import test from 'node:test';
import assert from 'node:assert/strict';
import { readFileSync } from 'node:fs';
import { safeFetch, safeFetchText, getFetchMetrics } from '../apis/utils/fetch.mjs';

test('safeFetch reports HTML as degraded JSON response', async () => {
  const originalFetch = globalThis.fetch;
  globalThis.fetch = async () => ({
    ok: true,
    status: 200,
    headers: { get: () => 'text/html' },
    text: async () => '<html>not json</html>',
  });
  try {
    const data = await safeFetch('https://example.test/json', { retries: 0, source: 'unit' });
    assert.match(data.error, /Expected JSON/);
    assert.ok(getFetchMetrics().bySource.unit.requests >= 1);
  } finally {
    globalThis.fetch = originalFetch;
  }
});

test('safeFetchText returns text and byte count', async () => {
  const originalFetch = globalThis.fetch;
  globalThis.fetch = async () => ({
    ok: true,
    status: 200,
    text: async () => 'hello',
  });
  try {
    const data = await safeFetchText('https://example.test/rss', { retries: 0, source: 'rss-unit' });
    assert.equal(data.text, 'hello');
    assert.equal(data.bytes, 5);
  } finally {
    globalThis.fetch = originalFetch;
  }
});

test('terminal action endpoints avoid URL tokens and include hardening gates', () => {
  const server = readFileSync(new URL('../server.mjs', import.meta.url), 'utf8');
  assert.match(server, /app\.post\('\/api\/action'/);
  assert.match(server, /app\.post\('\/api\/sweep'/);
  assert.match(server, /x-crucix-token/);
  assert.match(server, /sameOriginPost/);
  assert.match(server, /rateLimitTerminalAction/);
  assert.match(server, /auditTerminalAction/);
  assert.doesNotMatch(server, /req\.query\.token/);
});

test('dashboard exposes token configuration flow without devtools edits', () => {
  const html = readFileSync(new URL('../dashboard/public/jarvis.html', import.meta.url), 'utf8');
  assert.match(html, /configureTerminalActionToken/);
  assert.match(html, /crucix_terminal_action_token/);
  assert.match(html, /x-crucix-token/);
  assert.match(html, /SET TOKEN/);
});
