import { beforeEach, describe, expect, it, vi } from "vitest";

const session = vi.fn();
const validate = vi.fn();
const handler = vi.fn(async () => Response.json({ passed: true }));

vi.mock("server-only", () => ({}));
vi.mock("better-auth/next-js", () => ({ toNextJsHandler: () => ({ GET: handler }) }));
vi.mock("@/lib/auth/server", () => ({
  getAuth: () => ({ api: { getSession: session }, handler }),
  isSudlohOidcEnabled: () => true,
}));
vi.mock("@/lib/auth/sudloh", () => ({ validateSudlohSession: validate }));

const { GET, POST } = await import("./route");

beforeEach(() => {
  vi.clearAllMocks();
  process.env.BETTER_AUTH_URL = "https://guide.sudloh.com";
  process.env.SUDLOH_OIDC_ONLY = "true";
  session.mockResolvedValue({ user: { id: "user-1" }, session: { id: "session-1" } });
  validate.mockResolvedValue(false);
});

describe("Better Auth Sudloh boundary", () => {
  it("returns no browser session after Sudloh revokes the bound token", async () => {
    const response = await GET(new Request("https://guide.sudloh.com/api/auth/get-session"));
    expect(response.status).toBe(200);
    expect(await response.json()).toBeNull();
    expect(handler).not.toHaveBeenCalled();
  });

  it("denies other account endpoints but permits the OIDC callback", async () => {
    const denied = await GET(new Request("https://guide.sudloh.com/api/auth/list-sessions"));
    expect(denied.status).toBe(401);
    const callback = await GET(new Request("https://guide.sudloh.com/api/auth/callback/sudloh?code=code"));
    expect(callback.status).toBe(200);
  });

  it("denies Better Auth mutations with a revoked local session", async () => {
    const response = await POST(new Request("https://guide.sudloh.com/api/auth/admin/create-user", {
      method: "POST", headers: { Origin: "https://guide.sudloh.com", "Content-Type": "application/json" },
      body: JSON.stringify({ password: "example-password" }),
    }));
    expect(response.status).toBe(401);
    expect(handler).not.toHaveBeenCalled();
  });
});