import { test, after } from 'node:test'
import assert from 'node:assert/strict'
import { Router } from 'express'
import { startAppwriteMock } from './support/appwriteMock.js'
import { startFakeStripe } from './support/fakeStripe.js'
import { useTestEnv } from './support/testEnv.js'

// Team-Eingang /api/team: Appwrite-JWT aus dem Ticketsystem, jeder Mitarbeiter (nicht nur Label admin)
const aw = await startAppwriteMock()
const st = await startFakeStripe()
useTestEnv({ appwriteUrl: aw.url, stripeUrl: st.url })
const { startTestApp, rawGet } = await import('./support/testApp.js')
const { requireStaffJwt } = await import('../server/middleware/staffJwt.js')
const { corsMiddleware } = await import('../server/middleware/cors.js')

const probeRouter = Router()
probeRouter.use(requireStaffJwt)
probeRouter.get('/', (req, res) => res.json(req.session))

const app = await startTestApp({
  '/': corsMiddleware(['https://ticket.webklar.com']),
  '/probe': probeRouter,
})
after(() => Promise.all([app.close(), aw.close(), st.close()]))

aw.seed('employees', { $id: 'e_staff2', userId: 'u_staff2', displayName: 'Andrej', email: 'andrej@webklar.com' })
aw.seed('employees', { $id: 'e_nico', userId: '', displayName: 'Nico', email: 'nico@webklar.com' })

const probe = (jwt) => rawGet('/probe', jwt ? { headers: { authorization: `Bearer ${jwt}` } } : {})

test('ohne, ungueltiges und halbes JWT -> 401', async () => {
  for (const jwt of [null, 'jwt-falsch', 'jwt-halb']) assert.equal((await probe(jwt)).status, 401, String(jwt))
})

test('Kunde (kein Mitarbeiter, kein Label) -> 403', async () => {
  const res = await probe('jwt-kunde')
  assert.equal(res.status, 403)
  assert.equal(res.body.error, 'Kein Mitarbeiterkonto.')
})

test('Mail gleicht Mitarbeiter, ist aber unbestaetigt -> 403', async () => {
  assert.equal((await probe('jwt-mail-ungeprueft')).status, 403)
})

test('bestaetigte Mail eines Mitarbeiters ohne userId -> erlaubt', async () => {
  const res = await probe('jwt-mail-geprueft')
  assert.equal(res.status, 200)
  assert.equal(res.body.name, 'Nico')
  assert.equal(res.body.appwriteUserId, 'u_neu')
})

test('Mitarbeiter ohne Admin-Label -> erlaubt, Sitzung in Admin-Form', async () => {
  const res = await probe('jwt-staff')
  assert.equal(res.status, 200)
  assert.deepEqual(res.body, { role: 'admin', isAdmin: false, appwriteUserId: 'u_staff2', name: 'Andrej', email: 'andrej@webklar.com' })
})

test('Label admin ohne employees-Eintrag -> erlaubt, isAdmin true', async () => {
  const res = await probe('jwt-admin')
  assert.equal(res.status, 200)
  assert.equal(res.body.isAdmin, true)
})

test('CORS: erlaubte Herkunft bekommt die Upload-Header, fremde nichts', async () => {
  const ok = await rawGet('/probe', { headers: { origin: 'https://ticket.webklar.com' } })
  assert.equal(ok.headers.get('access-control-allow-origin'), 'https://ticket.webklar.com')
  assert.equal(
    ok.headers.get('access-control-allow-headers'),
    'Authorization, Content-Type, X-File-Name, X-Attachment-Kind, X-Duration-Ms, X-Image-Width, X-Image-Height'
  )
  const bad = await rawGet('/probe', { headers: { origin: 'https://evil.example' } })
  assert.equal(bad.headers.get('access-control-allow-origin'), null)
})

test('CORS: Preflight der erlaubten Herkunft -> 204 ohne JWT-Pruefung', async () => {
  const res = await fetch(`${app.url}/probe`, { method: 'OPTIONS', headers: { origin: 'https://ticket.webklar.com' } })
  assert.equal(res.status, 204)
})