# Online Class Webhook Smoke Test

This smoke test sends **real HTTP requests** to the public PlugNMeet webhook endpoint and then verifies the expected database side effects.

It is useful when you want to validate:

- Nginx/public routing to `/api/courses/plugnmeet/webhook/`
- signature verification with `PLUGNMEET_API_SECRET`
- Django webhook processing
- `CourseLiveSession` updates
- `LiveSessionUser` join/leave updates
- moderator auto-close scheduling

## Command

Run from the backend project:

```bash
python manage.py smoke_test_online_class_webhooks --help
```

## Recommended Safe Mode

Use a **disposable** live session instead of a real class session:

```bash
python manage.py smoke_test_online_class_webhooks \
  --create-session \
  --course-id 16 \
  --base-url https://imamjavad.online \
  --include-invalid-signature
```

What this does:

1. creates a temporary active `CourseLiveSession`
2. sends real webhook HTTP requests to the public endpoint
3. verifies DB side effects after each webhook
4. closes the temporary session at the end

## Use an Existing Active Session

If you want to test against a currently active session:

```bash
python manage.py smoke_test_online_class_webhooks \
  --session-id 123 \
  --base-url https://imamjavad.online
```

Be careful: the final closing webhook will close that session unless you pass `--skip-final-close`.

## Optional User Overrides

By default, the command auto-picks:

- moderator: first professor of the course
- participant: first active participant of the course

You can override them:

```bash
python manage.py smoke_test_online_class_webhooks \
  --create-session \
  --course-id 16 \
  --moderator-user-id 279 \
  --participant-user-id 315 \
  --base-url https://imamjavad.online
```

## Webhooks Covered

The smoke test currently verifies this flow:

1. `participant_joined` for a student
2. `participant_joined` for a moderator
3. `participant_left` for the moderator
4. `participant_joined` for the moderator again
5. `participant_left` for the student
6. final close event: `room_finished` or `session_ended`

Optional:

- invalid signature should return `403`

## What Each Step Verifies

- participant join creates or updates `LiveSessionUser` with `is_online=True`
- moderator join creates a moderator `LiveSessionUser` and clears pending auto-close fields
- moderator leave sets `last_moderator_left_at` and `auto_close_after_moderator_exit_at`
- participant leave marks the participant offline
- final close sets `ended_at` and forces all session users offline

## Useful Flags

- `--include-invalid-signature`
  - sends one bad-signature request and expects HTTP `403`
- `--skip-final-close`
  - skips the final closing webhook
- `--final-event room_finished`
  - default final close event
- `--final-event session_ended`
  - use the alternate close event
- `--timeout 20`
  - set HTTP timeout in seconds

## How To Read Results

The command prints one line per step:

- `[PASS] ...`
- `[FAIL] ...`

If any step fails, the command exits with a non-zero status.

## Recommended Production Usage

Prefer this pattern:

1. choose a dedicated test course
2. ensure the course has at least one professor and one active participant
3. run the command with `--create-session`
4. review:
   - command output
   - Django logs
   - Nginx logs

This avoids mutating a real student-facing live class.