package com.example.todo;
import java.util.Optional;
import org.junit.jupiter.api.Test;
import org.springframework.web.server.ResponseStatusException;
import static org.junit.jupiter.api.Assertions.*;
import static org.mockito.Mockito.*;
class OwnershipTest {
    @Test void foreignTodoCannotBeReadUpdatedOrDeleted() {
        PersonalTodoRepository repo=mock(PersonalTodoRepository.class);
        when(repo.findByIdAndOwnerId("alice-task","bob")).thenReturn(Optional.empty());
        PersonalTodoService service=new PersonalTodoService(repo);
        assertEquals(404,assertThrows(ResponseStatusException.class,() -> service.get("alice-task","bob")).getStatusCode().value());
        assertThrows(ResponseStatusException.class,() -> service.update("alice-task","bob",new TodoRequest("Hacked",true)));
        assertThrows(ResponseStatusException.class,() -> service.delete("alice-task","bob"));
        verify(repo,never()).save(any()); verify(repo,never()).delete(any(PersonalTodo.class));
        verify(repo,never()).findById(anyString());
    }
    @Test void newTodoAlwaysUsesAuthenticatedOwner() {
        PersonalTodoRepository repo=mock(PersonalTodoRepository.class);
        when(repo.save(any(PersonalTodo.class))).thenAnswer(i -> i.getArgument(0));
        PersonalTodo todo=new PersonalTodoService(repo).create("alice",new TodoRequest(" Plan ",false));
        assertEquals("alice",todo.getOwnerId()); assertEquals("Plan",todo.getTitle());
    }
}