import assert from "node:assert/strict";
import test from "node:test";
import type { SelfHostedIdentityConfig } from "../src/modules/identity/config.ts";
import { createHostIsolatedAuthHandlers, resolveIdentitySurface } from "../src/modules/identity/host.ts";

const config: SelfHostedIdentityConfig = {
  provider: "self-hosted",
  databaseUrl: "postgresql://identity_runtime:test@postgres:5432/jyotisha",
  userOrigin: "https://staging.jyotisha.chat",
  userSecret: "user-secret-that-is-at-least-32-bytes-long",
  resendApiKey: "re_test",
  resendFrom: "Jyotisha <login@staging.jyotisha.chat>",
};

test("identity host accepts only the configured user origin", () => {
  assert.equal(resolveIdentitySurface("staging.jyotisha.chat", config), "user");
  assert.equal(resolveIdentitySurface("STAGING.JYOTISHA.CHAT:443", config), "user");
  for (const host of [null, "", "admin.staging.jyotisha.chat", "staging.jyotisha.chat.evil.example", "staging.jyotisha.chat,evil.example"]) {
    assert.equal(resolveIdentitySurface(host, config), null);
  }
});

test("auth route dispatches only to the user service", async () => {
  let calls = 0;
  const handlers = createHostIsolatedAuthHandlers(config, { user: { GET: async () => { calls += 1; return new Response("user"); }, POST: async () => { calls += 1; return new Response("user"); } } });
  const response = await handlers.GET(new Request("https://internal/api/auth/get-session", { headers: { host: "staging.jyotisha.chat" } }));
  assert.equal(await response.text(), "user");
  assert.equal(calls, 1);
});

test("unknown hosts remain fail-closed with 421", async () => {
  let calls = 0;
  const handler = async () => { calls += 1; return new Response("unexpected"); };
  const handlers = createHostIsolatedAuthHandlers(config, { user: { GET: handler, POST: handler } });
  const response = await handlers.GET(new Request("https://internal/api/auth/get-session", { headers: { host: "unknown.example" } }));
  assert.equal(response.status, 421);
  assert.equal(calls, 0);
});

test("main auth surface keeps Better Auth admin endpoints closed", async () => {
  let calls = 0;
  const handler = async () => { calls += 1; return new Response("unexpected"); };
  const handlers = createHostIsolatedAuthHandlers(config, { user: { GET: handler, POST: handler } });
  const response = await handlers.POST(new Request("https://internal/api/auth/admin/set-role", { method: "POST", headers: { host: "staging.jyotisha.chat" } }));
  assert.equal(response.status, 404);
  assert.equal(calls, 0);
});