package httpapi

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

// TestFirewallRoutesGone verifies the firewall subsystem HTTP surface has been
// decommissioned in favor of the standalone EvoFirewall service (see docs/firewall.md).
// Every legacy /v1/firewall/* path — public and authenticated — must answer 410 Gone.
func TestFirewallRoutesGone(t *testing.T) {
	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
	if err != nil {
		t.Fatal(err)
	}
	defer srv.Close()
	tenant, _, _, _, _ := srv.Store().DemoIDs()
	mustSetTestAPIKeys(t, srv, "opkey|"+tenant+"|operator")

	ts := httptest.NewServer(srv.Handler())
	defer ts.Close()
	client := ts.Client()

	cases := []struct {
		method string
		path   string
		auth   bool // send a valid operator bearer token
	}{
		{http.MethodPost, "/v1/firewall/enroll", false},
		{http.MethodGet, "/v1/firewall/install.sh", false},
		{http.MethodGet, "/v1/firewall/sync-script", false},
		{http.MethodGet, "/v1/firewall/install-context", true},
		{http.MethodGet, "/v1/firewall/clients", true},
		{http.MethodGet, "/v1/firewall/clients/any-id", true},
		{http.MethodGet, "/v1/firewall/rules", true},
		{http.MethodGet, "/v1/firewall/blocklist", false},
		{http.MethodPost, "/v1/firewall/apply-report", false},
		{http.MethodPost, "/v1/firewall/heartbeat", false},
	}
	for _, tc := range cases {
		req, err := http.NewRequest(tc.method, ts.URL+tc.path, nil)
		if err != nil {
			t.Fatal(err)
		}
		if tc.auth {
			req.Header.Set("Authorization", "Bearer opkey")
		}
		resp, err := client.Do(req)
		if err != nil {
			t.Fatal(err)
		}
		_ = resp.Body.Close()
		if resp.StatusCode != http.StatusGone {
			t.Fatalf("%s %s: want 410 got %d", tc.method, tc.path, resp.StatusCode)
		}
	}
}