import { describe, expect, it } from "vitest";
import { NextRequest } from "next/server";
import { proxy, config } from "@/proxy";

function request(path: string, cookies: Record<string, string> = {}): NextRequest {
  const next = new NextRequest(new URL(`http://localhost${path}`));
  for (const [name, value] of Object.entries(cookies)) next.cookies.set(name, value);
  return next;
}

describe("proxy", () => {
  it("cobre as áreas protegidas e nada além", () => {
    expect(config.matcher).toContain("/adaptador/:path*");
    expect(config.matcher).toContain("/api/spreadsheet-adapter/:path*");
    expect(config.matcher).toContain("/selecionar-workspace");
  });

  it("redireciona a página protegida ao login preservando o destino", () => {
    const response = proxy(request("/adaptador/operacao"));
    expect(response.status).toBe(307);
    const location = new URL(response.headers.get("location") as string);
    expect(location.pathname).toBe("/login");
    expect(location.searchParams.get("next")).toBe("/adaptador/operacao");
  });

  it("não propaga query da requisição original para o login", () => {
    const next = new NextRequest(new URL("http://localhost/adaptador?returnTo=https://evil.example"));
    const response = proxy(next);
    const location = new URL(response.headers.get("location") as string);
    expect(location.searchParams.get("returnTo")).toBeNull();
    expect(location.searchParams.get("next")).toBe("/adaptador");
  });

  it("responde 401 em JSON na API sem sessão", async () => {
    const response = proxy(request("/api/spreadsheet-adapter/models"));
    expect(response.status).toBe(401);
    const body = (await response.json()) as { error: { code: string } };
    expect(body.error.code).toBe("UNAUTHENTICATED");
  });

  it("deixa passar com cookie do Supabase e com a sessão local", () => {
    expect(proxy(request("/adaptador", { "sb-projeto-auth-token": "abc" })).status).toBe(200);
    expect(proxy(request("/adaptador", { adapter_dev_session: "abc" })).status).toBe(200);
  });

  it("não interfere em rota pública nem no health check", () => {
    expect(proxy(request("/")).status).toBe(200);
    expect(proxy(request("/api/health/live")).status).toBe(200);
    expect(proxy(request("/login")).status).toBe(200);
  });

  it("protege a tela de escolha de workspace", () => {
    expect(proxy(request("/selecionar-workspace")).status).toBe(307);
  });
});