import { test } from 'node:test';
import assert from 'node:assert/strict';
import { spawn } from 'node:child_process';
import path from 'node:path';
import { fileURLToPath } from 'node:url';

const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
const authzRoot = path.join(root, '..', 'verae-access-authz');

test('leaf forwards archive.put and refuses billing adjust', async () => {
  const authzPort = 18026;
  const leafPort = 18027;
  const authz = spawn(process.execPath, ['src/server.js'], {
    cwd: authzRoot,
    env: { ...process.env, PORT: String(authzPort) },
    stdio: ['ignore', 'pipe', 'pipe'],
  });
  const leaf = spawn(process.execPath, ['src/server.js'], {
    cwd: root,
    env: {
      ...process.env,
      PORT: String(leafPort),
      AUTHZ_URL: `http://127.0.0.1:${authzPort}`,
      LEAF_TOKEN: 'leaf-dev-token',
    },
    stdio: ['ignore', 'pipe', 'pipe'],
  });
  await new Promise((r) => setTimeout(r, 500));
  try {
    const h = await (await fetch(`http://127.0.0.1:${leafPort}/health`)).json();
    assert.equal(h.plane, 'leaf');
    const ok = await fetch(`http://127.0.0.1:${leafPort}/forward`, {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify({
        token: 'leaf-dev-token',
        target: 'verae.archive.put',
        principal: 'ns2',
        payload: { sha256: 'abc' },
      }),
    });
    assert.equal(ok.status, 200);
    const no = await fetch(`http://127.0.0.1:${leafPort}/forward`, {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify({
        token: 'leaf-dev-token',
        target: 'verae.billing.balance.adjust',
        payload: { customerId: 'c1', cents: 9999 },
      }),
    });
    assert.equal(no.status, 403);
    const bad = await fetch(`http://127.0.0.1:${leafPort}/forward`, {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ token: 'wrong', target: 'verae.archive.put' }),
    });
    assert.equal(bad.status, 401);
  } finally {
    leaf.kill('SIGTERM');
    authz.kill('SIGTERM');
  }
});