//! Session revocation workflow tests.
//!
//! Tests the ability to revoke individual sessions and all other sessions.

use crate::harness::TestHarness;

#[tokio::test]
async fn revoke_all_other_sessions() {
    let mut h = TestHarness::new().await;
    let _user_id = h.signup("sessrev", "sessrev@test.com", "password123").await;

    // The user is now logged in with one session.
    // Revoking all other sessions should succeed (even if there are no others).
    let resp = h
        .client
        .delete("/api/users/me/sessions")
        .await;
    assert!(
        resp.status.is_success(),
        "Revoke all other sessions should succeed: {} {}",
        resp.status, resp.text
    );
}

#[tokio::test]
async fn revoke_all_sessions_requires_auth() {
    let mut h = TestHarness::new().await;

    // Not logged in — should be rejected
    let resp = h
        .client
        .delete("/api/users/me/sessions")
        .await;
    assert!(
        resp.status.is_client_error() || resp.status.is_redirection(),
        "Unauthenticated session revocation should be rejected: {} {}",
        resp.status, resp.text
    );
}

#[tokio::test]
async fn revoke_nonexistent_session_succeeds_gracefully() {
    let mut h = TestHarness::new().await;
    let _user_id = h.signup("sessbad", "sessbad@test.com", "password123").await;

    // The handler deletes 0 rows silently and re-renders the sessions page.
    // Verify it doesn't panic or error.
    let fake_id = uuid::Uuid::new_v4();
    let resp = h
        .client
        .delete(&format!("/api/users/me/sessions/{}", fake_id))
        .await;
    assert!(
        resp.status.is_success(),
        "Nonexistent session revocation should succeed gracefully: {} {}",
        resp.status, resp.text
    );
}