meta {
  name: Register User
  type: http
  seq: 2
}

post {
  url: {{base_url}}/api/auth/register
  body: json
  auth: inherit
}

body:json {
  {
    "email": "test@example.com",
    "username": "testuser",
    "password": "password123",
    "first_name": "Test",
    "last_name": "User"
  }
}

script:post-response {
  function onResponse(res) {
    let data = res.getBody();

    // If successful registration, set token environment variable
    if (res.getStatus() === 201 || res.getStatus() === 200) {
      if (data && data.token) {
        return bru.setEnvVar("token", data.token, { persist: true });
      }
    }
  }
  onResponse(res);
}

tests {
  test_register_user_success(status, headers, body) {
    const contentType = headers["content-type"];
    if (!contentType || !contentType.includes("application/json")) {
      throw new Error("Expected content-type to contain application/json, got " + contentType);
    }

    // Verify response body is valid JSON and has expected structure
    let data;
    try {
      data = JSON.parse(body);
    } catch (e) {
      throw new Error("Response body is not valid JSON: " + body);
    }

    if (!data || typeof data !== "object") {
      throw new Error("Expected response body to be an object");
    }

    // Handle both success and error responses
    if (status === 500) {
      // Backend error - should not happen but handle gracefully
      if (data.error) {
        throw new Error("Backend Error: " + data.error);
      } else {
        throw new Error("Backend Error: Internal server error during registration");
      }
    }

    if (status === 201 || status === 200) {
      // Successful registration
      if (!data.token) {
        throw new Error("Response missing required field: token");
      }

      if (!data.user) {
        throw new Error("Response missing required field: user");
      }

      // Validate user object
      if (!data.user.id) {
        throw new Error("User object missing required field: id");
      }

      if (!data.user.email) {
        throw new Error("User object missing required field: email");
      }

      if (!data.user.username) {
        throw new Error("User object missing required field: username");
      }

      return true;
    }

    throw new Error("Unexpected status code: " + status);
  }

  test_register_user_error_409(status, headers, body) {
    // Test case: User already exists
    if (status === 409) {
      const data = JSON.parse(body);
      if (data.error && data.error.includes("already exists")) {
        return true; // Expected conflict response
      }
    }
    return false; // Not this test case
  }

  test_register_user_error_400(status, headers, body) {
    // Test case: Invalid input data
    if (status === 400) {
      const data = JSON.parse(body);
      if (data.error) {
        return true; // Expected bad request response
      }
    }
    return false; // Not this test case
  }
}

settings {
  encodeUrl: true
  timeout: 0
}

docs {
  ## Register User

  Creates a new user account with role-based restrictions.

  **Method:** POST

  **Endpoint:** /api/auth/register

   **Request Body:**
   - `email` (string): Email address
   - `username` (string): Username
   - `password` (string): Password
   - `first_name` (string, optional): First name
   - `last_name` (string, optional): Last name
   - `role` (string): User role ("user" or "admin")

  **Response:**
   - `token` (string): JWT token
    - `user` (object): User details
       - `id` (string): User ID
       - `email` (string): Email
       - `username` (string): Username
   - `theme` (string): User theme preference
       - `first_name` (string, optional): First name
       - `last_name` (string, optional): Last name
       - `role` (string): User role ("user" or "admin")

  **Status Codes:**
   - 201: Created
   - 400: Invalid input data
   - 403: Forbidden - role-based restrictions apply
   - 409: User exists

  **Role Restrictions:**
   - **First User**: Automatically gets admin role regardless of request
   - **Existing Admins Present**: Only authenticated admins can create new admin accounts
   - **No Admins Yet**: Anyone can create first admin (auto-assigned)
   - **Regular User Creation**: Anyone can create regular user accounts
   - **Unauthenticated Users**: Can only create first admin, not subsequent admins

  **Examples:**
   - First admin creation: `{"email": "admin@example.com", "username": "admin", "password": "password123", "role": "admin"}`
   - Regular user creation: `{"email": "user@example.com", "username": "user", "password": "password123", "role": "user"}`

}