package main

import "fmt"

func init() {
	register(Check{
		Seq:   190,
		ID:    "19",
		Title: "Bearer token precedence over cookies in auth middleware",
		Run: func(ctx *ScanContext, rep *Reporter) {
			// Check 19: Bearer token precedence over cookies
			fmt.Println("\n=== Check 19: Bearer token precedence over cookies in auth middleware ===")
			var authPrecViolations []authPrecedenceViolation
			for _, target := range ctx.backendTargets {
				for _, v := range checkAuthPrecedence(target.root) {
					v.file = prefixDisplayPath(target.display, v.file)
					authPrecViolations = append(authPrecViolations, v)
				}
			}
			for _, target := range ctx.pluginTargets {
				for _, v := range checkAuthPrecedence(target.root) {
					v.file = prefixDisplayPath(target.display, v.file)
					authPrecViolations = append(authPrecViolations, v)
				}
			}
			if len(authPrecViolations) > 0 {
				fmt.Printf("  FAIL: %d auth precedence violation(s):\n", len(authPrecViolations))
				for _, v := range authPrecViolations {
					fmt.Printf("    %s:%d %s\n", v.file, v.line, v.snippet)
				}
				fmt.Println("\n  Fix: Check Bearer/Authorization header BEFORE cookies. Bearer is explicit; cookies are ambient and may be stale.")
				rep.Fail()
			} else {
				fmt.Println("  OK: Bearer token takes precedence over cookies in all auth extraction")
				printPerTargetOKLines(pluginTargetLabels(ctx.pluginTargets))
			}
		},
	})
}