import { describe, it, expect, vi } from "vitest";
import { Hono } from "hono";

// Mock auth lib so getAuth() throws — non-bypass paths hit the 503 "not configured" guard.
vi.mock("../lib/auth.js", () => ({
  getAuth: () => {
    throw new Error("auth not configured");
  },
  initAuth: vi.fn(),
  getActiveProviders: vi.fn(() => []),
}));

describe("authMiddleware bypass: /api/readyz", () => {
  it("serves /api/readyz without auth (bypass before auth check)", async () => {
    // Ensure AUTH_DISABLED is not set so the bypass is exercised, not AUTH_DISABLED shortcut.
    const prev = process.env.AUTH_DISABLED;
    delete process.env.AUTH_DISABLED;

    const { authMiddleware } = await import("../middleware/auth.js");
    const app = new Hono();
    app.use("/api/*", authMiddleware);
    app.get("/api/readyz", (c) => c.json({ status: "ok" }, 200));

    const res = await app.request("/api/readyz", { method: "GET" });
    expect(res.status).toBe(200);

    if (prev !== undefined) process.env.AUTH_DISABLED = prev;
  });

  it("blocks non-whitelisted /api/* paths when auth is not configured", async () => {
    const prev = process.env.AUTH_DISABLED;
    delete process.env.AUTH_DISABLED;

    const { authMiddleware } = await import("../middleware/auth.js");
    const app = new Hono();
    app.use("/api/*", authMiddleware);
    app.get("/api/staff", (c) => c.json({ ok: true }, 200));

    const res = await app.request("/api/staff", { method: "GET" });
    expect(res.status).toBe(503);

    if (prev !== undefined) process.env.AUTH_DISABLED = prev;
  });
});