import test from 'node:test';
import assert from 'node:assert/strict';
import { loadConfig } from '../server/config.mjs';
import { createStatusServer } from '../server/index.mjs';

test('public HTTP API is read-only, uncached, strict on ranges and isolated from demo data', async () => {
  const config = loadConfig({ STATUS_DB_PATH: ':memory:', PORT: '0', HOST: '127.0.0.1' });
  const app = await createStatusServer(config, { monitorEnabled: false });
  try {
    await new Promise((resolve, reject) => { app.server.once('error', reject); app.server.listen(0, '127.0.0.1', resolve); });
    const origin = `http://127.0.0.1:${app.server.address().port}`;
    const response = await fetch(`${origin}/api/status?range=30`);
    assert.equal(response.status, 200); assert.equal(response.headers.get('cache-control'), 'no-store');
    const live = await response.json(); assert.equal(live.overall, 'unknown'); assert.equal(live.demo, false);
    assert.equal((await fetch(`${origin}/api/status?range=31`)).status, 400);
    assert.equal((await fetch(`${origin}/api/status`, { method: 'POST' })).status, 405);
    assert.equal((await fetch(`${origin}/api/private`)).status, 404);
    assert.equal((await (await fetch(`${origin}/api/status?demo=1`)).json()).demo, true);
    assert.equal((await (await fetch(`${origin}/api/status`)).json()).services[0].checks, 0);
    assert.equal((await fetch(`${origin}/healthz`)).status, 200);
    assert.equal((await fetch(`${origin}/../.env`)).status, 404);
  } finally { await app.close(); }
});