// ── The demo lock, wired into the real app (DEMO_MODE.md §3.1) ─────────────
//
// demoLocks.test.js proves each rule against a stand-in app. This file proves
// the wiring: with DEMO_MODE=true, app.js mounts the lock ahead of every
// router, so a locked route is refused before its handler — before even its
// auth check — and an open one still reaches it. One process per flag value,
// since app.js decides at require time: this file is the demo, and every other
// test file that requires app.js is the normal deployment.
process.env.DB_HOST = '127.0.0.1'
process.env.DB_PORT = '59999'
process.env.DEMO_MODE = 'true'
process.env.MODULES_DIR = require('path').join(require('os').tmpdir(), 'rg-demo-app-no-modules')

const { test, after } = require('node:test')
const assert = require('node:assert/strict')

const app = require('../src/app')
const db = require('../src/utils/db')

after(() => db.close())

async function withServer(fn) {
  const server = await new Promise((resolve) => {
    const s = app.listen(0, '127.0.0.1', () => resolve(s))
  })
  try {
    return await fn(`http://127.0.0.1:${server.address().port}`)
  } finally {
    server.closeAllConnections()
    await new Promise((resolve) => server.close(resolve))
  }
}

test('a locked route answers DEMO_LOCKED before its own auth check', async () => {
  await withServer(async (base) => {
    const res = await fetch(`${base}/api/v1/admin/site-mode`, {
      method: 'PUT',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ mode: 'maintenance' }),
    })
    assert.equal(res.status, 403)
    assert.equal((await res.json()).code, 'DEMO_LOCKED')
  })
})

test('an open route still reaches its handler, which answers as usual', async () => {
  await withServer(async (base) => {
    const res = await fetch(`${base}/api/v1/admin/posts`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ title: 'x' }),
    })
    assert.equal(res.status, 401) // requireAuth, not the lock
  })
})

test('an upload is refused before multer or auth sees it', async () => {
  await withServer(async (base) => {
    const form = new FormData()
    form.append('image', new Blob(['x'], { type: 'image/png' }), 'x.png')
    const res = await fetch(`${base}/api/v1/admin/uploads`, { method: 'POST', body: form })
    assert.equal(res.status, 403)
    assert.equal((await res.json()).code, 'DEMO_LOCKED')
  })
})

test('a pasted data: image is refused before auth sees it, on an open route', async () => {
  await withServer(async (base) => {
    const res = await fetch(`${base}/api/v1/admin/posts`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ title: 'x', body: '<p><img src="data:image/png;base64,iVBORw0KGgo="></p>' }),
    })
    assert.equal(res.status, 403)
    assert.equal((await res.json()).code, 'DEMO_LOCKED')
  })
})

test('every response carries noindex, and robots.txt disallows everything', async () => {
  await withServer(async (base) => {
    const health = await fetch(`${base}/api/health`)
    assert.equal(health.headers.get('x-robots-tag'), 'noindex, nofollow')
    const robots = await fetch(`${base}/robots.txt`)
    assert.equal(await robots.text(), 'User-agent: *\nDisallow: /\n')
  })
})