import assert from 'node:assert/strict';
import test from 'node:test';

import { buildApp } from '../../src/app/build-app.js';

function createTestApp({ authorizeUnsafeRequest } = {}) {
  let settings = { pricing: { defaultStrategy: 'median' } };
  return buildApp({
    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
    authorizeUnsafeRequest,
    sellerSettingsService: {
      async get() { return settings; },
      async update({ settings: nextSettings }) {
        settings = { ...settings, ...nextSettings };
        return settings;
      },
    },
  });
}

test('reads and updates seller settings', async (testContext) => {
  const app = createTestApp();
  testContext.after(() => app.close());

  const readResponse = await app.inject({ method: 'GET', url: '/api/v1/admin/settings' });
  const updateResponse = await app.inject({
    method: 'PATCH',
    url: '/api/v1/admin/settings',
    payload: { inventory: { maxImagesPerItem: 12 } },
  });

  assert.equal(readResponse.statusCode, 200);
  assert.deepEqual(readResponse.json().data, { pricing: { defaultStrategy: 'median' } });
  assert.equal(updateResponse.statusCode, 200);
  assert.deepEqual(updateResponse.json().data, {
    pricing: { defaultStrategy: 'median' },
    inventory: { maxImagesPerItem: 12 },
  });
});

test('protects settings updates with CSRF validation', async (testContext) => {
  const app = createTestApp({
    authorizeUnsafeRequest: async () => {
      const error = new Error('CSRF validation failed.');
      error.code = 'FORBIDDEN';
      error.statusCode = 403;
      throw error;
    },
  });
  testContext.after(() => app.close());

  const response = await app.inject({
    method: 'PATCH',
    url: '/api/v1/admin/settings',
    payload: { pricing: { defaultStrategy: 'median' } },
  });

  assert.equal(response.statusCode, 403);
  assert.equal(response.json().error.code, 'FORBIDDEN');
});