src/app/api/codes/validate/route.test.ts

import { describe, it, expect, vi, beforeEach } from 'vitest'

beforeEach(() => {
  vi.resetModules()
})

describe('POST /api/codes/validate', () => {
  it('redirects to setup for unused code', async () => {
    vi.doMock('lib/logger', () => ({ logEvent: vi.fn() }))
    vi.doMock('lib/persistence', () => ({ getCodeByCode: async () => ({ id: 'c1', code: 'AAAAA', used: null }) }))

    const route = await import('./route')
    const req = { json: async () => ({ code: 'AAAAA' }) } as any

    const res: any = await route.POST(req)
    expect(res.status).toBe(200)
  })

  it('requires PIN when code has pin_hash and session missing', async () => {
    vi.doMock('lib/logger', () => ({ logEvent: vi.fn() }))
    vi.doMock('lib/session', () => ({ getAnonymousSession: async () => null }))
    vi.doMock('lib/persistence', () => ({
      getCodeByCode: async () => ({ id: 'c1', code: 'BBBBB', used: 1, pin_hash: 'x', room_id: 'r1' })
    }))

    const route = await import('./route')
    const req = { json: async () => ({ code: 'BBBBB' }) } as any
    const res: any = await route.POST(req)
    expect(res.status).toBe(200)
  })

  it('redirects to room when session matches for pin-protected code', async () => {
    vi.doMock('lib/logger', () => ({ logEvent: vi.fn() }))
    vi.doMock('lib/session', () => ({ getAnonymousSession: async () => ({ codeId: 'c1', sessionHash: 's1' }) }))
    vi.doMock('lib/persistence', () => ({
      getCodeByCode: async () => ({ id: 'c1', code: 'CCCCC', used: 1, pin_hash: 'x', room_id: 'r1', session_hash: 's1' })
    }))

    const route = await import('./route')
    const req = { json: async () => ({ code: 'CCCCC' }) } as any
    const res: any = await route.POST(req)
    expect(res.status).toBe(200)
  })
})