import { readFile } from "node:fs/promises";

import { describe, expect, it } from "vitest";

const protectedEntryPoints = [
  "app/admin/actions.ts",
  "app/api/admin/media/presign/route.ts",
  "app/api/admin/media/[id]/complete/route.ts",
  "app/api/admin/media/[id]/route.ts",
  "app/api/events/admin/route.ts",
] as const;

describe("administrative security boundaries", () => {
  for (const path of protectedEntryPoints) {
    it(`${path} repeats server-side admin authorization`, async () => {
      const source = await readFile(
        new URL(`../${path}`, import.meta.url),
        "utf8",
      );
      expect(source).toContain("requireAdmin");
      expect(source).toMatch(/await requireAdmin\(\)/u);
    });
  }

  it("same-origin media checks visibility before falling back to admin auth", async () => {
    const source = await readFile(
      new URL("../app/media/[id]/route.ts", import.meta.url),
      "utf8",
    );
    expect(source).toContain("getMediaVisibility");
    expect(source).toContain("getAdminSession");
    expect(source.indexOf("getMediaVisibility")).toBeLessThan(
      source.lastIndexOf("getAdminSession"),
    );
  });
});