honeyDueAPI/internal/handlers/document_handler_test.go

package handlers

import (
	"encoding/json"
	"fmt"
	"net/http"
	"testing"

	"github.com/labstack/echo/v4"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	"github.com/treytartt/casera-api/internal/models"
	"github.com/treytartt/casera-api/internal/repositories"
	"github.com/treytartt/casera-api/internal/services"
	"github.com/treytartt/casera-api/internal/testutil"
	"gorm.io/gorm"
)

func setupDocumentHandler(t *testing.T) (*DocumentHandler, *echo.Echo, *gorm.DB) {
	db := testutil.SetupTestDB(t)
	documentRepo := repositories.NewDocumentRepository(db)
	residenceRepo := repositories.NewResidenceRepository(db)
	documentService := services.NewDocumentService(documentRepo, residenceRepo)
	handler := NewDocumentHandler(documentService, nil) // nil storage for JSON-only tests
	e := testutil.SetupTestRouter()
	return handler, e, db
}

func TestDocumentHandler_ListDocuments(t *testing.T) {
	handler, e, db := setupDocumentHandler(t)
	user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
	residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
	testutil.CreateTestDocument(t, db, residence.ID, user.ID, "Test Doc")

	authGroup := e.Group("/api/documents")
	authGroup.Use(testutil.MockAuthMiddleware(user))
	authGroup.GET("/", handler.ListDocuments)

	t.Run("successful list", func(t *testing.T) {
		w := testutil.MakeRequest(e, "GET", "/api/documents/", nil, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusOK)

		var response []map[string]interface{}
		err := json.Unmarshal(w.Body.Bytes(), &response)
		require.NoError(t, err)
		assert.Len(t, response, 1)
		assert.Equal(t, "Test Doc", response[0]["title"])
	})
}

func TestDocumentHandler_CreateDocument(t *testing.T) {
	handler, e, db := setupDocumentHandler(t)
	user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
	residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")

	authGroup := e.Group("/api/documents")
	authGroup.Use(testutil.MockAuthMiddleware(user))
	authGroup.POST("/", handler.CreateDocument)

	t.Run("successful creation via JSON", func(t *testing.T) {
		body := map[string]interface{}{
			"title":        "Warranty Doc",
			"residence_id": residence.ID,
		}
		w := testutil.MakeRequest(e, "POST", "/api/documents/", body, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusCreated)

		var response map[string]interface{}
		err := json.Unmarshal(w.Body.Bytes(), &response)
		require.NoError(t, err)
		assert.Equal(t, "Warranty Doc", response["title"])
	})

	t.Run("creation without residence access", func(t *testing.T) {
		otherUser := testutil.CreateTestUser(t, db, "other", "other@test.com", "password")
		otherResidence := testutil.CreateTestResidence(t, db, otherUser.ID, "Other House")

		body := map[string]interface{}{
			"title":        "Unauthorized Doc",
			"residence_id": otherResidence.ID,
		}
		w := testutil.MakeRequest(e, "POST", "/api/documents/", body, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusForbidden)
	})
}

func TestDocumentHandler_GetDocument(t *testing.T) {
	handler, e, db := setupDocumentHandler(t)
	user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
	residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
	doc := testutil.CreateTestDocument(t, db, residence.ID, user.ID, "Test Doc")

	authGroup := e.Group("/api/documents")
	authGroup.Use(testutil.MockAuthMiddleware(user))
	authGroup.GET("/:id/", handler.GetDocument)

	t.Run("successful get", func(t *testing.T) {
		w := testutil.MakeRequest(e, "GET", fmt.Sprintf("/api/documents/%d/", doc.ID), nil, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusOK)

		var response map[string]interface{}
		err := json.Unmarshal(w.Body.Bytes(), &response)
		require.NoError(t, err)
		assert.Equal(t, "Test Doc", response["title"])
	})

	t.Run("document not found", func(t *testing.T) {
		w := testutil.MakeRequest(e, "GET", "/api/documents/99999/", nil, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusNotFound)
	})
}

func TestDocumentHandler_DeleteDocumentImage(t *testing.T) {
	handler, e, db := setupDocumentHandler(t)
	user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
	residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
	doc := testutil.CreateTestDocument(t, db, residence.ID, user.ID, "Test Doc")

	// Create a document image directly
	img := &models.DocumentImage{
		DocumentID: doc.ID,
		ImageURL:   "https://example.com/img.jpg",
		Caption:    "Test image",
	}
	require.NoError(t, db.Create(img).Error)

	authGroup := e.Group("/api/documents")
	authGroup.Use(testutil.MockAuthMiddleware(user))
	authGroup.DELETE("/:id/images/:imageId/", handler.DeleteDocumentImage)

	t.Run("successful delete", func(t *testing.T) {
		w := testutil.MakeRequest(e, "DELETE", fmt.Sprintf("/api/documents/%d/images/%d/", doc.ID, img.ID), nil, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusOK)

		var response map[string]interface{}
		err := json.Unmarshal(w.Body.Bytes(), &response)
		require.NoError(t, err)
		assert.Equal(t, "Test Doc", response["title"])

		// Verify image is deleted
		images := response["images"].([]interface{})
		assert.Len(t, images, 0)
	})

	t.Run("image not found", func(t *testing.T) {
		w := testutil.MakeRequest(e, "DELETE", fmt.Sprintf("/api/documents/%d/images/99999/", doc.ID), nil, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusNotFound)
	})

	t.Run("document not found", func(t *testing.T) {
		w := testutil.MakeRequest(e, "DELETE", "/api/documents/99999/images/1/", nil, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusNotFound)
	})

	t.Run("access denied", func(t *testing.T) {
		otherUser := testutil.CreateTestUser(t, db, "other", "other@test.com", "password")
		otherResidence := testutil.CreateTestResidence(t, db, otherUser.ID, "Other House")
		otherDoc := testutil.CreateTestDocument(t, db, otherResidence.ID, otherUser.ID, "Other Doc")

		otherImg := &models.DocumentImage{
			DocumentID: otherDoc.ID,
			ImageURL:   "https://example.com/other.jpg",
		}
		require.NoError(t, db.Create(otherImg).Error)

		w := testutil.MakeRequest(e, "DELETE", fmt.Sprintf("/api/documents/%d/images/%d/", otherDoc.ID, otherImg.ID), nil, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusForbidden)
	})
}

func TestDocumentHandler_UploadDocumentImage_NoStorage(t *testing.T) {
	handler, e, db := setupDocumentHandler(t)
	user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
	residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
	doc := testutil.CreateTestDocument(t, db, residence.ID, user.ID, "Test Doc")

	authGroup := e.Group("/api/documents")
	authGroup.Use(testutil.MockAuthMiddleware(user))
	authGroup.POST("/:id/images/", handler.UploadDocumentImage)

	t.Run("document not found", func(t *testing.T) {
		// Send a plain request (no multipart) - will fail at parse
		w := testutil.MakeRequest(e, "POST", "/api/documents/99999/images/", nil, "test-token")
		// Should get 400 because no multipart form
		assert.True(t, w.Code == http.StatusBadRequest || w.Code == http.StatusNotFound,
			"expected 400 or 404, got %d", w.Code)
	})

	_ = doc // used to set up test data
}

func TestDocumentHandler_DeleteDocument(t *testing.T) {
	handler, e, db := setupDocumentHandler(t)
	user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
	residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
	doc := testutil.CreateTestDocument(t, db, residence.ID, user.ID, "Test Doc")

	authGroup := e.Group("/api/documents")
	authGroup.Use(testutil.MockAuthMiddleware(user))
	authGroup.DELETE("/:id/", handler.DeleteDocument)

	t.Run("successful delete", func(t *testing.T) {
		w := testutil.MakeRequest(e, "DELETE", fmt.Sprintf("/api/documents/%d/", doc.ID), nil, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusOK)
	})

	t.Run("document not found after delete", func(t *testing.T) {
		// Already soft-deleted above
		w := testutil.MakeRequest(e, "DELETE", fmt.Sprintf("/api/documents/%d/", doc.ID), nil, "test-token")
		testutil.AssertStatusCode(t, w, http.StatusNotFound)
	})
}