// Q284 / #385: returning header-preview writer support must fail this regression.
// No OIDC, broker, credentials or host configuration are constructed by these tests.
import test from 'node:test';
import assert from 'node:assert/strict';
import { spawnSync } from 'node:child_process';
import { startServer } from '../src/serve.mjs';

const preview = { host: 'console.example.test', header: 'x-authentik-username', user: 'jason' };
const cli = new URL('../src/cli.mjs', import.meta.url);
const service = new URL('../../../scripts/webui-service.sh', import.meta.url);
const send = async () => { assert.fail('refused configuration must never invoke its writer'); };

for (const [name, proof] of [['without proof', null], ['with proof', { header: 'x-console-proof', value: Buffer.from('fixture-proof-value-that-does-not-authenticate-a-human') }]]) {
  test(`header-preview cannot bind a human writer ${name}`, async () => {
    let web;
    try {
      web = await startServer({ port: 0, preview, proof, send });
      assert.fail('header-preview writer configuration was accepted');
    } catch (error) {
      assert.match(error.message, /--send needs --sso/);
    } finally {
      if (web) await new Promise(resolve => web.close(resolve));
    }
  });
}

test('CLI refuses header-preview writes before loading the system configuration', () => {
  const env = { ...process.env, MOSAIC_CONFIG: '/fixture-q284-missing-config/config.json' };
  for (const flags of [['--public-host', preview.host, '--auth-header', preview.header, '--allow-user', preview.user], []]) {
    const r = spawnSync(process.execPath, [cli.pathname, 'serve', '--port', '0', '--send', ...flags], { env, encoding: 'utf8', timeout: 5000 });
    assert.equal(r.error, undefined);
    assert.equal(r.status, 2);
    assert.match(r.stderr, /refused: --send needs --sso/);
    assert.equal(r.stdout, '');
    assert.doesNotMatch(r.stderr, /fixture-q284-missing-config/);
  }
});

test('read-only preview can still bind without any human writer', async () => {
  const web = await startServer({ port: 0, preview });
  await new Promise(resolve => web.close(resolve));
});

test('service renderer cannot produce a header-preview human-writer unit', () => {
  const r = spawnSync(service.pathname, ['render', '--public-host', preview.host, '--auth-header', preview.header, '--allow-user', preview.user, '--send'], { env: { PATH: '/usr/bin:/bin', HOME: '/fixture-q284-no-home' }, encoding: 'utf8', timeout: 5000 });
  assert.equal(r.error, undefined);
  assert.equal(r.status, 1);
  assert.match(r.stderr, /--send needs --sso/);
  assert.equal(r.stdout, '');
});