import { expect } from "bun:test";
import { forEachDb } from "./helpers";
import { FIXTURES, makeApp } from "./app";
import { extraCourses } from "./courses";

forEachDb("one visibility rule: the global author role alone does not open a restricted course (I1)", async (db) => {
  const dir = await extraCourses();
  const { call, signUp } = await makeApp(db, [FIXTURES, dir]);
  const owner = await signUp("owner@x.test");
  const author = await signUp("author@x.test");
  const coAuthor = await signUp("co@x.test");
  const users = (await (await call("GET", "/api/admin/users", { cookie: owner })).json()) as { id: string; email: string }[];
  const id = (e: string) => users.find((u) => u.email === e)!.id;
  expect((await call("PUT", `/api/admin/users/${id("author@x.test")}/roles`, { cookie: owner, body: { roles: ["author"] } })).status).toBe(200);
  expect((await call("PUT", "/api/admin/courses/secret/access", { cookie: owner, body: { authors: [id("co@x.test")] } })).status).toBe(200);

  const paths = ["/api/courses/secret", "/api/courses/secret/lessons/s1", "/api/media/secret/a.md"];
  for (const p of paths) {
    expect([p, (await call("GET", p, { cookie: author })).status]).toEqual([p, 404]);
    expect([p, (await call("GET", p, { cookie: coAuthor })).status]).toEqual([p, 200]);
  }
  const lib = async (c: string) => ((await (await call("GET", "/api/library", { cookie: c })).json()) as { courses: { id: string }[] }).courses.map((x) => x.id);
  expect(await lib(author)).not.toContain("secret");
  expect(await lib(coAuthor)).toContain("secret");
  const search = (await (await call("GET", "/api/library/search?q=hidden", { cookie: author })).json()) as unknown[];
  expect(search).toEqual([]);
});