import { test, expect } from "@playwright/test";

const USERNAME = process.env.OIDC_USERNAME ?? "playwright-test";
const PASSWORD = process.env.OIDC_PASSWORD ?? "";

test("OIDC login via Authentik stays on public domains throughout", async ({ page }) => {
  test.skip(!PASSWORD, "OIDC_PASSWORD not set");

  await page.goto("/");
  const oidcButton = page.getByRole("link", { name: "Sign in with Authentik" });
  await expect(oidcButton).toBeVisible();
  await oidcButton.click();

  // Regression check for the actual bug reported: the authorization endpoint
  // must be the public auth.jerodrigged.com, never a LAN IP a browser off the
  // LAN can't reach.
  await page.waitForURL(/^https:\/\/auth\.jerodrigged\.com\//, { timeout: 10_000 });
  expect(page.url()).not.toMatch(/192\.168\./);

  await page.getByPlaceholder(/email or username/i).fill(USERNAME);
  await page.getByRole("button", { name: /log in|continue|next/i }).click();

  await page.getByLabel(/password/i).fill(PASSWORD);
  await page.getByRole("button", { name: /log in|continue|sign in/i }).click();

  await page.waitForURL(/^https:\/\/monitor\.jerodrigged\.com\//, { timeout: 15_000 });
  expect(page.url()).not.toMatch(/192\.168\./);

  await expect(page.locator(".host-card").first()).toBeVisible({ timeout: 15_000 });

  await page.getByRole("button", { name: "Sign out" }).click();
  await expect(page.getByPlaceholder("Username")).toBeVisible();
});