import {describe, expect, test} from 'bun:test'
import server from './index'

describe('API surface hardening', () => {
    test('serves an unauthenticated JSON health check', async () => {
        const res = await server.fetch(new Request('http://localhost/api/health'))

        expect(res.status).toBe(200)
        expect(await res.json()).toEqual({status: 'ok'})
    })

    test('answers unknown API paths with JSON instead of the SPA shell', async () => {
        const res = await server.fetch(new Request('http://localhost/api/does-not-exist'))

        expect(res.headers.get('content-type')).toContain('application/json')
    })

    test('rejects an oversized sign-in body before parsing it', async () => {
        const res = await server.fetch(new Request('http://localhost/api/auth/login', {
            method: 'POST',
            headers: {'content-type': 'application/x-www-form-urlencoded', accept: 'application/json'},
            body: `username=admin&password=${'x'.repeat(20 * 1024)}`,
        }))

        expect(res.status).toBe(413)
        expect(await res.json()).toEqual({error: 'Request body is too large'})
    })

    test('keeps the upload ceiling for object uploads', async () => {
        const res = await server.fetch(new Request('http://localhost/api/clouds/aws/services/storage/resources/bucket-1/object?key=big.bin', {
            method: 'PUT',
            headers: {'content-type': 'application/octet-stream'},
            body: new Uint8Array(11 * 1024 * 1024),
        }))

        expect(res.status).toBe(401)
    })

    test('applies the default limit to other API routes', async () => {
        const res = await server.fetch(new Request('http://localhost/api/clouds/aws/services/messaging/resources/queue-1/messages', {
            method: 'POST',
            headers: {'content-type': 'application/json'},
            body: new Uint8Array(11 * 1024 * 1024),
        }))

        expect(res.status).toBe(413)
    })
})