import { jest } from '@jest/globals'

process.env.NODE_ENV = 'test'
process.env.INGEST_API_KEY = 'ingest-test-key'
process.env.ADMIN_API_KEY = 'admin-test-key'

jest.unstable_mockModule('../src/models/Product.js', () => ({
  default: {
    search: jest.fn(async () => ({ results: [], total: 0, page: 1, pages: 0 })),
    distinct: jest.fn(async () => []),
    find: jest.fn(() => ({ sort: () => ({ skip: () => ({ limit: () => ({ lean: async () => [] }) }) }) })),
    countDocuments: jest.fn(async () => 0),
  },
}))

jest.unstable_mockModule('../src/scraper.js', () => ({
  scrapeAll: jest.fn(async () => ({ total: 0 })),
}))

const { default: supertest } = await import('supertest')
const { default: app } = await import('../src/server.js')

describe('parapharmacy security', () => {
  test('keeps public product search available without credentials', async () => {
    const res = await supertest(app).get('/api/products/search?q=cream')
    expect(res.status).toBe(200)
  })

  test.each(['/api/products', '/api/products/bulk', '/api/scrape'])(
    'rejects unauthenticated mutation route %s',
    async (path) => {
      const res = await supertest(app).post(path).send({})
      expect(res.status).toBe(401)
    },
  )

  test('accepts a valid ingest key for product creation', async () => {
    const res = await supertest(app)
      .post('/api/products')
      .set('Authorization', 'Bearer ingest-test-key')
      .send({})
    expect(res.status).toBe(400)
  })

  test('requires a separate admin key for product deletion', async () => {
    const res = await supertest(app)
      .delete('/api/products/507f1f77bcf86cd799439011')
      .set('Authorization', 'Bearer ingest-test-key')
    expect(res.status).toBe(403)
  })

  test('does not expose Swagger in production', async () => {
    const original = process.env.NODE_ENV
    process.env.NODE_ENV = 'production'
    const res = await supertest(app).get('/api/docs')
    process.env.NODE_ENV = original
    expect(res.status).toBe(404)
  })
})