const test = require('node:test');
const assert = require('node:assert/strict');
process.env.JWT_SECRET = 'telegram-api-tests-only-secret';
process.env.NODE_ENV = 'production';
// This router test never connects to a real database.
require.cache[require.resolve('../src/config/database')] = { exports: { query: async () => ({ rows: [] }) } };
const express = require('express');
const jwt = require('jsonwebtoken');
const { createTelegramImportRouter } = require('../src/routes/telegramImport');

test('Telegram admin API rejects anonymous/non-admin access and preserves selected-city scope', async () => {
  const calls = [];
  const service = {
    config: { citySlug: 'polotsk' },
    getStatus: () => ({ enabled: false }),
    list: async cityId => { calls.push(['list', cityId]); return []; },
    sync: async () => { calls.push(['sync']); return {}; },
    review: async (...args) => { calls.push(['review', ...args]); return { status: 'dismissed' }; }
  };
  const app = express();
  app.use(express.json());
  app.use((req, res, next) => { req.city = { id: Number(req.get('X-City-Id') || 1), slug: req.get('X-City-Id') === '2' ? 'novopolotsk' : 'polotsk' }; next(); });
  app.use('/telegram-import', createTelegramImportRouter(service));
  const server = await new Promise(resolve => { const s = app.listen(0, '127.0.0.1', () => resolve(s)); });
  const url = `http://127.0.0.1:${server.address().port}/telegram-import`;
  const token = role => jwt.sign({ id: 7, role }, process.env.JWT_SECRET);
  try {
    assert.equal((await fetch(url)).status, 401);
    assert.equal((await fetch(url, { headers: { Authorization: `Bearer ${token('user')}` } })).status, 403);
    assert.equal(calls.length, 0);
    const headers = { Authorization: `Bearer ${token('admin')}`, 'X-City-Id': '2', 'Content-Type': 'application/json' };
    assert.equal((await fetch(url, { headers })).status, 200);
    assert.deepEqual(calls[0], ['list', 2]);
    assert.equal((await fetch(`${url}/sync`, { method: 'POST', headers })).status, 409);
    assert.equal(calls.length, 1);
    assert.equal((await fetch(`${url}/4/review`, { method: 'POST', headers, body: JSON.stringify({ action: 'dismiss', content_hash: 'hash' }) })).status, 200);
    assert.deepEqual(calls[1], ['review', 4, 2, { action: 'dismiss', content_hash: 'hash' }, 7]);
    assert.equal((await fetch(`${url}/not-an-id/review`, { method: 'POST', headers, body: '{}' })).status, 400);
  } finally { await new Promise(resolve => server.close(resolve)); }
});