-module(admin_utils_tests).
-include_lib("eunit/include/eunit.hrl").
-include("records.hrl").

-define(TABLES, [admin]).
-define(ADMIN_ID, <<"adm_utils_1">>).
-define(SUPER_ID, <<"adm_super_1">>).

%%%===================================================================
%%% client_ip / ip_to_binary (cowboy via eh_test_support)
%%%===================================================================

client_ip_setup() ->
  ok.

client_ip_cleanup(_) ->
  eh_test_support:unload_cowboy(),
  ok.

client_ip_test_() ->
  {foreach, fun client_ip_setup/0, fun client_ip_cleanup/1, [
    {"Uses X-Forwarded-For when present", fun test_forwarded_for/0},
    {"Falls back to X-Real-IP", fun test_real_ip/0},
    {"Falls back to peer address", fun test_peer_fallback/0},
    {"ip_to_binary handles IPv4 tuple", fun test_ipv4_tuple/0}
  ]}.

test_forwarded_for() ->
  Req = eh_test_support:with_cowboy(#{
    headers => #{<<"x-forwarded-for">> => <<"203.0.113.10, 10.0.0.1">>},
    peer => {10, 0, 0, 2}
  }),
  ?assertEqual(<<"203.0.113.10">>, admin_utils:client_ip(Req)).

test_real_ip() ->
  Req = eh_test_support:with_cowboy(#{
    headers => #{<<"x-real-ip">> => <<"198.51.100.5">>},
    peer => {10, 0, 0, 2}
  }),
  ?assertEqual(<<"198.51.100.5">>, admin_utils:client_ip(Req)).

test_peer_fallback() ->
  Req = eh_test_support:with_cowboy(#{
    headers => #{},
    peer => {127, 0, 0, 1}
  }),
  ?assertEqual(<<"127.0.0.1">>, admin_utils:client_ip(Req)).

test_ipv4_tuple() ->
  ?assertEqual(<<"192.168.1.1">>, admin_utils:ip_to_binary({192, 168, 1, 1})).

%%%===================================================================
%%% Role / permission helpers (real admin table, no core_admin mock)
%%%===================================================================

role_setup() ->
  eh_test_support:start_mnesia(),
  eh_test_support:ensure_tables(?TABLES),
  eh_test_support:seed_admin(#{id => ?ADMIN_ID, role => admin}),
  eh_test_support:seed_admin(#{
    id => ?SUPER_ID,
    email => <<"super@test.local">>,
    role => superadmin,
    nickname => <<"super">>
  }),
  ok.

role_cleanup(_) ->
  eh_test_support:clear_tables(?TABLES),
  eh_test_support:delete_tables(?TABLES),
  eh_test_support:stop_mnesia(),
  ok.

role_utils_test_() ->
  {foreach, fun role_setup/0, fun role_cleanup/1, [
    {"is_admin / is_superadmin", fun test_is_admin_roles/0},
    {"check_role atom and list", fun test_check_role/0},
    {"get_permissions by role", fun test_get_permissions/0}
  ]}.

test_is_admin_roles() ->
  ?assertEqual(true, admin_utils:is_admin(?ADMIN_ID)),
  ?assertEqual(true, admin_utils:is_admin(?SUPER_ID)),
  ?assertEqual(false, admin_utils:is_admin(<<"missing">>)),
  ?assertEqual(true, admin_utils:is_superadmin(?SUPER_ID)),
  ?assertEqual(false, admin_utils:is_superadmin(?ADMIN_ID)),
  ?assertEqual(false, admin_utils:is_superadmin(<<"missing">>)).

test_check_role() ->
  ?assertEqual(true, admin_utils:check_role(?ADMIN_ID, admin)),
  ?assertEqual(false, admin_utils:check_role(?ADMIN_ID, superadmin)),
  ?assertEqual(true, admin_utils:check_role(?ADMIN_ID, [admin, moderator])),
  ?assertEqual(false, admin_utils:check_role(?ADMIN_ID, [superadmin, support])),
  ?assertEqual(true, admin_utils:check_role(?SUPER_ID, [admin, superadmin])),
  ?assertEqual(false, admin_utils:check_role(<<"missing">>, admin)),
  ?assertEqual(false, admin_utils:check_role(<<"missing">>, [admin])).

test_get_permissions() ->
  Super = admin_utils:get_permissions(superadmin),
  Admin = admin_utils:get_permissions(admin),
  Mod = admin_utils:get_permissions(moderator),
  Support = admin_utils:get_permissions(support),
  ?assert(lists:member(<<"manage_admins">>, Super)),
  ?assert(lists:member(<<"view_audit">>, Super)),
  ?assertEqual(false, lists:member(<<"manage_admins">>, Admin)),
  ?assert(lists:member(<<"manage_users">>, Admin)),
  ?assert(lists:member(<<"manage_tickets">>, Mod)),
  ?assertEqual(false, lists:member(<<"view_audit">>, Mod)),
  ?assertEqual([<<"manage_tickets">>, <<"view_stats">>], Support),
  ?assertEqual([], admin_utils:get_permissions(unknown)).