/**
 * Contract test: methods that `webServer.js` calls on `ApiKeyManager`
 * MUST exist on the real class.
 *
 * Bug history this guards against:
 *   - 2026-05: webServer's /api/auth/signout called
 *     `apiKeyManager.removeKeys(null)` but the real method is
 *     `removeSessionKeys`. Sign-out 500'd at runtime. The existing
 *     `authRoutes.test.js` happened to pass because it built its own
 *     mock `apiKeyManager` with the wrong method names — the mock and
 *     the production caller agreed with each other, but neither agreed
 *     with the real class. Same drift hit /auth/callback's `setKeys`
 *     call, which silently failed to persist API keys from OAuth.
 *
 * This file imports the REAL ApiKeyManager and asserts each method
 * webServer.js calls is a function on it. Cheap to maintain — when
 * webServer starts calling a new method, add it here.
 */

import { describe, test, expect } from '@jest/globals';
import ApiKeyManager from '../../services/apiKeyManager.js';

/**
 * Every ApiKeyManager method invoked from webServer.js production paths.
 * Update this list when webServer.js starts using a new method.
 */
const REQUIRED_METHODS = Object.freeze([
  'setSessionKeys',     // /auth/callback, remote-session bootstrap
  'removeSessionKeys',  // /api/auth/signout
  'getKeysForRequest',  // /api/auth/status, /api/auth/resolve, every AI call
]);

describe('ApiKeyManager contract (methods called by webServer.js)', () => {
  const instance = new ApiKeyManager(/* logger */ null);

  test.each(REQUIRED_METHODS)('exposes %s as a function', (methodName) => {
    expect(typeof instance[methodName]).toBe('function');
  });
});
