinds the session heartbeat timestamp (tests only).
func watchToUnlock(t *testing.T, e *testEnv, token string, lesson int64) {
	t.Helper()
	for i := 1; i <= 6; i++ {
		rewindWatchSession(t, e, token, lesson)
		code, body := e.do(t, "POST", "/api/lessons/"+itoa(lesson)+"/heartbeat", token,
			map[string]any{"position": float64(i * 9), "delta": 9, "seq": i})
		if code != http.StatusOK {
			t.Fatalf("heartbeat: %d %v", code, body)
		}
		if body["quizUnlocked"] == true {
			return
		}
	}
}

func rewindWatchSession(t *testing.T, e *testEnv, token string, lesson int64) {
	t.Helper()
	code, me := e.do(t, "GET", "/api/auth/me", token, nil)
	if code != http.StatusOK {
		t.Fatalf("auth/me for rewind: %d %v", code, me)
	}
	u, _ := me["user"].(map[string]any)
	id, _ := u["id"].(float64)
	if id < 1 {
		t.Fatalf("auth/me missing user id: %v", me)
	}
	_, err := e.pool.Exec(context.Background(), `
		INSERT INTO watch_sessions (user_id, lesson_id, started_at, last_heartbeat_at, last_position)
		VALUES ($1, $2, now() - interval '30 seconds', now() - interval '30 seconds', 0)
		ON CONFLICT (user_id, lesson_id) DO UPDATE
		SET last_heartbeat_at = now() - interval '30 seconds'`, int64(id), lesson)
	if err != nil {
		t.Fatalf("rewind session: %v", err)
	}
}

func itoa(v int64) string {
	if v == 0 {
		return "0"
	}
	neg := v < 0
	if neg {
		v = -v
	}
	var buf [20]byte
	i := len(buf)
	for v > 0 {
		i--
		buf[i] = byte('0' + v%10)
		v /= 10
	}
	if neg {
		i--
		buf[i] = '-'
	}
	return string(buf[i:])
}