import assert from "node:assert/strict";
import test from "node:test";

import { cloudWebProxyRoutePolicy } from "./cloud-web-routes.mjs";

test("cloud web proxies skills routes through authenticated cloud-api", () => {
  assert.deepEqual(cloudWebProxyRoutePolicy("GET", "/v1/skills"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "GET /v1/skills"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("GET", "/v1/skills/skill_1/tree"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "GET /v1/skills/skill_1/tree"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/skills/uploads"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "POST /v1/skills/uploads"
  });
});

test("cloud web proxies authenticated REST RPC bridge routes", () => {
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/rpc/system.health"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "POST /v1/rpc/system.health"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("GET", "/v1/rpc/system.health"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "GET /v1/rpc/system.health"
  });
});

test("cloud web proxies public WebUI performance telemetry to cloud-api", () => {
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/web-performance"), {
    proxy: true,
    authRequired: false,
    publicRoute: true,
    routeKey: "POST /v1/web-performance"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("GET", "/v1/web-performance/summary"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "GET /v1/web-performance/summary"
  });
});

test("cloud web exposes auth bootstrap as a public auth route", () => {
  assert.deepEqual(cloudWebProxyRoutePolicy("GET", "/auth/bootstrap"), {
    proxy: true,
    authRequired: false,
    publicRoute: true,
    routeKey: "GET /auth/bootstrap"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/auth/register"), {
    proxy: true,
    authRequired: false,
    publicRoute: true,
    routeKey: "POST /auth/register"
  });
});

test("cloud web proxies authenticated API key management write routes", () => {
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/api-keys"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "POST /v1/api-keys"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/api-keys/key_1/regenerate"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "POST /v1/api-keys/key_1/regenerate"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("PATCH", "/v1/api-keys/key_1"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "PATCH /v1/api-keys/key_1"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("DELETE", "/v1/api-keys/key_1"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "DELETE /v1/api-keys/key_1"
  });
});

test("cloud web proxies authenticated admin billing user management write routes", () => {
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/admin/billing/users"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "POST /v1/admin/billing/users"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("PATCH", "/v1/admin/billing/users/usr_alice"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "PATCH /v1/admin/billing/users/usr_alice"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("PATCH", "/v1/admin/billing/users/usr_alice/status"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "PATCH /v1/admin/billing/users/usr_alice/status"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/admin/billing/users/usr_alice/credits/adjust"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "POST /v1/admin/billing/users/usr_alice/credits/adjust"
  });
});

test("cloud web proxies authenticated Admin Access write routes", () => {
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/admin/access/check"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "POST /v1/admin/access/check"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("PATCH", "/v1/admin/access/users/usr_alice"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "PATCH /v1/admin/access/users/usr_alice"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("PUT", "/v1/admin/access/users/usr_alice/tools/hwpod/can-use"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "PUT /v1/admin/access/users/usr_alice/tools/hwpod/can-use"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("DELETE", "/v1/admin/access/users/usr_alice/tools/hwpod/can-use"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "DELETE /v1/admin/access/users/usr_alice/tools/hwpod/can-use"
  });
});

test("cloud web proxies authenticated provider profile management write routes", () => {
  assert.deepEqual(cloudWebProxyRoutePolicy("PUT", "/v1/admin/provider-profiles/deepseek/credential"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "PUT /v1/admin/provider-profiles/deepseek/credential"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("PUT", "/v1/admin/provider-profiles/deepseek/config"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "PUT /v1/admin/provider-profiles/deepseek/config"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/admin/provider-profiles/deepseek/validate"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "POST /v1/admin/provider-profiles/deepseek/validate"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("DELETE", "/v1/admin/provider-profiles/deepseek"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "DELETE /v1/admin/provider-profiles/deepseek"
  });
  assert.deepEqual(cloudWebProxyRoutePolicy("DELETE", "/v1/admin/provider-profiles/deepseek/credential"), {
    proxy: false,
    authRequired: false,
    publicRoute: false,
    routeKey: "DELETE /v1/admin/provider-profiles/deepseek/credential"
  });
});

test("cloud web proxies authenticated hwpod node-ops route", () => {
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/hwpod-node-ops"), {
    proxy: true,
    authRequired: true,
    publicRoute: false,
    routeKey: "POST /v1/hwpod-node-ops"
  });
});

test("cloud web proxies Code Agent steer through the Web-equivalent public API path", () => {
  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/agent/chat/steer"), {
    proxy: true,
    authRequired: false,
    publicRoute: true,
    routeKey: "POST /v1/agent/chat/steer"
  });
});