require "rails_helper"

RSpec.describe "Sessions" do
  describe "GET /identify" do
    it "renders the identification page" do
      get identify_path

      expect(response).to have_http_status(:ok)
      expect(response.body).to include("Identify yourself")
    end
  end

  describe "POST /identify" do
    it "identifies a new user with the current access key" do
      access_key = AccessKey.current

      expect do
        post session_path, params: { name: "Driver One", email: "DRIVER@example.com", key: access_key.raw_key }
      end.to change(User, :count).by(1).and change(UserSession, :count).by(1)

      expect(response).to redirect_to(vehicles_path)
      expect(User.last.email).to eq("driver@example.com")
    end

    it "identifies an existing user when the name matches" do
      access_key = AccessKey.current
      user = create(:user, name: "Driver One", email: "driver@example.com")

      expect do
        post session_path, params: { name: "Driver One", email: "driver@example.com", key: access_key.raw_key }
      end.to change(UserSession, :count).by(1).and change(User, :count).by(0)

      expect(response).to redirect_to(vehicles_path)
      expect(UserSession.last.user).to eq(user)
    end

    it "rejects an existing email when the name does not match" do
      access_key = AccessKey.current
      create(:user, name: "Driver One", email: "driver@example.com")

      expect do
        post session_path, params: { name: "Driver Two", email: "driver@example.com", key: access_key.raw_key }
      end.not_to change(UserSession, :count)

      expect(response).to have_http_status(:unprocessable_content)
      expect(response.body).to include("name does not match")
    end

    it "rejects invalid access keys and logs the attempt" do
      AccessKey.current
      allow(Rails.logger).to receive(:warn)

      expect do
        post session_path, params: { name: "Driver One", email: "driver@example.com", key: "wrong-key" }
      end.not_to change(UserSession, :count)

      expect(response).to have_http_status(:unprocessable_content)
      expect(response.body).to include("access key is not valid")
      expect(Rails.logger).to have_received(:warn).with(/Invalid access key identification attempt/)
    end
  end

  describe "DELETE /session" do
    it "logs the user out" do
      identify_user

      expect do
        delete logout_path
      end.to change(UserSession, :count).by(-1)

      expect(response).to redirect_to(identify_path)
    end
  end

  def identify_user(user = create(:user))
    access_key = AccessKey.current
    post session_path, params: { name: user.name, email: user.email, key: access_key.raw_key }
  end
end