// Security verification tests - live HTTP tests
// Run with: pnpm test -- src/__tests__/security.test.ts
// Note: These tests require a running server

const BASE_URL = process.env.TEST_URL || "http://localhost:3001";

describe("Security: Authentication", () => {
  describe("POST /api/auth/signin", () => {
    it("should reject invalid credentials", async () => {
      const res = await fetch(`${BASE_URL}/api/auth/signin`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ email: "invalid@test.com", password: "wrong", action: "signin" }),
      });
      const data = await res.json();
      expect(res.status).toBe(401);
      expect(data.error).toBeDefined();
    });

    it("should return success with valid credentials", async () => {
      const res = await fetch(`${BASE_URL}/api/auth/signin`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ email: "test@test.com", password: "Test1234", action: "signin" }),
      });
      // Either 200 (success) or 401 (invalid password) is acceptable
      expect([200, 401]).toContain(res.status);
    });
  });
});

describe("Security: Cross-Family Access", () => {
  it("should reject access to chat without auth", async () => {
    const res = await fetch(`${BASE_URL}/api/chat`);
    expect(res.status).toBe(401);
  });

  it("should reject access to family without auth", async () => {
    const res = await fetch(`${BASE_URL}/api/family`);
    expect(res.status).toBe(401);
  });

  it("should reject access to family/members without auth", async () => {
    const res = await fetch(`${BASE_URL}/api/family/members`);
    expect(res.status).toBe(401);
  });

  it("should reject access to invites without auth", async () => {
    const res = await fetch(`${BASE_URL}/api/invites`);
    expect(res.status).toBe(401);
  });

  it("should reject access to upload without auth", async () => {
    const res = await fetch(`${BASE_URL}/api/upload`);
    expect(res.status).toBe(401);
  });
});

describe("Security: Admin Routes", () => {
  it("should reject /api/admin/families without admin session", async () => {
    const res = await fetch(`${BASE_URL}/api/admin/families`);
    expect(res.status).toBe(401);
  });

  it("should reject /api/admin/users without admin session", async () => {
    const res = await fetch(`${BASE_URL}/api/admin/users`);
    expect(res.status).toBe(401);
  });
});

describe("Security: Public Routes", () => {
  it("should allow /api/auth/signin without auth", async () => {
    const res = await fetch(`${BASE_URL}/api/auth/signin`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ email: "x@y.com", password: "x", action: "signin" }),
    });
    // Should not return 401 (but might return 400 or other error)
    expect(res.status).not.toBe(401);
  });

  it("should allow /api/onboarding without auth", async () => {
    const res = await fetch(`${BASE_URL}/api/onboarding`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    expect([400, 401, 500]).toContain(res.status);
  });
});

describe("Security: Rate Limiting", () => {
  it("should implement rate limiting on auth", async () => {
    // Try multiple signins rapidly
    let rateLimited = false;
    for (let i = 0; i < 10; i++) {
      const res = await fetch(`${BASE_URL}/api/auth/signin`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ email: "ratelimit@test.com", password: "wrong", action: "signin" }),
      });
      if (res.status === 429) {
        rateLimited = true;
        break;
      }
    }
    expect(rateLimited).toBe(true);
  });
});