// ── The shape of the identity surface ─────────────────────────────────────
//
// Three properties that are invisible in review and expensive in production:
//
//   • **the link route is rate-limited** (R1). Six characters from a 32-glyph
//     alphabet is a good code only while a guesser is made to pay per attempt,
//     and once phase 7 grants permissions against a link, guessing one is a
//     privilege-escalation path rather than a nuisance.
//   • **the extension router merges its parent's params**. Without
//     `mergeParams`, `req.params.id` is `undefined` and every statement in that
//     panel silently scopes to no user — a panel that reads as "this user has no
//     Rust account" for everybody.
//   • **the extension's paths keep the module's own segment.** Core owns
//     `/admin/users/:id`; a bare `/links` would be this module claiming a word on
//     a URL it does not own, and the next module to fill a slot would collide.

const test = require('node:test')
const assert = require('node:assert')

const { fakeCtx, fakeApi } = require('./_fakes')

function register(ctx = fakeCtx()) {
  require('../core')._reset()
  const api = fakeApi()
  require('../index')(ctx, api)
  return api
}

/** `[{ method, path, handlers }]` for one express router. */
function routesOf(router) {
  return router.stack
    .filter((layer) => layer.route)
    .map((layer) => ({
      path: layer.route.path,
      method: Object.keys(layer.route.methods)[0].toUpperCase(),
      handlers: layer.route.stack.map((s) => s.handle),
    }))
}

test('the player tier serves the three identity routes, and nothing else new', () => {
  const api = register()
  const routes = routesOf(api.record.routes.player['/rust'])

  assert.deepEqual(
    routes.map((r) => `${r.method} ${r.path}`).sort(),
    ['DELETE /links/:steamId', 'GET /links', 'GET /servers', 'POST /link'],
  )
})

test('redeeming a code is rate-limited, and by a limiter of its own', () => {
  const api = register()
  const post = routesOf(api.record.routes.player['/rust']).find((r) => r.method === 'POST')

  // The fake's `rateLimit` hands back a pass-through carrying the options it was
  // given, so the policy itself is assertable — a limiter that was quietly
  // removed, or one built with core's `accountChangeLimiter` shared counter,
  // both fail here.
  const limiter = post.handlers.find((h) => h.options && h.options.label === 'rust-link-code')

  assert.ok(limiter, 'POST /link must carry its own rate limiter (R1)')
  assert.equal(limiter.options.max, 10)
  assert.equal(limiter.options.windowMs, 15 * 60 * 1000)

  // First in the chain: a limiter behind the validator would let an attacker
  // spend the cheap half of the request unbounded.
  assert.equal(post.handlers[0], limiter)
})

test('the admin.users.detail router merges the parent’s params and keeps its own segment', () => {
  const api = register()
  const slot = api.record.extensions.find((e) => e.slot === 'admin.users.detail')

  assert.ok(slot, 'the server half of admin.users.detail must be registered')
  assert.equal(slot.router.mergeParams, true)

  const paths = routesOf(slot.router).map((r) => `${r.method} ${r.path}`).sort()
  assert.deepEqual(paths, ['DELETE /rust/links/:steamId', 'GET /rust/links'])

  for (const route of routesOf(slot.router)) {
    assert.ok(route.path.startsWith('/rust/'), `${route.path} must live under this module's own segment`)
  }
})