// test/fixtures/api/server/plugins/test-user.ts
import { getHeader } from 'h3'

const USERS: Record<string, any> = {
  alice: { id: 1, organizationId: 'org_a', permissions: ['posts:update'] },
  bob: { id: 2, organizationId: 'org_b', permissions: [] },
  root: { id: 3, organizationId: 'org_a', permissions: ['*'] },
}

export default defineNitroPlugin((nitroApp) => {
  nitroApp.hooks.hook('request', (event) => {
    const user = USERS[getHeader(event, 'x-test-user') ?? '']
    if (user) {
      event.context.user = user
      event.context.permissions = user.permissions
    }
  })
})

// test/api.test.ts
import { fileURLToPath } from 'node:url'
import { describe, it, expect } from 'vitest'
import { setup, fetch } from '@nuxt/test-utils/e2e'

const as = (user?: string) => ({ headers: { 'content-type': 'application/json', ...(user ? { 'x-test-user': user } : {}) } })

describe('posts API', async () => {
  await setup({ rootDir: fileURLToPath(new URL('./fixtures/api', import.meta.url)) })

  it('refuses anonymous writes', async () => {
    const res = await fetch('/api/posts', { method: 'POST', body: JSON.stringify({ title: 'x' }), ...as() })
    expect(res.status).toBe(401)
  })

  it('only lists the caller\'s organization', async () => {
    const { data } = await (await fetch('/api/posts', as('alice'))).json()
    expect(data.every((p: any) => p.organizationId === 'org_a')).toBe(true)
  })

  it('hides other tenants\' rows as not found', async () => {
    const res = await fetch('/api/posts/2', as('alice')) // post 2 belongs to org_b
    expect(res.status).toBe(404)
  })

  it('ignores server-owned columns in the body', async () => {
    await fetch('/api/posts/1', { method: 'PATCH', body: JSON.stringify({ organizationId: 'org_b' }), ...as('alice') })
    const { data } = await (await fetch('/api/posts/1', as('alice'))).json()
    expect(data.organizationId).toBe('org_a')
  })
})

// test/fixtures/api/server/plugins/00.db.ts
import Database from 'better-sqlite3'
import { drizzle } from 'drizzle-orm/better-sqlite3'
import { initializeDatabase } from '@websideproject/nuxt-auto-api/database'
import * as schema from '../database/schema'

export default defineNitroPlugin(() => {
  const sqlite = new Database(':memory:')
  sqlite.exec(`
    CREATE TABLE posts (id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL, organization_id TEXT);
    INSERT INTO posts (title, organization_id) VALUES ('A1', 'org_a'), ('B1', 'org_b');
  `)
  initializeDatabase(drizzle(sqlite, { schema }), 'better-sqlite3')
})

// vitest.config.ts
import { fileURLToPath } from 'node:url'
import { defineConfig } from 'vitest/config'

export default defineConfig({
  test: {
    alias: { 'nitropack/runtime': fileURLToPath(new URL('./test/nitro-stub.ts', import.meta.url)) },
  },
})

// test/nitro-stub.ts
export const useRuntimeConfig = () => ({})
export const defineNitroPlugin = (fn: any) => fn

import { describe, it, expect } from 'vitest'
import { evaluatePermission } from '@websideproject/nuxt-auto-api/utils'
import { postsAuth } from '../modules/blog/auth'

const ctx = (user: any) => ({ user, permissions: user?.permissions ?? [] }) as any

describe('posts rules', () => {
  it('only org admins delete', async () => {
    expect(await evaluatePermission(postsAuth.permissions!.delete, ctx({ id: 1, orgRole: 'member' }))).toBe(false)
    expect(await evaluatePermission(postsAuth.permissions!.delete, ctx({ id: 1, orgRole: 'admin' }))).toBe(true)
  })

  it('authors edit their own posts', async () => {
    const author = { id: 7, orgRole: 'member' }
    expect(await postsAuth.objectLevel!({ authorId: 7 } as any, { ...ctx(author), operation: 'update' })).toBe(true)
    expect(await postsAuth.objectLevel!({ authorId: 8 } as any, { ...ctx(author), operation: 'update' })).toBe(false)
  })
})

bun run test               # everything (unit, integration, e2e fixtures)
bun run test:unit
bun run test:integration
AUTO_API_DIST=1 bunx vitest run test/basic.test.ts test/security.test.ts   # e2e against the BUILT module