import assert from "node:assert/strict";
import { createServer } from "node:http";
import type { AddressInfo } from "node:net";
import { test } from "node:test";
import express from "express";
import type { SupabaseClient } from "@supabase/supabase-js";

test("media lookups skip timing data while retaining session ownership checks", async () => {
  Object.assign(process.env, {
    NODE_ENV: "test", FRONTEND_URL: "http://127.0.0.1:3000", BACKEND_URL: "http://127.0.0.1:4000",
    ANALYSIS_PROXY_SECRET: "test-analysis-proxy-secret-32-chars", SUPABASE_URL: "http://127.0.0.1:54321",
    SUPABASE_ANON_KEY: "test-anon-key", SUPABASE_SERVICE_ROLE_KEY: "test-service-role-key",
  });
  const { analysisRouter } = await import("../src/analysis.js");
  const sessionId = "11111111-1111-4111-8111-111111111111";
  const userId = "22222222-2222-4222-8222-222222222222";
  const times = [{ action_id: sessionId, start_time_seconds: 1, end_time_seconds: 2 }];
  const filters: [string, string][] = [];
  const tables: string[] = [];
  let owned = true;
  const db = {
    from(table: string) {
      tables.push(table);
      const query = {
        select() { return query; },
        eq(column: string, value: string) { filters.push([column, value]); return query; },
        async maybeSingle() { return { data: owned ? { session_id: sessionId, user_id: userId } : null, error: null }; },
        then(resolve: (value: unknown) => void) { return Promise.resolve({ data: times, error: null }).then(resolve); },
      };
      return query;
    },
  } as unknown as SupabaseClient;
  const app = express();
  const secret = process.env.ANALYSIS_PROXY_SECRET!;
  app.use("/internal/analysis", analysisRouter(db, secret));
  const server = createServer(app);
  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
  const url = `http://127.0.0.1:${(server.address() as AddressInfo).port}/internal/analysis/${sessionId}`;
  const headers = { "x-sporalize-proxy-secret": secret, "x-sporalize-user-id": userId };
  try {
    const media = await fetch(`${url}?playbackTimes=false`, { headers });
    assert.equal(media.status, 200);
    assert.deepEqual(tables, ["sessions"]);
    assert.ok(filters.some(([column, value]) => column === "user_id" && value === userId));
    tables.length = 0;
    const results = await fetch(url, { headers });
    assert.equal(results.status, 200);
    assert.deepEqual((await results.json()).action_times, times);
    assert.deepEqual(tables, ["sessions", "actions"]);
    owned = false;
    tables.length = 0;
    const denied = await fetch(`${url}?playbackTimes=false`, { headers });
    assert.equal(denied.status, 404);
    assert.deepEqual(tables, ["sessions"]);
  } finally {
    await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
  }
});