// Auth routes test
import { describe, it, before, after } from "node:test";
import assert from "node:assert/strict";
import { buildApp } from "../index.js";
import type { FastifyInstance } from "fastify";

let app: FastifyInstance;
let token: string;

before(async () => {
  process.env.JWT_SECRET = "test-secret";
  process.env.DATABASE_URL = ":memory:";
  app = await buildApp();
  await app.ready();
});

after(async () => {
  await app.close();
});

describe("POST /api/auth/register", () => {
  it("registers a new user", async () => {
    const res = await app.inject({
      method: "POST",
      url: "/api/auth/register",
      payload: { username: "testuser", password: "password123" },
    });
    assert.equal(res.statusCode, 201);
    const body = res.json();
    assert.ok(body.token);
    assert.equal(body.user.username, "testuser");
    token = body.token;
  });

  it("rejects duplicate username", async () => {
    const res = await app.inject({
      method: "POST",
      url: "/api/auth/register",
      payload: { username: "testuser", password: "password123" },
    });
    assert.equal(res.statusCode, 409);
  });

  it("rejects short password", async () => {
    const res = await app.inject({
      method: "POST",
      url: "/api/auth/register",
      payload: { username: "user2", password: "123" },
    });
    assert.equal(res.statusCode, 400);
  });
});

describe("POST /api/auth/login", () => {
  it("logs in with correct credentials", async () => {
    const res = await app.inject({
      method: "POST",
      url: "/api/auth/login",
      payload: { username: "testuser", password: "password123" },
    });
    assert.equal(res.statusCode, 200);
    const body = res.json();
    assert.ok(body.token);
    token = body.token;
  });

  it("rejects wrong password", async () => {
    const res = await app.inject({
      method: "POST",
      url: "/api/auth/login",
      payload: { username: "testuser", password: "wrongpassword" },
    });
    assert.equal(res.statusCode, 401);
  });
});

describe("GET /api/auth/me", () => {
  it("returns current user with valid token", async () => {
    const res = await app.inject({
      method: "GET",
      url: "/api/auth/me",
      headers: { authorization: `Bearer ${token}` },
    });
    assert.equal(res.statusCode, 200);
    const body = res.json();
    assert.equal(body.data.username, "testuser");
  });

  it("rejects without token", async () => {
    const res = await app.inject({
      method: "GET",
      url: "/api/auth/me",
    });
    assert.equal(res.statusCode, 401);
  });
});