import { afterEach, beforeEach, describe, expect, it } from 'vitest';
import { handleActuateAPI } from '../../api/index.js';
import { initDB } from '../../db.js';
const SECRET = 'test-secret-for-cron-routes-aaaaaaaaaaa';
function createMockDB() {
    return {
        document: {
            findMany: async () => [],
            updateMany: async () => ({ count: 0 }),
            deleteMany: async () => ({ count: 0 }),
        },
        session: { deleteMany: async () => ({ count: 0 }) },
        auditLog: { deleteMany: async () => ({ count: 0 }) },
        passwordResetToken: { deleteMany: async () => ({ count: 0 }) },
    };
}
describe('cron route HTTP method (Vercel Cron compatibility)', () => {
    const originalCronSecret = process.env.CRON_SECRET;
    beforeEach(() => {
        process.env.CMS_SECRET = SECRET;
        process.env.CRON_SECRET = 'cron-secret-for-test-aaaaaaaaaaaaaaaa';
        initDB(createMockDB());
    });
    afterEach(() => {
        if (originalCronSecret === undefined)
            delete process.env.CRON_SECRET;
        else
            process.env.CRON_SECRET = originalCronSecret;
    });
    // Bugbot review (PR #40, post-fix commit): Vercel Cron sends GET requests
    // (https://vercel.com/docs/cron-jobs). The original implementation used
    // router.post(...) which would have returned 405/404 for every Vercel
    // invocation, leaving the cron jobs silently non-functional.
    it.each(['/api/cms/cron/publish', '/api/cms/cron/cleanup', '/api/cms/cron/seo-scan'])('accepts GET %s with valid CRON_SECRET (Vercel Cron path)', async (path) => {
        const handler = handleActuateAPI({ prismaClient: createMockDB() });
        const response = await handler(new Request(`https://example.com${path}`, {
            method: 'GET',
            headers: { authorization: `Bearer ${process.env.CRON_SECRET}` },
        }));
        // Either 200 (handler ran) or 500 (handler ran but mock DB couldn't
        // satisfy something) — both prove the route was matched. We must NOT
        // get 404 or 405.
        expect([200, 500]).toContain(response.status);
    });
    it.each(['/api/cms/cron/publish', '/api/cms/cron/cleanup', '/api/cms/cron/seo-scan'])('still accepts POST %s for self-hosted schedulers', async (path) => {
        const handler = handleActuateAPI({ prismaClient: createMockDB() });
        const response = await handler(new Request(`https://example.com${path}`, {
            method: 'POST',
            headers: { authorization: `Bearer ${process.env.CRON_SECRET}` },
        }));
        expect([200, 500]).toContain(response.status);
    });
    it.each(['/api/cms/cron/publish', '/api/cms/cron/cleanup', '/api/cms/cron/seo-scan'])('rejects GET %s without CRON_SECRET (401, not 405)', async (path) => {
        const handler = handleActuateAPI({ prismaClient: createMockDB() });
        const response = await handler(new Request(`https://example.com${path}`, { method: 'GET' }));
        expect(response.status).toBe(401);
    });
    it.each(['/api/cms/cron/publish', '/api/cms/cron/cleanup', '/api/cms/cron/seo-scan'])('rejects GET %s with wrong CRON_SECRET (401)', async (path) => {
        const handler = handleActuateAPI({ prismaClient: createMockDB() });
        const response = await handler(new Request(`https://example.com${path}`, {
            method: 'GET',
            headers: { authorization: 'Bearer wrong-secret' },
        }));
        expect(response.status).toBe(401);
    });
});
//# sourceMappingURL=cron-routes.test.js.map