import { Database } from "bun:sqlite";
import { expect, test } from "bun:test";
import { createApp } from "../src/server/app.ts";
import type { Config } from "../src/server/config.ts";

const config: Config = {
	domain: "kepr.example",
	dataDir: "data",
	adminPasswordHash: "$argon2id$x",
	bucket: {
		kind: "s3",
		endpoint: "https://s3.fr-par.scw.cloud",
		name: "koh",
		region: "fr-par",
		accessKeyId: "read",
		secretAccessKey: "only",
	},
};

test("every route the app registers is listed in docs/routes.txt", async () => {
	const listed = new Set(
		(await Bun.file("docs/routes.txt").text())
			.split("\n")
			.filter((line) => line.trim() !== "" && !line.startsWith("#")),
	);
	const registered = createApp(config, new Database(":memory:"))
		.routes.filter((route) => !(route.method === "ALL" && route.path === "/*"))
		.map((route) => `${route.method} ${route.path}`);
	expect(registered.filter((route) => !listed.has(route))).toEqual([]);
});

test("responses carry the §25 content security policy", async () => {
	const response = await createApp(config, new Database(":memory:")).request("/");
	const csp = response.headers.get("content-security-policy") ?? "";
	expect(csp).toContain("script-src 'self'");
	expect(csp).not.toContain("unsafe-inline");
	expect(csp).toContain("img-src 'self' https://s3.fr-par.scw.cloud");
	expect(csp).toContain("frame-ancestors 'none'");
	expect(response.headers.get("x-content-type-options")).toBe("nosniff");
});

test("request bodies over 64 KB are refused", async () => {
	const app = createApp(config, new Database(":memory:"));
	app.post("/echo", async (c) => c.text(String((await c.req.text()).length)));
	const post = (bytes: number) => app.request("/echo", { method: "POST", body: "x".repeat(bytes) });
	expect((await post(64 * 1024)).status).toBe(200);
	expect((await post(64 * 1024 + 1)).status).toBe(413);
});