import { test, expect } from "@playwright/test";

// No page/cookies involved -- confirms protected routes actually reject
// unauthenticated requests, independent of whatever the UI does.
test.describe("unauthenticated API access is rejected", () => {
  for (const path of ["/api/hosts", "/api/devices", "/api/auth/me"]) {
    test(`GET ${path} without a session returns 401`, async ({ request }) => {
      const res = await request.get(path);
      expect(res.status()).toBe(401);
    });
  }

  test("POST /api/auth/login with bad credentials returns 401 and grants no access", async ({
    request,
  }) => {
    const res = await request.post("/api/auth/login", {
      data: { username: "admin", password: "definitely-not-the-password" },
    });
    expect(res.status()).toBe(401);

    // @fastify/session issues an anonymous session cookie on any response by
    // design (regardless of login success) -- that alone doesn't mean anything.
    // What matters is that cookie doesn't carry authentication: the same
    // request context (Playwright persists cookies across calls) must still
    // be rejected from a protected route.
    const hostsRes = await request.get("/api/hosts");
    expect(hostsRes.status()).toBe(401);
  });
});