import { describe, expect, it } from "vitest";
import {
  AcceptUploadRequestSchema,
  AdminCreditAdjustmentRequestSchema,
  ApiErrorResponseSchema,
  CreateCheckoutResponseSchema,
  DownloadResponseSchema,
  SessionResponseSchema,
} from "./index.js";

describe("API contracts", () => {
  it("validates server-calculated integer pricing", () => {
    expect(CreateCheckoutResponseSchema.parse({ version: "v1", checkoutId: "cs_1", checkoutUrl: "https://checkout.stripe.test/x", quantity: 2, unitPriceCents: 500, totalCents: 1000, currency: "USD" }).totalCents).toBe(1000);
    expect(CreateCheckoutResponseSchema.safeParse({ version: "v1", checkoutId: "cs_1", checkoutUrl: "https://checkout.stripe.test/x", quantity: 2, unitPriceCents: 500, totalCents: 999, currency: "USD" }).success).toBe(false);
  });

  it("rejects private paths and secret fields", () => {
    const upload = { version: "v1", uploadId: "up_1", originalFilename: "test.pdf", contentType: "application/pdf", sizeBytes: 42, idempotencyKey: "0123456789abcdef", privatePath: "/srv/private/test.pdf" };
    expect(AcceptUploadRequestSchema.safeParse(upload).success).toBe(false);
    const download = { version: "v1", downloadUrl: "https://example.test/signed", expiresAt: "2026-08-23T12:00:00.000Z", filename: "test.zip", storageKey: "private/key" };
    expect(DownloadResponseSchema.safeParse(download).success).toBe(false);
  });

  it("does not expose session secrets", () => {
    const session = { version: "v1", user: { id: "user_1", email: "a@example.test", isAdmin: false }, csrfToken: "0123456789abcdef", creditBalance: 3, creditDeficit: 0 };
    expect(SessionResponseSchema.safeParse(session).success).toBe(true);
    expect(SessionResponseSchema.safeParse({ ...session, sessionToken: "secret" }).success).toBe(false);
  });

  it("uses non-enumerating public errors", () => {
    expect(ApiErrorResponseSchema.safeParse({ version: "v1", error: { code: "NOT_FOUND", message: "Resource not found", retryable: false } }).success).toBe(true);
    expect(ApiErrorResponseSchema.safeParse({ version: "v1", error: { code: "WRONG_OWNER", message: "Owned by another user", retryable: false } }).success).toBe(false);
  });

  it("requires audited non-zero integer admin adjustments", () => {
    const base = { version: "v1", userId: "user_1", reason: "Manual reconciliation", idempotencyKey: "0123456789abcdef" };
    expect(AdminCreditAdjustmentRequestSchema.safeParse({ ...base, deltaCredits: -2 }).success).toBe(true);
    expect(AdminCreditAdjustmentRequestSchema.safeParse({ ...base, deltaCredits: 0 }).success).toBe(false);
    expect(AdminCreditAdjustmentRequestSchema.safeParse({ ...base, deltaCredits: 1.5 }).success).toBe(false);
  });
});