import assert from 'node:assert/strict';
import test from 'node:test';
import { buildApp } from '../../src/app/build-app.js';

test('validates and authorizes image moves and exposes only the image DTO', async (context) => {
  const calls = [];
  const app = buildApp({
    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
    authorizeUnsafeRequest: async () => { calls.push('csrf'); },
    inventoryImageService: { async move(input) { calls.push(input); return { id: input.imageId, sortOrder: 1, privateData: 'hidden' }; } },
  });
  context.after(() => app.close());
  const response = await app.inject({ method: 'POST', url: '/api/v1/admin/images/image-1/move', payload: { direction: 'down' } });
  assert.equal(response.statusCode, 200);
  assert.deepEqual(calls, ['csrf', { imageId: 'image-1', direction: 'down', sellerId: 'seller-1' }]);
  assert.equal(response.json().data.sortOrder, 1);
  assert.equal(response.json().data.privateData, undefined);
  for (const payload of [{}, { direction: 'left' }, { direction: 'up', sellerId: 'other' }]) {
    assert.equal((await app.inject({ method: 'POST', url: '/api/v1/admin/images/image-1/move', payload })).statusCode, 400);
  }
});

test('rejects unauthenticated and CSRF-blocked moves without calling the service', async (context) => {
  for (const csrf of [false, true]) {
    const app = buildApp({
      authenticateAdmin: async () => csrf ? { sellerId: 'seller-1' } : null,
      authorizeUnsafeRequest: async () => { throw Object.assign(new Error('Forbidden'), { statusCode: 403 }); },
      inventoryImageService: { async move() { assert.fail('unauthorized move'); } },
    });
    context.after(() => app.close());
    assert.equal((await app.inject({ method: 'POST', url: '/api/v1/admin/images/image-1/move', payload: { direction: 'up' } })).statusCode, csrf ? 403 : 401);
  }
});