/**
 * 2FA must hold on the API surface too.
 *
 * `sessions.requires_2fa` is set when the password step succeeds and cleared
 * only once the second factor is accepted (routes/auth.tsx:565, 674, 716).
 * middleware/auth.ts honours it in both its softAuth and requireAuth paths
 * (lines ~200 and ~273).
 *
 * middleware/api-auth.ts's session-cookie fallback checked only expiry. A
 * session that had passed the password step but not 2FA therefore
 * authenticated fully against every route using apiAuth — and was handed
 * ["repo","user","admin"] scopes — bypassing 2FA for the whole API surface.
 */

import { describe, expect, it } from "bun:test";
import { readFileSync } from "fs";

const API_AUTH = readFileSync("src/middleware/api-auth.ts", "utf8");
const AUTH = readFileSync("src/middleware/auth.ts", "utf8");

describe("api-auth session fallback honours requires2fa", () => {
  it("rejects a session still pending its second factor", () => {
    expect(API_AUTH).toContain("!session.requires2fa");
  });

  it("checks it alongside expiry, in the same guard", () => {
    // Guards against the check being added somewhere that a later `return`
    // can skip.
    const guard = API_AUTH.slice(
      API_AUTH.indexOf("// Fall back to session cookie"),
      API_AUTH.indexOf('c.set("authMethod", "session")')
    );
    expect(guard).toContain("expiresAt");
    expect(guard).toContain("!session.requires2fa");
  });

  it("does not grant scopes before the 2FA check", () => {
    const scopeIdx = API_AUTH.indexOf('c.set("tokenScopes", ["repo", "user", "admin"])');
    const checkIdx = API_AUTH.indexOf("!session.requires2fa");
    expect(checkIdx).toBeGreaterThan(-1);
    expect(scopeIdx).toBeGreaterThan(checkIdx);
  });
});

describe("the two middlewares agree", () => {
  it("both consult requires2fa", () => {
    // The bug was a divergence between them; keep them in step.
    expect(AUTH).toContain("session.requires2fa");
    expect(API_AUTH).toContain("session.requires2fa");
  });
});