mana-swift-core/Tests/ManaCoreTests/AuthClientGuestAndResilienceTests.swift

import Foundation
import Testing
@testable import ManaCore

@Suite("AuthClient Guest-Mode + Resilience")
@MainActor
struct AuthClientGuestAndResilienceTests {
    // MARK: - enterGuestMode / currentGuestId

    @Test("enterGuestMode aus signedOut erzeugt UUID und setzt .guest")
    func enterGuestModeFromSignedOut() throws {
        let mocked = makeMockedAuth()
        mocked.auth.bootstrap()
        #expect(mocked.auth.status == .signedOut)

        let id = try mocked.auth.enterGuestMode()
        #expect(!id.isEmpty)
        #expect(mocked.auth.status == .guest(id: id))
        #expect(mocked.auth.currentGuestId() == id)
    }

    @Test("enterGuestMode ist idempotent")
    func enterGuestModeIdempotent() throws {
        let mocked = makeMockedAuth()
        let first = try mocked.auth.enterGuestMode()
        let second = try mocked.auth.enterGuestMode()
        #expect(first == second)
        #expect(mocked.auth.status == .guest(id: first))
    }

    @Test("enterGuestMode stört aktive Session nicht")
    func enterGuestModeKeepsSignedIn() throws {
        let mocked = makeMockedAuth()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))

        let id = try mocked.auth.enterGuestMode()
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
        #expect(mocked.auth.currentGuestId() == id)
    }

    @Test("clearGuestId aus .guest fällt auf .signedOut")
    func clearGuestIdFromGuest() throws {
        let mocked = makeMockedAuth()
        _ = try mocked.auth.enterGuestMode()
        mocked.auth.clearGuestId()
        #expect(mocked.auth.status == .signedOut)
        #expect(mocked.auth.currentGuestId() == nil)
    }

    @Test("clearGuestId aus .signedIn behält Status")
    func clearGuestIdKeepsSignedIn() throws {
        let mocked = makeMockedAuth()
        _ = try mocked.auth.enterGuestMode()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.auth.clearGuestId()
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
        #expect(mocked.auth.currentGuestId() == nil)
    }

    // MARK: - bootstrap

    @Test("bootstrap erkennt nur-Guest-Keychain als .guest")
    func bootstrapDetectsGuest() throws {
        let mocked = makeMockedAuth()
        _ = try mocked.auth.enterGuestMode()
        mocked.auth.bootstrap()
        if case let .guest(id) = mocked.auth.status {
            #expect(!id.isEmpty)
        } else {
            Issue.record("Expected .guest after bootstrap, got \(mocked.auth.status)")
        }
    }

    @Test("bootstrap priorisiert Session über Guest")
    func bootstrapPrioritisesSession() throws {
        let mocked = makeMockedAuth()
        _ = try mocked.auth.enterGuestMode()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.auth.bootstrap()
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
    }

    // MARK: - signOut(keepGuestMode:)

    @Test("signOut Default löscht alles inkl. Guest-ID")
    func signOutDefaultClearsGuest() async throws {
        let mocked = makeMockedAuth()
        _ = try mocked.auth.enterGuestMode()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in (200, Data()) }

        await mocked.auth.signOut()
        #expect(mocked.auth.status == .signedOut)
        #expect(mocked.auth.currentGuestId() == nil)
    }

    @Test("signOut(keepGuestMode: true) behält existierende Guest-ID")
    func signOutKeepsExistingGuest() async throws {
        let mocked = makeMockedAuth()
        let id = try mocked.auth.enterGuestMode()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in (200, Data()) }

        await mocked.auth.signOut(keepGuestMode: true)
        #expect(mocked.auth.status == .guest(id: id))
        #expect(mocked.auth.currentGuestId() == id)
    }

    @Test("signOut(keepGuestMode: true) erzeugt neue Guest-ID wenn keine existiert")
    func signOutCreatesGuestWhenMissing() async throws {
        let mocked = makeMockedAuth()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in (200, Data()) }

        await mocked.auth.signOut(keepGuestMode: true)
        if case let .guest(id) = mocked.auth.status {
            #expect(!id.isEmpty)
            #expect(mocked.auth.currentGuestId() == id)
        } else {
            Issue.record("Expected .guest after signOut(keepGuestMode:), got \(mocked.auth.status)")
        }
    }

    // MARK: - refreshAccessToken Resilience

    @Test("refresh 503 wirft serviceUnavailable, behält Session")
    func refreshKeepsSessionOn503() async throws {
        let mocked = makeMockedAuth()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in
            (503, Data(#"{"error":"SERVICE_UNAVAILABLE","status":503}"#.utf8))
        }

        do {
            _ = try await mocked.auth.refreshAccessToken()
            Issue.record("Expected throw on 503")
        } catch let err as AuthError {
            #expect(err == .serviceUnavailable)
        }
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
    }

    @Test("refresh 500 wirft serverInternal, behält Session")
    func refreshKeepsSessionOn500() async throws {
        let mocked = makeMockedAuth()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in
            (500, Data(#"{"error":"INTERNAL","status":500}"#.utf8))
        }

        do {
            _ = try await mocked.auth.refreshAccessToken()
            Issue.record("Expected throw on 500")
        } catch let err as AuthError {
            #expect(err == .serverInternal)
        }
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
    }

    @Test("refresh 429 wirft rateLimited, behält Session")
    func refreshKeepsSessionOnRateLimit() async throws {
        let mocked = makeMockedAuth()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in
            (429, Data(#"{"error":"RATE_LIMITED","retryAfterSec":30,"status":429}"#.utf8))
        }

        do {
            _ = try await mocked.auth.refreshAccessToken()
            Issue.record("Expected throw on 429")
        } catch let err as AuthError {
            if case let .rateLimited(retryAfter) = err {
                #expect(retryAfter == 30)
            } else {
                Issue.record("Expected .rateLimited, got \(err)")
            }
        }
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
    }

    @Test("refresh 401 invalidiert Session ohne Guest → .signedOut")
    func refreshInvalidates401NoGuest() async throws {
        let mocked = makeMockedAuth()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in
            (401, Data(#"{"error":"UNAUTHORIZED","status":401}"#.utf8))
        }

        do {
            _ = try await mocked.auth.refreshAccessToken()
            Issue.record("Expected throw on 401")
        } catch let err as AuthError {
            #expect(err.invalidatesSession)
        }
        #expect(mocked.auth.status == .signedOut)
    }

    @Test("refresh 401 mit Guest-ID fällt auf .guest zurück")
    func refreshInvalidates401WithGuest() async throws {
        let mocked = makeMockedAuth()
        let id = try mocked.auth.enterGuestMode()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in
            (401, Data(#"{"error":"UNAUTHORIZED","status":401}"#.utf8))
        }

        _ = try? await mocked.auth.refreshAccessToken()
        #expect(mocked.auth.status == .guest(id: id))
        #expect(mocked.auth.currentGuestId() == id)
    }

    // MARK: - Refresh-Coalescing

    @Test("coalescing: parallele Refreshes teilen einen /refresh-Call")
    func refreshCoalescesConcurrentCalls() async throws {
        let mocked = makeMockedAuth()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        let counter = CallCounter()
        mocked.setHandler { _ in
            counter.increment()
            return (200, Data(#"{"accessToken":"new-access","refreshToken":"new-refresh"}"#.utf8))
        }

        // Drei gleichzeitige Refreshes. Ohne Coalescing würde jeder den
        // (jetzt rotierten) Token "r" schicken → der Server invalidiert
        // beim zweiten → Logout. Mit Coalescing genau ein /refresh-Call.
        async let first = mocked.auth.refreshAccessToken()
        async let second = mocked.auth.refreshAccessToken()
        async let third = mocked.auth.refreshAccessToken()
        let results = try await [first, second, third]

        #expect(results.allSatisfy { $0 == "new-access" })
        #expect(counter.value == 1)
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
    }

    @Test("coalescing: nach Abschluss startet ein neuer Refresh frisch")
    func refreshNotCoalescedAfterCompletion() async throws {
        let mocked = makeMockedAuth()
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        let counter = CallCounter()
        mocked.setHandler { _ in
            counter.increment()
            return (200, Data(#"{"accessToken":"new-access","refreshToken":"new-refresh"}"#.utf8))
        }

        _ = try await mocked.auth.refreshAccessToken()
        _ = try await mocked.auth.refreshAccessToken()

        // Sequenziell → kein Coalescing, zwei echte Calls.
        #expect(counter.value == 2)
    }

    // MARK: - RefreshFailurePolicy.softFirst

    @Test("softFirst: erster 401-Refresh behält Session, zweiter wiped")
    func softFirstSecondFailureWipes() async throws {
        let mocked = makeMockedAuth(refreshFailurePolicy: .softFirst)
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in
            (401, Data(#"{"error":"UNAUTHORIZED","status":401}"#.utf8))
        }

        // Erster Versuch — wirft, aber Session bleibt
        do {
            _ = try await mocked.auth.refreshAccessToken()
            Issue.record("Expected throw")
        } catch let err as AuthError {
            #expect(err.invalidatesSession)
        }
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
        #expect(mocked.auth.refreshFailureCount == 1)

        // Zweiter Versuch — wiped jetzt
        do {
            _ = try await mocked.auth.refreshAccessToken()
            Issue.record("Expected throw")
        } catch let err as AuthError {
            #expect(err.invalidatesSession)
        }
        #expect(mocked.auth.status == .signedOut)
        #expect(mocked.auth.refreshFailureCount == 2)
    }

    @Test("softFirst: 401 nach erfolgreichem Refresh wiped NICHT sofort (Regression 2026-06-02)")
    func softFirstAfterSuccessDoesNotWipeOnFirstFailure() async throws {
        let mocked = makeMockedAuth(refreshFailurePolicy: .softFirst)
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")

        // Erst erfolgreich refreshen — wie der scenePhase-Heartbeat beim
        // App-Start. Setzt `refreshOnceSucceeded = true`.
        mocked.setHandler { _ in
            (200, Data(#"{"accessToken":"new-a","refreshToken":"new-r"}"#.utf8))
        }
        _ = try await mocked.auth.refreshAccessToken()
        #expect(mocked.auth.refreshOnceSucceeded)
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))

        // Dann ein EINZELNER 401. FRÜHER (Bug): `refreshOnceSucceeded`
        // erzwang sofort den Wipe → auf dem geteilten Keychain Flotten-
        // Logout. JETZT: Session bleibt, erst der zweite invalidierende
        // Fehler in Folge wiped.
        mocked.setHandler { _ in
            (401, Data(#"{"error":"UNAUTHORIZED","status":401}"#.utf8))
        }
        do {
            _ = try await mocked.auth.refreshAccessToken()
            Issue.record("Expected throw")
        } catch let err as AuthError {
            #expect(err.invalidatesSession)
        }
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
        #expect(mocked.auth.refreshFailureCount == 1)

        // Zweiter 401 in Folge → jetzt sauberer Wipe.
        do {
            _ = try await mocked.auth.refreshAccessToken()
            Issue.record("Expected throw")
        } catch let err as AuthError {
            #expect(err.invalidatesSession)
        }
        #expect(mocked.auth.status == .signedOut)
        #expect(mocked.auth.refreshFailureCount == 2)
    }

    @Test("Shared-Keychain: 401, aber Token wurde unter uns ausgetauscht → retry statt Wipe")
    func refreshReReadsTokenBeforeWipe() async throws {
        // Selbst `.immediateWipe` darf NICHT wipen, wenn ein anderer
        // Prozess (andere mana-App, Widget) zwischenzeitlich einen frischen
        // Token in den geteilten Keychain geschrieben hat.
        let mocked = makeMockedAuth(refreshFailurePolicy: .immediateWipe)
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r-old")
        let store = KeychainStore(service: "ev.mana.test.\(mocked.testID)")
        let counter = CallCounter()

        mocked.setHandler { _ in
            counter.increment()
            if counter.value == 1 {
                // Simuliert: parallele App hat eben frisch refresht und den
                // rotierten Token in den geteilten Keychain geschrieben.
                try? store.setString("r-new", for: .refreshToken)
                return (401, Data(#"{"error":"UNAUTHORIZED","status":401}"#.utf8))
            }
            return (200, Data(#"{"accessToken":"a2","refreshToken":"r-new"}"#.utf8))
        }

        let token = try await mocked.auth.refreshAccessToken()
        #expect(token == "a2")
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
        #expect(mocked.auth.refreshFailureCount == 0)
        #expect(counter.value == 2)
    }

    @Test("Refresh-200 ohne refreshToken behält bestehenden Session-Token")
    func refreshWithoutRefreshTokenKeepsExisting() async throws {
        let mocked = makeMockedAuth(refreshFailurePolicy: .softFirst)
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r-keep")

        // Server liefert 200, aber der best-effort get-session-Subcall fiel
        // aus → `refreshToken` fehlt. Früher: DecodingError auf einem
        // erfolgreichen Refresh → Access-Token nie gespeichert → Loop.
        mocked.setHandler { _ in
            (200, Data(#"{"accessToken":"new-a"}"#.utf8))
        }
        let token = try await mocked.auth.refreshAccessToken()
        #expect(token == "new-a")
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))

        let store = KeychainStore(service: "ev.mana.test.\(mocked.testID)")
        #expect(store.getString(for: .accessToken) == "new-a")
        #expect(store.getString(for: .refreshToken) == "r-keep")
    }

    @Test("softFirst: transienter 503 ändert nichts an Counter")
    func softFirstTransientDoesNotCount() async throws {
        let mocked = makeMockedAuth(refreshFailurePolicy: .softFirst)
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in
            (503, Data(#"{"error":"SERVICE_UNAVAILABLE","status":503}"#.utf8))
        }

        _ = try? await mocked.auth.refreshAccessToken()
        #expect(mocked.auth.status == .signedIn(email: "u@x.de"))
        #expect(mocked.auth.refreshFailureCount == 0)
    }

    @Test("immediateWipe: erster 401 wiped sofort (Default-Verhalten)")
    func immediateWipeFirstFailureWipes() async throws {
        let mocked = makeMockedAuth(refreshFailurePolicy: .immediateWipe)
        try mocked.auth.persistSession(email: "u@x.de", accessToken: "a", refreshToken: "r")
        mocked.setHandler { _ in
            (401, Data(#"{"error":"UNAUTHORIZED","status":401}"#.utf8))
        }

        _ = try? await mocked.auth.refreshAccessToken()
        #expect(mocked.auth.status == .signedOut)
    }

    // MARK: - AuthError.invalidatesSession

    @Test("invalidatesSession unterscheidet Session-Tot vs. transient")
    func invalidatesSessionPartitioning() {
        // Tot — Session muss weg
        #expect(AuthError.invalidCredentials.invalidatesSession)
        #expect(AuthError.unauthorized.invalidatesSession)
        #expect(AuthError.tokenExpired.invalidatesSession)
        #expect(AuthError.tokenInvalid.invalidatesSession)

        // Transient — Session bleibt
        #expect(!AuthError.serviceUnavailable.invalidatesSession)
        #expect(!AuthError.serverInternal.invalidatesSession)
        #expect(!AuthError.networkFailure("offline").invalidatesSession)
        #expect(!AuthError.rateLimited(retryAfter: 30).invalidatesSession)
        #expect(!AuthError.accountLocked(retryAfter: nil).invalidatesSession)
    }
}