# auth.test --
#
# Tests HTTP authentication options against the local test server.
#
# Copyright (c) 2024-2026 Massimo Manghi
#
# SPDX-License-Identifier: TCL
#
# See the file "license.terms" at the top level of this distribution
# for information on usage and redistribution of this file, and for the
# complete disclaimer of warranties and limitation of liability.
#
# Portions of this file were drafted or revised with AI assistance
# under the direction and review of Massimo Manghi

package require tcltest
namespace import ::tcltest::*

source [file join [file dirname [file normalize [info script]]] support.tcl]
source [file join [file dirname [file normalize [info script]]] http_common.tcl]

::tclcurl::test::load_package

test auth-1.1 {a protected endpoint returns 401 without credentials} -constraints http_server -body {
    set body {}
    ::tclcurl::test::with_easy_handle handle {
        $handle configure -url [::tclcurl::test::server::base_url auth-basic] \
                          -bodyvar body \
                          -noprogress 1
        set rc [$handle perform]
        list $rc \
             [$handle getinfo responsecode] \
             [expr {[::tclcurl::test::normalizedBody $body] eq "auth=missing"}]
    }
} -result {0 401 1}

test auth-1.2 {-userpwd authenticates with HTTP Basic credentials} -constraints http_server -body {
    set body {}
    ::tclcurl::test::with_easy_handle handle {
        $handle configure -url [::tclcurl::test::server::base_url auth-basic] \
                          -userpwd "testuser:testpass" \
                          -bodyvar body \
                          -noprogress 1
        set rc [$handle perform]
        set response [::tclcurl::test::parse_server_response $body]
        list $rc \
             [$handle getinfo responsecode] \
             [dict get $response auth] \
             [dict get $response user]
    }
} -result {0 200 ok testuser}

test auth-1.3 {-username and -password authenticate with HTTP Basic credentials} -constraints http_server -body {
    set body {}
    ::tclcurl::test::with_easy_handle handle {
        $handle configure -url [::tclcurl::test::server::base_url auth-basic] \
                          -username "testuser" \
                          -password "testpass" \
                          -bodyvar body \
                          -noprogress 1
        set rc [$handle perform]
        set response [::tclcurl::test::parse_server_response $body]
        list $rc \
             [$handle getinfo responsecode] \
             [dict get $response auth] \
             [dict get $response user]
    }
} -result {0 200 ok testuser}

test auth-1.4 {wrong credentials are rejected} -constraints http_server -body {
    set body {}
    ::tclcurl::test::with_easy_handle handle {
        $handle configure -url [::tclcurl::test::server::base_url auth-basic] \
                          -userpwd "testuser:wrongpass" \
                          -bodyvar body \
                          -noprogress 1
        set rc [$handle perform]
        list $rc \
             [$handle getinfo responsecode] \
             [expr {[::tclcurl::test::normalizedBody $body] eq "auth=denied"}]
    }
} -result {0 401 1}

test auth-1.5 {-httpauth basic works together with explicit credentials} -constraints http_server -body {
    set body {}
    ::tclcurl::test::with_easy_handle handle {
        $handle configure -url [::tclcurl::test::server::base_url auth-basic] \
                          -httpauth basic \
                          -userpwd "testuser:testpass" \
                          -bodyvar body \
                          -noprogress 1
        set rc [$handle perform]
        set response [::tclcurl::test::parse_server_response $body]
        list $rc \
             [$handle getinfo responsecode] \
             [dict get $response auth] \
             [dict get $response user]
    }
} -result {0 200 ok testuser}

cleanupTests
