irdb/api/tests/Integration/Internal/JobsEndpointsTest.php

<?php

declare(strict_types=1);

namespace App\Tests\Integration\Internal;

use App\Tests\Integration\Support\AppTestCase;

/**
 * End-to-end coverage for `/internal/jobs/*`. The AppTestCase boots a Slim
 * app whose ServerRequestFactory does NOT populate REMOTE_ADDR — so we
 * inject one explicitly via the request() helper override below to satisfy
 * InternalNetworkMiddleware.
 */
final class JobsEndpointsTest extends AppTestCase
{
    private const TOKEN = 'test-internal-token';

    protected function setUp(): void
    {
        // Ensure the container picks up our internal token.
        putenv('INTERNAL_JOB_TOKEN=' . self::TOKEN);
        $_ENV['INTERNAL_JOB_TOKEN'] = self::TOKEN;
        $_SERVER['INTERNAL_JOB_TOKEN'] = self::TOKEN;

        parent::setUp();

        // Override the internal-token middleware in the container so the
        // running Slim app validates against our test token. The base
        // AppTestCase wires a settings bundle that doesn't include the
        // token, so we patch the InternalTokenMiddleware factory directly.
        if (method_exists($this->container, 'set')) {
            /** @var \DI\Container $container */
            $container = $this->container;
            $container->set(
                \App\Infrastructure\Http\Middleware\InternalTokenMiddleware::class,
                new \App\Infrastructure\Http\Middleware\InternalTokenMiddleware(
                    new \Slim\Psr7\Factory\ResponseFactory(),
                    self::TOKEN,
                ),
            );
        }
        // Rebuild the app so it picks up the patched middleware.
        $this->app = \App\App\AppFactory::build($this->container);
    }

    public function testTickRequiresToken(): void
    {
        $resp = $this->internalRequest('POST', '/internal/jobs/tick', headers: []);
        self::assertSame(401, $resp->getStatusCode());
    }

    public function testTickRejectsWrongToken(): void
    {
        $resp = $this->internalRequest(
            'POST',
            '/internal/jobs/tick',
            headers: ['Authorization' => 'Bearer wrong'],
        );
        self::assertSame(401, $resp->getStatusCode());
    }

    public function testExternalSourceReturns404OpaquePerSpec(): void
    {
        $resp = $this->internalRequest(
            'POST',
            '/internal/jobs/tick',
            headers: ['Authorization' => 'Bearer ' . self::TOKEN],
            remoteAddr: '8.8.8.8',
        );
        self::assertSame(404, $resp->getStatusCode());
    }

    public function testTickSuccessProducesEnvelope(): void
    {
        $resp = $this->internalRequest(
            'POST',
            '/internal/jobs/tick',
            headers: ['Authorization' => 'Bearer ' . self::TOKEN],
        );
        self::assertSame(200, $resp->getStatusCode());
        $body = $this->decode($resp);
        self::assertSame('tick', $body['job']);
        self::assertSame('success', $body['status']);
        self::assertArrayHasKey('run_id', $body);
        self::assertArrayHasKey('duration_ms', $body);
    }

    public function testRecomputeSucceedsWithEmptyTables(): void
    {
        $resp = $this->internalRequest(
            'POST',
            '/internal/jobs/recompute-scores',
            headers: ['Authorization' => 'Bearer ' . self::TOKEN],
        );
        self::assertSame(200, $resp->getStatusCode());
        $body = $this->decode($resp);
        self::assertSame('recompute-scores', $body['job']);
        self::assertSame('success', $body['status']);
    }

    public function testConcurrentRecomputeProducesOneSuccessOneSkipped(): void
    {
        // Pre-acquire the lock to simulate "another worker is busy". The
        // second HTTP call must come back 409 with skipped_locked.
        $now = (new \DateTimeImmutable('now', new \DateTimeZone('UTC')));
        $lockSql = 'INSERT INTO job_locks (job_name, acquired_by, acquired_at, expires_at) '
            . 'VALUES (:job, :owner, :acquired, :expires)';
        $this->db->executeStatement($lockSql, [
            'job' => 'recompute-scores',
            'owner' => 'OTHER',
            'acquired' => $now->format('Y-m-d H:i:s'),
            'expires' => $now->modify('+5 minutes')->format('Y-m-d H:i:s'),
        ]);

        $resp = $this->internalRequest(
            'POST',
            '/internal/jobs/recompute-scores',
            headers: ['Authorization' => 'Bearer ' . self::TOKEN],
            body: '{"full": true}',
        );
        self::assertSame(409, $resp->getStatusCode());
        $body = $this->decode($resp);
        self::assertSame('skipped_locked', $body['status']);
    }

    public function testRefreshGeoipDoesNotShortCircuitOnDbipDefault(): void
    {
        // dbip is the default test provider; requiresCredential() is false.
        // dry_run avoids the actual download.
        $resp = $this->internalRequest(
            'POST',
            '/internal/jobs/refresh-geoip?dry_run=1',
            headers: ['Authorization' => 'Bearer ' . self::TOKEN],
        );
        self::assertNotSame(412, $resp->getStatusCode());
    }

    public function testRefreshGeoipReturns412WithoutCredentialOnMaxmind(): void
    {
        // Patch the container's downloader to MaxMind without a key.
        $this->swapDownloader(new \App\Infrastructure\Enrichment\Downloaders\MaxMindDownloader(
            new \GuzzleHttp\Client(),
            licenseKey: '',
        ));
        $resp = $this->internalRequest(
            'POST',
            '/internal/jobs/refresh-geoip',
            headers: ['Authorization' => 'Bearer ' . self::TOKEN],
        );
        self::assertSame(412, $resp->getStatusCode());
        $body = $this->decode($resp);
        self::assertSame('no_credential', $body['error']);
        self::assertSame('maxmind', $body['provider']);
        self::assertSame('MAXMIND_LICENSE_KEY', $body['missing']);
    }

    public function testRefreshGeoipReturns412WithoutTokenOnIpinfo(): void
    {
        $this->swapDownloader(new \App\Infrastructure\Enrichment\Downloaders\IPinfoDownloader(
            new \GuzzleHttp\Client(),
            token: '',
        ));
        $resp = $this->internalRequest(
            'POST',
            '/internal/jobs/refresh-geoip',
            headers: ['Authorization' => 'Bearer ' . self::TOKEN],
        );
        self::assertSame(412, $resp->getStatusCode());
        $body = $this->decode($resp);
        self::assertSame('ipinfo', $body['provider']);
        self::assertSame('IPINFO_TOKEN', $body['missing']);
    }

    public function testEnrichPendingNoOpsCleanlyWithoutDbs(): void
    {
        $resp = $this->internalRequest(
            'POST',
            '/internal/jobs/enrich-pending',
            headers: ['Authorization' => 'Bearer ' . self::TOKEN],
        );
        self::assertSame(200, $resp->getStatusCode());
        $body = $this->decode($resp);
        self::assertSame('enrich-pending', $body['job']);
        self::assertSame('success', $body['status']);
        self::assertSame(0, $body['items_processed']);
    }

    public function testStatusListsAllRegisteredJobs(): void
    {
        $resp = $this->internalRequest(
            'GET',
            '/internal/jobs/status',
            headers: ['Authorization' => 'Bearer ' . self::TOKEN],
        );
        self::assertSame(200, $resp->getStatusCode());
        $body = $this->decode($resp);
        self::assertArrayHasKey('jobs', $body);
        self::assertArrayHasKey('recompute-scores', $body['jobs']);
        self::assertArrayHasKey('cleanup-audit', $body['jobs']);
        self::assertArrayHasKey('enrich-pending', $body['jobs']);
        self::assertArrayHasKey('refresh-geoip', $body['jobs']);
        self::assertArrayHasKey('tick', $body['jobs']);
    }

    private function swapDownloader(\App\Infrastructure\Enrichment\Downloaders\GeoIpDownloader $downloader): void
    {
        if (!method_exists($this->container, 'set')) {
            return;
        }
        /** @var \DI\Container $container */
        $container = $this->container;
        $container->set(\App\Infrastructure\Enrichment\Downloaders\GeoIpDownloader::class, $downloader);
        // PHP-DI caches singletons, so JobsController already holds the
        // previous downloader. Replace it with a freshly built one
        // (via container->make) so it picks up the new binding.
        $container->set(\App\Application\Internal\JobsController::class, $container->make(\App\Application\Internal\JobsController::class));
        $this->app = \App\App\AppFactory::build($this->container);
    }

    public function testCleanupAuditSucceedsAndRecordsRun(): void
    {
        $resp = $this->internalRequest(
            'POST',
            '/internal/jobs/cleanup-audit',
            headers: ['Authorization' => 'Bearer ' . self::TOKEN],
        );
        self::assertSame(200, $resp->getStatusCode());
        $body = $this->decode($resp);
        self::assertSame('cleanup-audit', $body['job']);
        self::assertSame('success', $body['status']);

        $row = $this->db->fetchAssociative(
            "SELECT triggered_by, status FROM job_runs WHERE job_name = 'cleanup-audit'"
        );
        self::assertNotFalse($row);
        self::assertSame('schedule', $row['triggered_by']);
        self::assertSame('success', $row['status']);
    }

    /**
     * @param array<string, string> $headers
     */
    private function internalRequest(
        string $method,
        string $path,
        array $headers = [],
        ?string $body = null,
        string $remoteAddr = '127.0.0.1',
    ): \Psr\Http\Message\ResponseInterface {
        $factory = new \Slim\Psr7\Factory\ServerRequestFactory();
        $request = $factory->createServerRequest($method, $path, ['REMOTE_ADDR' => $remoteAddr]);
        foreach ($headers as $name => $value) {
            $request = $request->withHeader($name, $value);
        }
        if ($body !== null) {
            $stream = (new \Slim\Psr7\Factory\StreamFactory())->createStream($body);
            $request = $request->withBody($stream);
            $request = $request->withHeader('Content-Type', 'application/json');
        }

        return $this->app->handle($request);
    }
}