/**
 * Regression coverage for a real production security bug: the auth guard
 * on /admin/security and /admin/soc2 was registered with a glued wildcard
 * pattern ("/admin/security*", no slash before the *) that doesn't match
 * in this Hono version -- confirmed via a standalone Hono reproduction and
 * live: an unauthenticated GET to both pages returned a real 200 with the
 * SOC 2 evidence dashboard (failed logins, locked accounts, MFA status,
 * active sessions, account deletions) in production. Found via a full
 * production HTTP sweep, not a doc or a prior test -- there was no test
 * file for this route at all before this one.
 */
import { describe, it, expect } from "bun:test";

describe("admin-security — auth gate", () => {
  it("GET /admin/security without auth redirects to login, not 200", async () => {
    const app = (await import("../app")).default;
    const res = await app.request("/admin/security");
    expect(res.status).toBe(302);
    expect(res.headers.get("location") || "").toContain("/login");
  });

  it("GET /admin/soc2 without auth redirects to login, not 200", async () => {
    const app = (await import("../app")).default;
    const res = await app.request("/admin/soc2");
    expect(res.status).toBe(302);
    expect(res.headers.get("location") || "").toContain("/login");
  });
});