module Api
  module V1
    class UsersController < ApplicationController
      def index
        @users = User.all
        render json: @users
      end

      def show
        @user = User.find(params[:id])
        render json: @user
      end

      def create
        @user = User.new(user_params)
        if @user.save
          render json: @user, status: :created
        else
          render json: @user.errors, status: :unprocessable_entity
        end
      end

      def update
        @user = User.find(params[:id])
        if @user.update(user_params)
          render json: @user
        else
          render json: @user.errors, status: :unprocessable_entity
        end
      end

      def destroy
        @user = User.find(params[:id])
        @user.destroy
        head :no_content
      end

      private

      def user_params
        params.require(:user).permit(:name, :email, :password)
      end
    end
  end
end

require 'rails_helper'

RSpec.describe "Api::V1::Users", type: :request do
  let(:valid_attributes) { { name: 'Alice', email: 'alice@example.com', password: 'password' } }
  let(:invalid_attributes) { { name: nil, email: 'alice@example.com', password: 'password' } }
  let!(:user) { User.create!(valid_attributes) }

  describe "GET /index" do
    it "returns a success response" do
      get api_v1_users_path
      expect(response).to be_successful
      expect(JSON.parse(response.body)).to be_an_instance_of(Array)
    end
  end

  describe "GET /show" do
    it "returns a success response" do
      get api_v1_user_path(user)
      expect(response).to be_successful
      expect(JSON.parse(response.body)["id"]).to eq(user.id)
    end
  end

  describe "POST /create" do
    context "with valid parameters" do
      it "creates a new User" do
        expect {
          post api_v1_users_path, params: { user: valid_attributes }
        }.to change(User, :count).by(1)

        expect(response).to have_http_status(:created)
        expect(JSON.parse(response.body)["name"]).to eq('Alice')
      end
    end

    context "with invalid parameters" do
      it "does not create a new User" do
        expect {
          post api_v1_users_path, params: { user: invalid_attributes }
        }.not_to change(User, :count)

        expect(response).to have_http_status(:unprocessable_entity)
        expect(JSON.parse(response.body)).to have_key("name")
      end
    end
  end

  describe "PUT /update" do
    context "with valid parameters" do
      let(:new_attributes) { { name: 'Bob' } }

      it "updates the requested user" do
        put api_v1_user_path(user), params: { user: new_attributes }
        user.reload
        expect(user.name).to eq('Bob')
        expect(response).to be_successful
      end
    end

    context "with invalid parameters" do
      it "does not update the user" do
        put api_v1_user_path(user), params: { user: invalid_attributes }
        expect(response).to have_http_status(:unprocessable_entity)
      end
    end
  end

  describe "DELETE /destroy" do
    it "destroys the requested user" do
      expect {
        delete api_v1_user_path(user)
      }.to change(User, :count).by(-1)

      expect(response).to have_http_status(:no_content)
    end
  end
end

module Api
  module V1
    class SecureUsersController < ApplicationController
      before_action :authenticate_user

      def index
        @users = User.all
        render json: @users
      end

      private

      def authenticate_user
        token = request.headers['Authorization']
        render json: { error: 'Unauthorized' }, status: :unauthorized unless token == 'valid_token'
      end
    end
  end
end

require 'rails_helper'

RSpec.describe "Api::V1::SecureUsers", type: :request do
  let(:valid_token) { 'valid_token' }
  let(:invalid_token) { 'invalid_token' }
  let(:headers) { { 'Authorization' => valid_token } }
  let(:invalid_headers) { { 'Authorization' => invalid_token } }
  let!(:user) { User.create!(name: 'Alice', email: 'alice@example.com', password: 'password') }

  describe "GET /index" do
    context "with valid token" do
      it "returns a success response" do
        get api_v1_secure_users_path, headers: headers
        expect(response).to be_successful
        expect(JSON.parse(response.body)).to be_an_instance_of(Array)
      end
    end

    context "with invalid token" do
      it "returns an unauthorized response" do
        get api_v1_secure_users_path, headers: invalid_headers
        expect(response).to have_http_status(:unauthorized)
        expect(JSON.parse(response.body)).to eq({ "error" => "Unauthorized" })
      end
    end

    context "without token" do
      it "returns an unauthorized response" do
        get api_v1_secure_users_path
        expect(response).to have_http_status(:unauthorized)
        expect(JSON.parse(response.body)).to eq({ "error" => "Unauthorized" })
      end
    end
  end
end