// P4 pinned8.0.42 regression: absent Claude provider config is HTTP404.
// Normalize only that fixed GET; all other methods/endpoints/statuses refuse.
import test from 'node:test';
import assert from 'node:assert/strict';
import http from 'node:http';
import { ManagementClient } from '../src/client.mjs';
const endpoint = '/v8/management/config/api-keys/claude';
const bodyCanary = 'p4-body-canary';
async function fixture(t, status, body = { error: bodyCanary, 'api-key': bodyCanary }) {
  const requests = [], receipts = [];
  const server = http.createServer(async (req, res) => {
    const chunks = []; for await (const chunk of req) chunks.push(chunk);
    requests.push({ method: req.method, path: req.url, body: Buffer.concat(chunks).toString('utf8') });
    res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body));
  });
  await new Promise(r => server.listen(0, '127.0.0.1', r));
  t.after(() => new Promise(r => server.close(r)));
  const client = new ManagementClient({ baseUrl: `http://127.0.0.1:${server.address().port}`, key: 'p4-management', receipt: r => receipts.push(r) });
  return { client, requests, receipts };
}
function evidence(s, method, path, status) {
  assert.equal(s.requests.length, 1, 'one call, no retry');
  assert.deepEqual(s.requests.map(r => [r.method, r.path]), [[method, path]]);
  assert.deepEqual(s.receipts, [{ call: `${method} ${path}`, status, keyIds: [] }]);
  assert.equal(JSON.stringify(s.receipts).includes(bodyCanary), false);
  assert.equal(JSON.stringify(s.receipts).includes('p4-management'), false);
}
async function refused(operation) {
  let failure;
  try { await operation(); } catch (error) { failure = error; }
  assert.equal(failure?.code, 'proxy-client-refused');
  assert.equal(failure.message.includes(bodyCanary), false, 'no error-body value escapes');
  assert.equal(JSON.stringify(failure).includes(bodyCanary), false);
}
test('empty provider GET404 yields empty array, discards body and receipts actual404 once', async t => {
  const s = await fixture(t, 404);
  const result = await s.client.getUpstreamGroups();
  assert.equal(Array.isArray(result), true); assert.equal(result.length, 0);
  assert.equal(JSON.stringify(result).includes(bodyCanary), false);
  evidence(s, 'GET', endpoint, 404);
});
for (const status of [401, 403, 500]) test(`provider GET${status} remains proxy-client-refused, no retry`, async t => {
  const s = await fixture(t, status);
  await refused(() => s.client.getUpstreamGroups());
  evidence(s, 'GET', endpoint, status);
});
for (const [method, path] of [['getCredentials', '/v8/management/credentials'], ['getKeys', '/v8/management/config/access/api-keys']])
  test(`${method}404 remains proxy-client-refused, no retry`, async t => {
    const s = await fixture(t, 404);
    await refused(() => s.client[method]());
    evidence(s, 'GET', path, 404);
  });
test('provider PUT404 remains proxy-client-refused, never treated as empty GET', async t => {
  const s = await fixture(t, 404);
  await refused(() => s.client.putUpstreamGroups([{ name: 'fixture', keys: [{ 'api-key': 'p4-first-key' }] }]));
  evidence(s, 'PUT', endpoint, 404);
  assert.equal(s.requests[0].body.includes('p4-first-key'), true);
  assert.equal(JSON.stringify(s.receipts).includes('p4-first-key'), false);
});
test('provider GET200 array passes through, with receipt and no retry', async t => {
  const s = await fixture(t, 200, [{ name: 'fixture', keys: [] }]);
  const result = await s.client.getUpstreamGroups();
  assert.equal(Array.isArray(result), true); assert.equal(result.length, 1);
  assert.equal(result[0].name === 'fixture' && Array.isArray(result[0].keys), true);
  evidence(s, 'GET', endpoint, 200);
});