defmodule ExMCP.Authorization.DiscoveryFlowTest do
  use ExUnit.Case, async: true

  alias ExMCP.Authorization.DiscoveryFlow

  # These tests verify the flow logic without making real HTTP calls.
  # Full integration tests with Bypass would test the actual HTTP layer.

  describe "execute/1" do
    test "returns error when resource discovery fails" do
      config = %{
        resource_url: "https://nonexistent.example.com/mcp",
        client_id: "test-client",
        auth_method: :client_secret,
        client_secret: "secret"
      }

      assert {:error, {:discovery_failed, _}} = DiscoveryFlow.execute(config)
    end

    test "returns error for invalid auth method" do
      # This would only be reached if discovery succeeded, so we test
      # the validation separately through the type system
      config = %{
        resource_url: "https://example.com/mcp",
        client_id: "test-client",
        auth_method: :invalid_method
      }

      # Will fail at discovery step first
      assert {:error, _} = DiscoveryFlow.execute(config)
    end

    test "returns error when client_secret is missing for :client_secret method" do
      # To test this path, we'd need discovery to succeed
      # Testing the select_auth_method logic indirectly
      config = %{
        resource_url: "https://example.com/mcp",
        client_id: "test-client",
        auth_method: :client_secret
        # missing :client_secret
      }

      assert {:error, _} = DiscoveryFlow.execute(config)
    end

    test "returns error when private_key is missing for :private_key_jwt method" do
      config = %{
        resource_url: "https://example.com/mcp",
        client_id: "test-client",
        auth_method: :private_key_jwt
        # missing :private_key
      }

      assert {:error, _} = DiscoveryFlow.execute(config)
    end
  end
end
