import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
import { parseRevealed, REVEAL_FAILED, RevealBigNummerAdapter } from './reveal-bignummer.adapter';

describe('parseRevealed (TE-002 trust boundary)', () => {
  it('accepts a well-formed body', () => {
    const r = parseRevealed({ bigNummer: '12345678' });
    expect(r.ok).toBe(true);
    if (r.ok) expect(r.value).toBe('12345678');
  });

  // The finding's own named case: a numeric bigNummer must be rejected, not
  // coerced — this is a PII reveal, not a display formatter.
  it('rejects a bigNummer sent as a number', () => {
    const r = parseRevealed({ bigNummer: 42 });
    expect(r).toEqual({ ok: false, error: REVEAL_FAILED });
  });

  it('rejects a missing bigNummer field', () => {
    expect(parseRevealed({}).ok).toBe(false);
  });

  it('rejects null and non-object bodies', () => {
    expect(parseRevealed(null).ok).toBe(false);
    expect(parseRevealed(undefined).ok).toBe(false);
    expect(parseRevealed('12345678').ok).toBe(false);
    expect(parseRevealed(42).ok).toBe(false);
  });
});

// isDevMode() reads the `ngDevMode` global the Angular CLI defines away in a
// production build. There is no ambient type for it in app code, so this is
// accessed through an untyped bag rather than a `declare const`.
const globals = globalThis as Record<string, unknown>;
const originalNgDevMode = globals['ngDevMode'];
const setDevMode = (on: boolean) => {
  globals['ngDevMode'] = on;
};

describe('RevealBigNummerAdapter.reveal (BIO-006a + BIO-012)', () => {
  const okResponse = () =>
    ({ ok: true, json: () => Promise.resolve({ bigNummer: '12345678' }) }) as unknown as Response;

  beforeEach(() => setDevMode(true));
  afterEach(() => {
    globals['ngDevMode'] = originalNgDevMode;
    vi.unstubAllGlobals();
  });

  it('sends X-Step-Up only when the caller passes stepUp: true', async () => {
    const fetchSpy = vi.fn().mockResolvedValue(okResponse());
    vi.stubGlobal('fetch', fetchSpy);

    await new RevealBigNummerAdapter().reveal(false);
    const headersWithoutStepUp = fetchSpy.mock.calls[0][1].headers as Record<string, string>;
    expect(headersWithoutStepUp['X-Step-Up']).toBeUndefined();

    await new RevealBigNummerAdapter().reveal(true);
    const headersWithStepUp = fetchSpy.mock.calls[1][1].headers as Record<string, string>;
    expect(headersWithStepUp['X-Step-Up']).toBe('true');
  });

  it('sends X-Role only under isDevMode()', async () => {
    const fetchSpy = vi.fn().mockResolvedValue(okResponse());
    vi.stubGlobal('fetch', fetchSpy);

    setDevMode(false);
    await new RevealBigNummerAdapter().reveal(true);
    const prodHeaders = fetchSpy.mock.calls[0][1].headers as Record<string, string>;
    expect(prodHeaders['X-Role']).toBeUndefined();
    expect(prodHeaders['X-Step-Up']).toBe('true'); // step-up is not a dev-only hatch

    setDevMode(true);
    await new RevealBigNummerAdapter().reveal(true);
    const devHeaders = fetchSpy.mock.calls[1][1].headers as Record<string, string>;
    expect(devHeaders['X-Role']).toBeDefined();
  });
});