import assert from 'node:assert/strict';
import { once } from 'node:events';
import test from 'node:test';
import express from 'express';
import { attachMindSpaceImageGenerationRoutes } from './mindspace-image-generation-routes.mjs';

async function start(service, requireInternal = null) {
  const app = express();
  app.use(express.json());
  app.use((req, _res, next) => {
    req.currentUser = { id: 'user-1' };
    req.requestId = 'req-1';
    next();
  });
  attachMindSpaceImageGenerationRoutes(app, { getService: () => service, requireInternal });
  const server = app.listen(0, '127.0.0.1');
  await once(server, 'listening');
  return {
    url: `http://127.0.0.1:${server.address().port}`,
    async close() { server.close(); await once(server, 'close'); },
  };
}

test('image generation route passes authenticated user and idempotency key to the service', async () => {
  const calls = [];
  const fixture = await start({
    async generate(input) {
      calls.push(input);
      return { ok: true, asset: { id: 'asset-1', publicUrl: '/image.webp' } };
    },
  });
  try {
    const response = await fetch(`${fixture.url}/mindspace/v1/images/generate`, {
      method: 'POST',
      headers: { 'content-type': 'application/json', 'idempotency-key': 'imgreq-1' },
      body: JSON.stringify({ purpose: 'hero', prompt: 'calm library' }),
    });
    assert.equal(response.status, 201);
    assert.equal((await response.json()).data.asset.id, 'asset-1');
    assert.deepEqual(calls, [{
      userId: 'user-1',
      purpose: 'hero',
      prompt: 'calm library',
      negativePrompt: undefined,
      consumerRef: 'mindspace:imgreq-1:hero',
      idempotencyKey: 'imgreq-1',
    }]);
  } finally { await fixture.close(); }
});

test('image generation route exposes safe fallback without changing existing flows', async () => {
  const fixture = await start({
    async generate() {
      return { ok: false, fallback: true, code: 'purpose_disabled', message: 'disabled' };
    },
  });
  try {
    const response = await fetch(`${fixture.url}/mindspace/v1/images/generate`, {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ purpose: 'feed_cover', prompt: 'calm library' }),
    });
    assert.equal(response.status, 409);
    assert.deepEqual(await response.json(), {
      ok: false, fallback: true, code: 'purpose_disabled', message: 'disabled',
    });
  } finally { await fixture.close(); }
});

test('internal image generation route requires its injected secret guard and explicit user', async () => {
  const calls = [];
  const fixture = await start({
    async generate(input) { calls.push(input); return { ok: true, asset: { id: 'asset-1' } }; },
  }, (req, res) => {
    if (req.get('authorization') === 'Bearer internal-secret') return true;
    res.status(401).json({ message: 'invalid secret' });
    return false;
  });
  try {
    const denied = await fetch(`${fixture.url}/agent/mindspace_image_generate`, {
      method: 'POST', headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ user_id: 'user-2', purpose: 'hero', prompt: 'x' }),
    });
    assert.equal(denied.status, 401);
    const allowed = await fetch(`${fixture.url}/agent/mindspace_image_generate`, {
      method: 'POST',
      headers: {
        'content-type': 'application/json',
        authorization: 'Bearer internal-secret',
        'idempotency-key': 'page-hero-1',
      },
      body: JSON.stringify({ user_id: 'user-2', purpose: 'hero', prompt: 'x' }),
    });
    assert.equal(allowed.status, 201);
    assert.equal(calls[0].userId, 'user-2');
    assert.equal(calls[0].consumerRef, 'mindspace-agent:page-hero-1:hero');
  } finally { await fixture.close(); }
});