import { describe, expect, it } from "vitest";
import worker from "../src/index";
import type { Env } from "../src/env";

const env: Env = {
  BETTER_AUTH_URL: "http://localhost:8788",
  TRUSTED_ORIGINS: "http://localhost:8787",
};

describe("cfw-auth worker", () => {
  it("does not expose a custom health endpoint", async () => {
    const response = await worker.fetch(new Request("http://auth.local/healthz"), env);
    expect(response.status).toBe(404);
  });

  it("does not expose a custom session wrapper", async () => {
    const response = await worker.fetch(new Request("http://auth.local/internal/session"), env);
    expect(response.status).toBe(404);
  });

  it("routes Better Auth traffic through /api/auth/*", async () => {
    const response = await worker.fetch(new Request("http://auth.local/api/auth/reference"), env);
    expect([200, 404, 500]).toContain(response.status);
  });

  it("applies configured CORS origin for auth routes", async () => {
    const response = await worker.fetch(
      new Request("http://auth.local/api/auth/reference", {
        headers: {
          Origin: "http://localhost:8787",
        },
      }),
      env,
    );
    expect(response.headers.get("access-control-allow-origin")).toBe("http://localhost:8787");
  });

  it("does not route non-GET/POST auth requests to Better Auth", async () => {
    const response = await worker.fetch(
      new Request("http://auth.local/api/auth/session", {
        method: "PUT",
      }),
      env,
    );
    expect(response.status).toBe(404);
  });
});