package server

import (
	"bytes"
	"log/slog"
	"strings"
	"testing"

	"steward/internal/api"
)

// TestFailedLoginLogged: a failed login and a refused token are logged
// with the address first, for Guard's and fail2ban's patterns.
func TestFailedLoginLogged(t *testing.T) {
	e := newEnv(t)
	var buf bytes.Buffer
	e.srv.log = slog.New(slog.NewTextHandler(&buf, nil))
	e.call("", "POST", "/auth/login", api.Login{Username: "x ip=8.8.8.8", Password: "wrong"}, nil)
	e.call("steward_aaaaaaaaaaaaaaaa_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "GET", "/status", nil, nil)
	for _, want := range []string{`msg="login failed" ip=127.0.0.1 user="x ip=8.8.8.8"`, `msg="token refused" ip=127.0.0.1 reason=`} {
		if !strings.Contains(buf.String(), want) {
			t.Errorf("no %q in\n%s", want, buf.String())
		}
	}
}