// P4 real client/page regression: fresh pinned proxy404 must allow the first key.
// Malformed successful bodies still fail closed with the existing refusal code.
import test from 'node:test';
import assert from 'node:assert/strict';
import { fakeManagement } from './proxy-page-fixture.mjs';
const route = '/v8/management/config/api-keys/claude';
test('fresh404 yields no accounts, then adds the first key once with no value leakage', async t => {
  const canary = 'p4-first-key';
  const s = await fakeManagement(t, { emptyProviderResponse: { status: 404, body: { error: 'p4-body-canary' } } });
  const empty = await s.call('proxy.accounts');
  assert.equal(Array.isArray(empty.accounts), true); assert.equal(empty.accounts.length, 0);
  const added = await s.call('proxy.apikey.add', { provider: 'z.ai', key: canary });
  assert.equal(added.added, true);
  const populated = await s.call('proxy.accounts');
  assert.equal(populated.accounts.length, 1); assert.equal(populated.accounts[0].provider, 'z.ai');
  assert.equal(s.state.receives, 1, 'one PUT, no retry');
  assert.equal(s.state.groups[0].keys[0]['api-key'] === canary, true);
  assert.deepEqual(s.state.calls, ['GET /v8/management/credentials', `GET ${route}`, `GET ${route}`, `PUT ${route}`,
    'GET /v8/management/credentials', `GET ${route}`]);
  assert.deepEqual(s.state.receipts.filter(r => r.call === `GET ${route}`).map(r => r.status), [404, 404, 200]);
  for (const value of [canary, 'p4-body-canary', 'p4-management']) {
    assert.equal(JSON.stringify([empty, added, populated]).includes(value), false);
    assert.equal(JSON.stringify(s.state.receipts).includes(value), false);
  }
});
for (const [name, body] of [['null', null], ['object', { groups: [] }]])
  test(`malformed200 ${name} remains proxy-down, no retry or write`, async t => {
    const s = await fakeManagement(t, { emptyProviderResponse: { status: 200, body } });
    await assert.rejects(s.call('proxy.accounts'), { code: 'proxy-down' });
    assert.deepEqual(s.state.calls, ['GET /v8/management/credentials', `GET ${route}`]);
    assert.equal(s.state.receives, 0);
    assert.deepEqual(s.state.receipts.map(r => r.status), [200, 200]);
  });