import assert from 'node:assert/strict';
import test from 'node:test';

import { buildApp } from '../../src/app/build-app.js';

test('protects provider mapping writes and scopes mappings to the seller', async (testContext) => {
  let received;
  const app = buildApp({
    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
    authorizeUnsafeRequest: async () => {},
    providerMappingService: {
      async create(input) { received = input; return { id: 'mapping-1', ...input, status: 'ACTIVE' }; },
      async list() { return []; },
      async disable() { return { id: 'mapping-1', status: 'DISABLED' }; },
    },
  });
  testContext.after(() => app.close());

  const response = await app.inject({
    method: 'POST',
    url: '/api/v1/admin/products/product-1/provider-mappings',
    headers: { 'x-csrf-token': 'csrf' },
    payload: { providerId: 'fixture', mappingType: 'PRODUCT', externalIdentifier: 'ext-1' },
  });

  assert.equal(response.statusCode, 201);
  assert.equal(received.sellerId, 'seller-1');
  assert.equal(response.json().data.providerId, 'fixture');
});