package movementtest

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

// Every public page must answer HEAD, not 405.
//
// chi routes HEAD only where a handler is registered for it, so a router built
// from r.Get alone refuses every HEAD request — and HEAD is what uptime
// checks, link unfurlers and a fair amount of crawler traffic send before
// anything else. This was found with curl -I against the deployed host after
// the first deploy, which is later than it should have been.
func TestPublicPagesAnswerHead(t *testing.T) {
	h := newApp(t)

	for _, path := range []string{"/", "/no-ai", "/uneasy", "/all-in"} {
		req := httptest.NewRequest(http.MethodHead, path, nil)
		rec := httptest.NewRecorder()
		h.ServeHTTP(rec, req)

		if rec.Code != http.StatusOK {
			t.Errorf("HEAD %s: status %d, want 200", path, rec.Code)
		}
	}
}

// HEAD must not become a way to make the app do work a GET would refuse.
// csrf.Protect only guards state-changing methods, so the check that matters
// is that the signup endpoint still refuses anything but POST.
func TestSignupIgnoresHead(t *testing.T) {
	h := newApp(t)

	req := httptest.NewRequest(http.MethodHead, "/signup", nil)
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)

	if rec.Code == http.StatusOK {
		t.Error("HEAD /signup answered 200; only POST should reach the handler")
	}
	if got := countNonces(t, h); got != 0 {
		t.Errorf("a HEAD request spent %d nonces", got)
	}
}