const request = require('supertest');
const express = require('express');
const healthRouter = require('../src/routes/healthDashboard');

describe('Health Router', () => {
  let app;

  beforeEach(() => {
    app = express();
    app.use(express.json());
    app.locals.databaseService = null;
    app.locals.healthPool = null;
    app.locals.db = null;
    app.use('/api/health', healthRouter);
  });

  test('GET /api/health returns 200 OK', async () => {
    const response = await request(app)
      .get('/api/health')
      .expect('Content-Type', /json/)
      .expect(200);

    expect(response.body).toMatchObject({
      status: 'ok',
      service: 'tilbudgivern-unified'
    });
    expect(response.body).toHaveProperty('timestamp');
  });

  test('GET /api/health/database returns 503 without a database pool', async () => {
    const response = await request(app)
      .get('/api/health/database')
      .expect('Content-Type', /json/)
      .expect(503);

    expect(response.body).toMatchObject({
      status: 'error',
      database: 'disconnected',
      error: 'Database pool not available'
    });
  });

  test('GET /api/health/server-metrics returns a metrics payload', async () => {
    const response = await request(app)
      .get('/api/health/server-metrics')
      .expect('Content-Type', /json/)
      .expect(200);

    expect(response.body).toHaveProperty('success', true);
    expect(response.body).toHaveProperty('metrics');
    expect(response.body.metrics).toHaveProperty('cpu');
    expect(response.body.metrics).toHaveProperty('memory');
    expect(response.body.metrics).toHaveProperty('disk');
  });
});

describe('Basic Security Headers', () => {
  let app;

  beforeEach(() => {
    app = express();
    app.use((req, res, next) => {
      res.header('Access-Control-Allow-Origin', '*');
      res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
      res.header('X-Content-Type-Options', 'nosniff');
      next();
    });
    app.get('/test', (req, res) => res.json({ ok: true }));
  });

  test('Response includes CORS headers', async () => {
    const response = await request(app).get('/test');

    expect(response.headers).toHaveProperty('access-control-allow-origin');
    expect(response.headers).toHaveProperty('access-control-allow-methods');
  });

  test('Response includes security headers', async () => {
    const response = await request(app).get('/test');

    expect(response.headers).toHaveProperty('x-content-type-options', 'nosniff');
  });
});