// @vitest-environment node

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";

vi.mock("server-only", () => ({}));

import { GET } from "@/app/api/me/quota/route";
import { signAuthToken } from "@/lib/auth/server";

const upstreamQuota = {
  object: "aegida.quota",
  model: "qwen",
  available_tokens: 42_000,
  unlimited: false,
  exhausted: false,
  resets_at: null,
  as_of: "2026-08-04T12:00:00Z",
};

beforeEach(() => {
  vi.stubEnv("JWT_SECRET", "ai-control-center-local-development-secret-2026");
  vi.stubEnv("JWT_ISSUER", "corp-ui");
  vi.stubEnv("JWT_AUDIENCE", "aegida-gate");
  vi.stubEnv("AEGIDA_TENANT_ID", "tenant-1");
  vi.stubEnv("AEGIDA_GATE_URL", "https://gate.example.test");
});

afterEach(() => {
  vi.unstubAllEnvs();
  vi.unstubAllGlobals();
});

describe("GET /api/me/quota", () => {
  it("authenticates and returns only the safe effective snapshot", async () => {
    const fetchMock = vi.fn().mockResolvedValue(Response.json(upstreamQuota));
    vi.stubGlobal("fetch", fetchMock);
    const authorization = `Bearer ${await userToken()}`;

    const response = await GET(
      new Request("http://localhost/api/me/quota?model=qwen", {
        headers: { Authorization: authorization },
      }),
    );

    expect(response.status).toBe(200);
    expect(response.headers.get("Cache-Control")).toBe("no-store");
    expect(await response.json()).toEqual({
      quota: {
        object: "aegida.quota",
        model: "qwen",
        availableTokens: 42_000,
        unlimited: false,
        exhausted: false,
        resetsAt: null,
        asOf: "2026-08-04T12:00:00Z",
      },
    });
    expect((fetchMock.mock.calls[0]?.[1] as RequestInit).headers).toEqual({
      Accept: "application/json",
      Authorization: authorization,
    });
  });

  it("rejects an invalid model before contacting Gate", async () => {
    const fetchMock = vi.fn();
    vi.stubGlobal("fetch", fetchMock);

    const response = await GET(
      new Request("http://localhost/api/me/quota?model=QWEN", {
        headers: { Authorization: `Bearer ${await userToken()}` },
      }),
    );

    expect(response.status).toBe(400);
    expect(fetchMock).not.toHaveBeenCalled();
  });

  it("maps Gate auth to 401 and every other malformed response to safe 503", async () => {
    const authorization = `Bearer ${await userToken()}`;
    vi.stubGlobal(
      "fetch",
      vi
        .fn()
        .mockResolvedValueOnce(new Response("private-auth-sentinel", { status: 401 }))
        .mockResolvedValueOnce(Response.json({ ...upstreamQuota, private_policy: "sentinel" })),
    );

    const unauthorized = await GET(
      new Request("http://localhost/api/me/quota?model=qwen", {
        headers: { Authorization: authorization },
      }),
    );
    expect(unauthorized.status).toBe(401);
    expect(JSON.stringify(await unauthorized.json())).not.toContain("private-auth-sentinel");

    const unavailable = await GET(
      new Request("http://localhost/api/me/quota?model=qwen", {
        headers: { Authorization: authorization },
      }),
    );
    expect(unavailable.status).toBe(503);
    expect(JSON.stringify(await unavailable.json())).not.toContain("private_policy");
  });
});

async function userToken(): Promise<string> {
  return signAuthToken({
    id: "11111111-1111-4111-8111-111111111111",
    email: "user@example.corp",
    externalUserId: "42",
  });
}