import { expect, test } from "vitest";
import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { stringify } from "yaml";
import { buildApp } from "../src/app.js";
import { loadConfig } from "../src/config.js";

test("configured OIDC advertises login but fails closed without its runtime client secret", async () => {
  const directory = mkdtempSync(join(tmpdir(), "thothii-app-oidc-mode-"));
  const file = join(directory, "auth.yaml");
  writeFileSync(file, stringify({
    version: 1, mode: "oidc", publicUrl: "https://thothii.example.org",
    oidc: {
      issuer: "https://authentik.example.org/application/o/thothii/", clientId: "thothii",
      clientSecretRef: "THT_OIDC_CLIENT_SECRET", scopes: ["openid"], groupsClaim: "groups",
    },
    groupCatalog: { driver: "authentik", baseUrl: "https://authentik.example.org", apiTokenRef: "THT_AUTHENTIK_API_TOKEN" },
    authorization: { groupRoles: { "TOT Users": ["user"], "TOT Admin": ["admin"] } },
  }), "utf8");
  try {
    const app = buildApp(loadConfig({ THT_AUTH_CONFIG_FILE: file, THT_AUTH_STATE_ROOT: join(directory, "auth-state") }));
    try {
      expect((await app.inject({ method: "GET", url: "/auth/config" })).json())
        .toEqual({ mode: "oidc", localLogin: false, oidcLogin: true });
      const placeholder = await app.inject({ method: "GET", url: "/auth/oidc/login" });
      expect(placeholder.statusCode).toBe(503);
      expect(placeholder.json()).toEqual({ code: "auth_unavailable", error: "Authentication is unavailable" });
    } finally {
      await app.close();
    }
  } finally {
    rmSync(directory, { recursive: true, force: true });
  }
});