package httpkit

import (
	"net/http/httptest"
	"testing"

	"hyapp/services/gateway-service/internal/auth"
)

func TestRoomMetaUsesOnlySignedJWTDeviceClaim(t *testing.T) {
	request := httptest.NewRequest("POST", "/api/v1/rooms/gift/send", nil)
	request = request.WithContext(auth.WithClaims(request.Context(), auth.Claims{
		AppCode: "lalu", UserID: 42, SessionID: "sess-not-a-device", DeviceID: "device-auth-session-42",
	}))
	meta := RoomMeta(request, "room-1", "cmd-1")
	if meta.GetDeviceId() != "device-auth-session-42" || meta.GetSessionId() != "sess-not-a-device" {
		t.Fatalf("room meta auth snapshots mismatch: %+v", meta)
	}

	legacy := httptest.NewRequest("POST", "/api/v1/rooms/gift/send", nil)
	legacy = legacy.WithContext(auth.WithClaims(legacy.Context(), auth.Claims{
		AppCode: "lalu", UserID: 42, SessionID: "sess-legacy-must-not-be-device",
	}))
	legacyMeta := RoomMeta(legacy, "room-1", "cmd-legacy")
	if legacyMeta.GetDeviceId() != "" {
		// 存量 JWT 缺 device_id 时保留空值，fixed_v2 兼容，dynamic_v3 交给 owner fail-close。
		t.Fatalf("legacy room meta derived fake device_id=%q", legacyMeta.GetDeviceId())
	}
}
