import assert from 'node:assert/strict';
import { after, before, test } from 'node:test';
import { createApp } from '../server/app.js';

let server;
let baseUrl;

before(async () => {
  const app = createApp({ config: { pin: '4711' }, secret: 'testgeheimnis' });
  server = app.listen(0);
  await new Promise((resolve) => server.once('listening', resolve));
  baseUrl = `http://127.0.0.1:${server.address().port}`;
});

after(() => server.close());

const login = (pin) =>
  fetch(`${baseUrl}/api/login`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ pin }),
  });

test('Healthcheck antwortet ohne Anmeldung', async () => {
  const res = await fetch(`${baseUrl}/healthz`);
  assert.equal(res.status, 200);
});

test('Geschützte Routen verlangen eine Anmeldung', async () => {
  const res = await fetch(`${baseUrl}/api/irgendwas`);
  assert.equal(res.status, 401);
});

test('Falsche PIN wird abgelehnt', async () => {
  const res = await login('0000');
  assert.equal(res.status, 401);
  assert.equal(res.headers.get('set-cookie'), null);
});

test('Richtige PIN liefert ein Sitzungs-Cookie, das gilt', async () => {
  const res = await login('4711');
  assert.equal(res.status, 200);
  const cookie = res.headers.get('set-cookie').split(';')[0];
  assert.match(cookie, /^fdc_session=/);
  assert.match(res.headers.get('set-cookie'), /HttpOnly/);

  const session = await fetch(`${baseUrl}/api/session`, { headers: { cookie } });
  assert.deepEqual(await session.json(), { authenticated: true, pinConfigured: true });

  const protectedRes = await fetch(`${baseUrl}/api/irgendwas`, { headers: { cookie } });
  assert.equal(protectedRes.status, 404);
});