// @ts-check
// Fix #200 / #202 / #203: Mehrere SettingsController- und
// BankinstituteController-Endpoints (Logo-Upload, Logo-Löschen, LLM-Test,
// CSV-Bankimport-Formate, Bankinstitute-Verwaltung) prüften
// Auth::requireAdmin() nicht, obwohl der Bereich laut Code-Kommentar bei
// update() bewusst admin-pflichtig sein soll. Ein normaler "user"-Account
// konnte damit das Firmenlogo hochladen/löschen, Bankimport-Formate
// anlegen/ändern/löschen, den LLM-Test auslösen und die systemweite
// Bankinstitute-Referenztabelle (BLZ/BIC) überschreiben.
// Dieser Test prüft die Durchsetzung auf HTTP-Ebene, die die PHP-Suite
// nicht erreicht (Router-Guard, Auth::requireAdmin()).

const { test, expect } = require('@playwright/test')
const { uniqueTag } = require('../helpers/app')

test.describe('Autorisierung: Settings-Verwaltungsendpoints nur für Admins (Fix #200)', () => {
	test('Nicht-Admin wird von Logo-, Bankimport- und LLM-Test-Endpoints ausgesperrt', async ({ page, browser }) => {
		const username = uniqueTag('noadmin').toLowerCase().replace(/[^a-z0-9-]/g, '').slice(0, 64)
		const password = 'TempPass123!'

		await page.goto('/useradmin')
		await page.fill('#field-username', username)
		await page.fill('#field-password', password)
		await page.click('#submit-btn')
		await page.waitForURL('/useradmin')

		const row = page.locator('tr', { hasText: username })
		await expect(row).toBeVisible()

		try {
			const context = await browser.newContext({ storageState: { cookies: [], origins: [] } })
			const userPage = await context.newPage()
			await userPage.goto('/login')
			await userPage.fill('#username', username)
			await userPage.fill('#password', password)
			await userPage.click('form[action="/login"] button[type="submit"]')
			await userPage.waitForURL(url => !url.pathname.startsWith('/login'))

			await userPage.goto('/settings')
			const csrfToken = await userPage.evaluate(() => document.querySelector('meta[name="csrf-token"]')?.content || '')
			expect(csrfToken).not.toBe('')

			const headers = { 'X-CSRF-Token': csrfToken }

			const bankImportGet = await userPage.request.get('/settings/bankimport')
			expect(bankImportGet.status()).toBe(403)

			const uploadLogo = await userPage.request.post('/settings/logo', {
				headers,
				multipart: { logo: { name: 'logo.png', mimeType: 'image/png', buffer: Buffer.from([]) } },
			})
			expect(uploadLogo.status()).toBe(403)

			const deleteLogo = await userPage.request.post('/settings/logo/delete', { headers, form: {} })
			expect(deleteLogo.status()).toBe(403)

			const llmTest = await userPage.request.post('/settings/llm-test', { headers, form: {} })
			expect(llmTest.status()).toBe(403)

			const createFormat = await userPage.request.post('/settings/bankimport/create', {
				headers,
				form: { name: 'X', kuerzel: 'X' },
			})
			expect(createFormat.status()).toBe(403)

			const suggest = await userPage.request.post('/settings/bankimport/suggest', {
				headers,
				data: {},
			})
			expect(suggest.status()).toBe(403)

			const dismiss = await userPage.request.post('/settings/bankimport/dismiss-suggestion', { headers, form: {} })
			expect(dismiss.status()).toBe(403)

			const updateField = await userPage.request.post('/settings/bankimport/1/field', {
				headers,
				form: { field: 'name', value: 'X' },
			})
			expect(updateField.status()).toBe(403)

			const deleteFormat = await userPage.request.post('/settings/bankimport/1/delete', { headers, form: {} })
			expect(deleteFormat.status()).toBe(403)

			const bankinstituteGet = await userPage.request.get('/settings/bankinstitute')
			expect(bankinstituteGet.status()).toBe(403)

			const bankinstituteCheck = await userPage.request.post('/settings/bankinstitute/check', {
				headers,
				multipart: { institute_file: { name: 'inst.csv', mimeType: 'text/csv', buffer: Buffer.from('') } },
			})
			expect(bankinstituteCheck.status()).toBe(403)

			const bankinstituteImport = await userPage.request.post('/settings/bankinstitute/import', {
				headers,
				multipart: { institute_file: { name: 'inst.csv', mimeType: 'text/csv', buffer: Buffer.from('') } },
			})
			expect(bankinstituteImport.status()).toBe(403)

			for (const response of [bankImportGet, uploadLogo, deleteLogo, llmTest, createFormat, suggest, dismiss, updateField, deleteFormat, bankinstituteGet, bankinstituteCheck, bankinstituteImport]) {
				await expect(response.text()).resolves.toContain('Kein Zugriff')
			}

			const bankinstituteSearch = await userPage.request.get('/bankinstitute/search?q=100')
			expect(bankinstituteSearch.status()).toBe(200)

			await context.close()
		} finally {
			const delForm = row.locator('form[action$="/delete"]')
			if (await delForm.count() > 0) {
				await delForm.locator('button[type="submit"]').click()
				await page.waitForLoadState('networkidle')
			}
		}
	})

	test('Admin darf /settings/bankimport weiterhin aufrufen (kein 403)', async ({ page }) => {
		const response = await page.goto('/settings/bankimport')
		expect(response.status()).not.toBe(403)
	})
})