import { readFile } from "node:fs/promises";

import { describe, expect, it } from "vitest";

const protectedEntryPoints = [
  "app/admin/actions.ts",
  "app/api/admin/media/presign/route.ts",
  "app/api/admin/media/[id]/complete/route.ts",
  "app/api/admin/media/[id]/route.ts",
  "app/api/events/admin/route.ts",
] as const;

describe("administrative security boundaries", () => {
  for (const path of protectedEntryPoints) {
    it(`${path} repeats server-side admin authorization`, async () => {
      const source = await readFile(
        new URL(`../${path}`, import.meta.url),
        "utf8",
      );
      expect(source).toContain("requireAdmin");
      expect(source).toMatch(/await requireAdmin\(\)/u);
    });
  }

  it("same-origin media checks visibility before falling back to admin auth", async () => {
    const source = await readFile(
      new URL("../app/media/[id]/route.ts", import.meta.url),
      "utf8",
    );
    expect(source).toContain("getMediaVisibility");
    expect(source).toContain("getAdminSession");
    expect(source.indexOf("getMediaVisibility")).toBeLessThan(
      source.lastIndexOf("getAdminSession"),
    );
  });

  it("enforces Cloudflare Turnstile on email sign-in", async () => {
    const source = await readFile(
      new URL("../lib/auth/server.ts", import.meta.url),
      "utf8",
    );
    expect(source).toContain('provider: "cloudflare-turnstile"');
    expect(source).toContain('secretKey: required("TURNSTILE_SECRET_KEY")');
    expect(source).toContain('endpoints: ["/sign-in/email"]');
  });

  it("requires a Turnstile token before submitting administrator login outside development", async () => {
    const source = await readFile(
      new URL("../components/admin/login-card.tsx", import.meta.url),
      "utf8",
    );
    expect(source).toContain('const turnstileEnabled = process.env.NODE_ENV !== "development";');
    const tokenGuard = "if (turnstileEnabled && !turnstileToken) return;";
    expect(source).toContain(tokenGuard);
    expect(source.indexOf(tokenGuard)).toBeLessThan(
      source.indexOf("await authClient.signIn.email("),
    );
    expect(source).toMatch(
      /headers:\s*turnstileEnabled && turnstileToken\s*\?\s*\{ "x-captcha-response": turnstileToken \}\s*:\s*undefined/u,
    );
    expect(source).toContain("disabled={loading || (turnstileEnabled && !turnstileToken)}");
    expect(source).toContain('"expired-callback": () => setTurnstileToken(null)');
    expect(source).toContain("resetTurnstile();");
  });
});