//go:build test

package user

import (
	"bytes"
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"

	"crussell/mw"

	"github.com/stretchr/testify/require"
)

// deleteAccountRequest builds the DELETE /api/user/account request the handler
// requires (finding 3): the current password in the body, plus a 2FA code
// when one is supplied (enforced environments + 2FA-enabled users only).
//
// Defined in a shared, non-dev test helper file so prod-tag (test,!dev) test
// builds can keep exercising the deletion path (gdpr_test.go, profile_test.go)
// even though the coverage suite in user_coverage_test.go is dev-only.
func deleteAccountRequest(t *testing.T, ctx context.Context, userID, password, code string) *http.Request {
	t.Helper()
	body := map[string]string{"current_password": password}
	if code != "" {
		body["verification_code"] = code
	}
	b, err := json.Marshal(body)
	require.NoError(t, err)
	req := httptest.NewRequest(http.MethodDelete, "/api/user/account", bytes.NewReader(b))
	req.Header.Set("Content-Type", "application/json")
	req = req.WithContext(context.WithValue(ctx, mw.UserIDKey, userID))
	return req
}