/**
 * GATE 2 (partial) — HTTP shell health endpoint.
 */

import { describe, it, before, after } from 'node:test';
import assert from 'node:assert/strict';
import { createApp } from '../../src/app.js';

describe('createApp', () => {
  /** @type {import('http').Server} */
  let server;
  /** @type {number} */
  let port;

  before(async () => {
    const app = createApp();
    await new Promise((resolve) => {
      server = app.listen(0, '127.0.0.1', resolve);
    });
    port = server.address().port;
  });

  after(async () => {
    await new Promise((resolve) => server.close(resolve));
  });

  it('GET /health returns ok', async () => {
    const res = await fetch(`http://127.0.0.1:${port}/health`);
    assert.equal(res.status, 200);
    const body = await res.json();
    assert.equal(body.status, 'ok');
    assert.equal(body.service, 'verae-zapier-middleware');
    assert.equal(typeof body.mockVerae, 'boolean');
    assert.equal(typeof body.natsEnabled, 'boolean');
    assert.equal(typeof body.natsConnected, 'boolean');
    assert.ok(res.headers.get('x-trace-id'));
  });

  it('protected /zapier path requires auth', async () => {
    const res = await fetch(`http://127.0.0.1:${port}/zapier/v1/timestamp`, {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: '{}',
    });
    assert.equal(res.status, 401);
    const body = await res.json();
    assert.equal(body.code, 'UNAUTHORIZED');
  });
});