"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const test_1 = require("@playwright/test");
const _8_8_1 = require("../../fixtures/8.8");
const UtilitiesPage_1 = require("../../pages/8.8/UtilitiesPage");
const _setup_1 = require("../../test-setup.js");
const users_1 = require("../../utils/users");
const urlHelpers_1 = require("../../utils/urlHelpers");
const testUser = (0, users_1.getTestUser)('twentySecondUser');
// This test covers the manual scenario: create a new API client via UI, copy the Operate URL, and verify the Operate endpoint denies unauthenticated access.
_8_8_1.test.describe.configure({ mode: 'parallel' });
_8_8_1.test.describe('Operate access requires authentication @tasklistV2', () => {
    let clientName;
    const clusterName = 'Test Cluster';
    _8_8_1.test.beforeEach(async ({ page, loginPage }, testInfo) => {
        await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, testUser, (testInfo.workerIndex + 1) * 1000);
    });
    _8_8_1.test.afterEach(async ({ page, homePage, clusterPage, clusterDetailsPage }, testInfo) => {
        await (0, _setup_1.captureScreenshot)(page, testInfo);
        await (0, _setup_1.captureFailureVideo)(page, testInfo);
        if (clientName) {
            await homePage.clickClusters();
            await clusterPage.clickClusterLink(clusterName);
            await clusterDetailsPage.clickAPITab();
            await clusterDetailsPage.deleteAPIClientsIfExist(clientName);
        }
    });
    (0, _8_8_1.test)('check that request POST /v2/process-definitions/search returns 401 without credentials', async ({ homePage, clusterPage, clusterDetailsPage, clientCredentialsDetailsPage, request, }) => {
        clientName = `operate-deny-${await (0, _setup_1.generateRandomStringAsync)(5)}`;
        await _8_8_1.test.step('Add API Client to Cluster', async () => {
            await homePage.clickClusters();
            await clusterPage.clickClusterLink(clusterName);
            await clusterDetailsPage.clickAPITab();
            await clusterDetailsPage.createAPIClient(clientName);
            await clusterDetailsPage.clickCloseModalButton();
            await (0, test_1.expect)(clusterDetailsPage.clientsList.filter({ hasText: clientName })).toBeVisible({ timeout: 6000 });
        });
        let operateUrl = '';
        await _8_8_1.test.step('Capture Operate URL from client credentials page and close it', async () => {
            await clusterDetailsPage.searchAndClickClientCredentialsLink(clientName);
            operateUrl = await clientCredentialsDetailsPage.getOperateUrl();
            (0, test_1.expect)(operateUrl).toMatch(/^https?:\/\//);
            await clientCredentialsDetailsPage.goBack();
            await clusterDetailsPage.clickAPITab();
        });
        await _8_8_1.test.step('POST search endpoint without auth should be rejected', async () => {
            const sanitizedOperateUrl = (0, urlHelpers_1.sanitizeUrl)(operateUrl);
            const response = await request.post(`${sanitizedOperateUrl}/v2/process-definitions/search`, {
                data: { filter: {}, size: 10 },
            });
            (0, test_1.expect)(response.status()).toBe(401);
            const body = await response.text();
            (0, test_1.expect)(body).toBe('');
        });
    });
});
