import { describe, expect, it, vi } from 'vitest'

const runLogin = vi.fn()

vi.mock('cloudflare:workers', () => ({
  DurableObject: class DurableObject<Env> {
    declare protected env: Env
  },
}), { virtual: true })

vi.mock('@zync/auth', () => ({
  timingSafeEqual: (a: string, b: string) => a === b,
}))

vi.mock('../src/routes/auth/_auth-flows', () => ({
  runLogin,
  runSignup: vi.fn(),
  runVerifyEmail: vi.fn(),
}))

const { AuthWriteDO } = await import('../src/durable-objects/AuthWriteDO')

describe('AuthWriteDO', () => {
  it('does not expose internal errors in its HTTP response', async () => {
    const diagnostic = vi.spyOn(console, 'error').mockImplementation(() => undefined)
    runLogin.mockRejectedValueOnce(new Error('database password must not escape'))

    const object = Object.create(AuthWriteDO.prototype) as AuthWriteDO & {
      env: { AUTHWRITE_DO_SECRET: string }
    }
    object.env = { AUTHWRITE_DO_SECRET: 'test-secret' }

    const response = await object.fetch(
      new Request('https://auth-write.test/login', {
        method: 'POST',
        headers: {
          'content-type': 'application/json',
          'x-zync-authwrite': 'test-secret',
        },
        body: JSON.stringify({
          email: 'user@example.com',
          password: 'password',
          reqUrl: 'https://app.zync.is/login',
          headers: {},
        }),
      }),
    )

    expect(response.status).toBe(500)
    expect(await response.json()).toEqual({ error: 'Internal server error' })
    expect(diagnostic).toHaveBeenCalledOnce()
    expect(diagnostic).toHaveBeenCalledWith('AuthWriteDO request failed', 'Error')
    diagnostic.mockRestore()
  })
})