auth.test.ts

/**
 * Tests for src/middleware/auth.ts (requireAuth + getUserId).
 *
 * Uses sessionManager singleton — clears state between tests to avoid leaks.
 */
import { describe, it, expect, beforeEach, vi } from 'vitest';
import { requireAuth, getUserId, AuthContext } from './auth.js';
import { sessionManager } from '../services/session-manager.js';
import { buildContext, defaultUser } from '../test/factories.js';

beforeEach(() => {
  // wipe all sessions before each test to ensure isolation
  for (const [uid] of sessionManager.getAllSessions()) {
    sessionManager.removeSession(uid);
  }
});

describe('getUserId', () => {
  it('extracts user_id from ctx.user (bot_started)', () => {
    const ctx = { user: { user_id: 100 } } as unknown as AuthContext;
    expect(getUserId(ctx)).toBe(100);
  });

  it('extracts user_id from ctx.message.sender (message_created)', () => {
    const ctx = { message: { sender: { user_id: 200 } } } as unknown as AuthContext;
    expect(getUserId(ctx)).toBe(200);
  });

  it('extracts user_id from ctx.callback.user (message_callback)', () => {
    const ctx = { callback: { user: { user_id: 300 } } } as unknown as AuthContext;
    expect(getUserId(ctx)).toBe(300);
  });

  it('returns undefined when no user is present', () => {
    const ctx = {} as AuthContext;
    expect(getUserId(ctx)).toBeUndefined();
  });

  it('prefers ctx.user over ctx.message and ctx.callback', () => {
    const ctx = {
      user: { user_id: 1 },
      message: { sender: { user_id: 2 } },
      callback: { user: { user_id: 3 } },
    } as unknown as AuthContext;
    expect(getUserId(ctx)).toBe(1);
  });
});

describe('requireAuth', () => {
  it('runs the wrapped handler when user has a session', async () => {
    const userId = 555;
    sessionManager.createSession(
      userId,
      { access_token: 'a', refresh_token: 'r' },
      { id: 1, name: 'Test', email: 'x@x.x', role: 'partner' },
    );

    const handler = vi.fn().mockResolvedValue('ok');
    const wrapped = requireAuth(handler);

    const ctx = buildContext({ user: defaultUser({ user_id: userId }) });
    await wrapped(ctx);

    expect(handler).toHaveBeenCalledOnce();
    const passedCtx = handler.mock.calls[0]![0]!;
    expect(passedCtx.session).toBeDefined();
    expect(passedCtx.apiClient).toBeDefined();
    expect(ctx.reply).not.toHaveBeenCalled();
  });

  it('blocks anonymous users and asks them to /login', async () => {
    const handler = vi.fn();
    const wrapped = requireAuth(handler);

    const ctx = buildContext({ user: defaultUser({ user_id: 999 }) });
    await wrapped(ctx);

    expect(handler).not.toHaveBeenCalled();
    expect(ctx.reply).toHaveBeenCalledOnce();
    const [text, opts] = (ctx.reply as ReturnType<typeof vi.fn>).mock.calls[0]!;
    expect(text).toMatch(/не авторизованы/i);
    expect(opts).toMatchObject({ format: 'html' });
    expect(opts.attachments).toBeDefined();
  });

  it('returns silently when user_id cannot be extracted', async () => {
    const handler = vi.fn();
    const wrapped = requireAuth(handler);

    const ctx = {} as AuthContext;
    const result = await wrapped(ctx);

    expect(result).toBeUndefined();
    expect(handler).not.toHaveBeenCalled();
  });
});