import { describe, it, expect, beforeAll, afterAll } from 'vitest';
import { buildApp } from '../../app.js';
describe('files routes', () => {
    let app;
    let cookie;
    beforeAll(async () => {
        app = await buildApp({ config: { jwtSecret: 'test-secret-files' } });
        await app.ready();
        const loginRes = await app.inject({
            method: 'POST',
            url: '/api/auth/login',
            payload: { username: 'admin', password: 'admin' },
        });
        const cookies = loginRes.cookies;
        const access = cookies.find((c) => c.name === 'access_token');
        const refresh = cookies.find((c) => c.name === 'refresh_token');
        cookie = `access_token=${access.value}; refresh_token=${refresh.value}`;
    });
    afterAll(async () => {
        await app.close();
    });
    it('GET /api/files — returns file list', async () => {
        const res = await app.inject({
            method: 'GET',
            url: '/api/files',
            headers: { cookie },
        });
        expect(res.statusCode).toBe(200);
        const body = res.json();
        expect(body).toBeInstanceOf(Array);
        expect(body.length).toBeGreaterThanOrEqual(1);
        // Each entry should have squad, file, path
        const entry = body[0];
        expect(entry).toHaveProperty('squad');
        expect(entry).toHaveProperty('file');
        expect(entry).toHaveProperty('path');
    });
    it('GET /api/files/:squad/:path — reads a file', async () => {
        const res = await app.inject({
            method: 'GET',
            url: '/api/files/sample-squad/squad.yaml',
            headers: { cookie },
        });
        expect(res.statusCode).toBe(200);
        const body = res.json();
        expect(body).toHaveProperty('content');
        expect(body.content).toContain('sample-squad');
    });
    it('GET /api/files/:squad/:path — reads memory file', async () => {
        const res = await app.inject({
            method: 'GET',
            url: '/api/files/sample-squad/_memory/memories.md',
            headers: { cookie },
        });
        expect(res.statusCode).toBe(200);
        const body = res.json();
        expect(body).toHaveProperty('content');
    });
    it('returns 404 for non-existent file', async () => {
        const res = await app.inject({
            method: 'GET',
            url: '/api/files/sample-squad/nonexistent.md',
            headers: { cookie },
        });
        expect(res.statusCode).toBe(404);
    });
    it('rejects unauthenticated requests', async () => {
        const res = await app.inject({
            method: 'GET',
            url: '/api/files',
        });
        expect(res.statusCode).toBe(401);
    });
    it('prevents directory traversal', async () => {
        // Fastify normalizes URLs, so ../../ gets resolved before reaching the handler.
        // Either returns 403 (handler catches it) or 404 (route doesn't match).
        const res = await app.inject({
            method: 'GET',
            url: '/api/files/sample-squad/../../package.json',
            headers: { cookie },
        });
        expect([403, 404]).toContain(res.statusCode);
    });
});
//# sourceMappingURL=files-routes.test.js.map