'use strict'
const { test, describe, before, after } = require('node:test')
const assert = require('node:assert/strict')
const http = require('node:http')
const { initDb } = require('../db.js')
const { createServer } = require('../server.js')

function request(server, method, path, body, headers = {}) {
  return new Promise((resolve, reject) => {
    const addr = server.address()
    const opts = {
      hostname: '127.0.0.1',
      port: addr.port,
      path,
      method,
      headers: { 'Content-Type': 'application/json', ...headers },
    }
    const req = http.request(opts, res => {
      let data = ''
      res.on('data', c => { data += c })
      res.on('end', () => {
        let json = null
        try { json = JSON.parse(data) } catch {}
        resolve({ status: res.statusCode, headers: res.headers, body: json, raw: data })
      })
    })
    req.on('error', reject)
    if (body) req.write(JSON.stringify(body))
    req.end()
  })
}

let db, server
const ADMIN_PWD = 'testadminpwd'

before(() => {
  process.env.ADMIN_PASSWORD = ADMIN_PWD
  db = initDb(':memory:')
  server = createServer(db)
  const p1 = db.createProfile('adm1@example.com', 'Admin1')
  const p2 = db.createProfile('adm2@example.com', 'Admin2')
  db.recordAnswer(p1.id, 'A', true)
  db.recordAnswer(p2.id, 'B', false)
  return new Promise(resolve => server.listen(0, resolve))
})

after(() => {
  delete process.env.ADMIN_PASSWORD
  db._db.close()
  return new Promise(resolve => server.close(resolve))
})

describe('GET /api/admin/users', () => {
  test('returns user list with valid admin password', async () => {
    const r = await request(server, 'GET', '/api/admin/users', null, {
      Authorization: `Bearer ${ADMIN_PWD}`,
    })
    assert.equal(r.status, 200)
    assert.ok(Array.isArray(r.body))
    const emails = r.body.map(u => u.email)
    assert.ok(emails.includes('adm1@example.com'))
  })

  test('returns 401 without admin password', async () => {
    const r = await request(server, 'GET', '/api/admin/users', null)
    assert.equal(r.status, 401)
  })

  test('returns 401 with wrong admin password', async () => {
    const r = await request(server, 'GET', '/api/admin/users', null, {
      Authorization: 'Bearer wrongpwd',
    })
    assert.equal(r.status, 401)
  })
})

describe('GET /api/admin/stats', () => {
  test('returns stats with valid admin password', async () => {
    const r = await request(server, 'GET', '/api/admin/stats', null, {
      Authorization: `Bearer ${ADMIN_PWD}`,
    })
    assert.equal(r.status, 200)
    assert.ok(typeof r.body.totalUsers === 'number')
    assert.ok(Array.isArray(r.body.mostMissed))
  })

  test('returns 401 without admin password', async () => {
    const r = await request(server, 'GET', '/api/admin/stats', null)
    assert.equal(r.status, 401)
  })
})