import { expect, loginAs, test } from "./fixtures";

test.describe("authentication", () => {
  test("an unauthenticated visitor sees the sign-in panel, not management data", async ({ page }) => {
    await page.goto("/");
    await expect(page.getByRole("heading", { name: "Inspect your governed MCP estate." })).toBeVisible();
    await expect(page.getByRole("link", { name: "Continue to sign in" })).toHaveAttribute("href", "/auth/login");
    // No management chrome or data leaks before authentication.
    await expect(page.getByRole("navigation", { name: "Primary navigation" })).toHaveCount(0);
    await expect(page.getByRole("link", { name: "Open platform settings" })).toHaveCount(0);
    await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toHaveCount(0);
  });

  test("a real PKCE/BFF login lands on an authenticated dashboard with real data", async ({ page }) => {
    await loginAs(page, "hub-viewer");
    await expect(page).toHaveURL(/\/$/);
    await expect(page.getByText("Authenticated", { exact: true })).toBeVisible();
    await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toBeVisible();
    // Assert a real bounded dashboard row without depending on catalog ordering.
    const snapshot = await (await page.request.get("/api/dashboard")).json();
    expect(snapshot.projects.length).toBeGreaterThan(0);
    await expect(page.locator(`[href="/projects/${snapshot.projects[0].slug}"]`).first()).toContainText(snapshot.projects[0].name);
  });

  test("an authenticated user can sign out and stale management data disappears", async ({ page }) => {
    await loginAs(page, "hub-viewer");
    await page.goto("/settings");
    await page.getByRole("button", { name: "Sign out" }).click();
    await expect(page.getByRole("heading", { name: "Inspect your governed MCP estate." })).toBeVisible();
    await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toHaveCount(0);
  });

  test("an invalidated session cookie safely falls back to the sign-in panel, not stale data", async ({
    page,
    context,
  }) => {
    await loginAs(page, "hub-viewer");
    await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toBeVisible();

    const cookies = await context.cookies();
    const sessionCookie = cookies.find((cookie) => cookie.name === "hub_session");
    expect(sessionCookie).toBeDefined();
    await context.addCookies([{ ...sessionCookie!, value: "tampered-session-value" }]);

    await page.reload();
    await expect(page.getByRole("heading", { name: "Inspect your governed MCP estate." })).toBeVisible();
    // The stale dashboard from before tampering must not still be showing.
    await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toHaveCount(0);
  });

  test("a mutating request with a missing CSRF token is safely rejected, not silently accepted", async ({
    page,
  }) => {
    await loginAs(page, "hub-admin");
    await page.goto("/policies");
    await page.route("**/api/policies/simulate", async (route) => {
      const headers = { ...route.request().headers() };
      delete headers["x-csrf-token"];
      await route.continue({ headers });
    });
    await page.getByLabel("Project").selectOption({ index: 0 });
    await page.getByRole("button", { name: "Explain decision" }).click();
    await expect(page.getByRole("alert")).toBeVisible();
    // No decision card was rendered from an unauthenticated-CSRF response.
    await expect(page.getByRole("status").filter({ hasText: "Matched:" })).toHaveCount(0);
  });
});