import { vi } from 'vitest'

vi.mock('../../lib/prisma', () => ({
  prisma: {
    employee: { findUnique: vi.fn() },
    company: { findUnique: vi.fn() },
    adminUser: { findUnique: vi.fn() },
  },
}))
vi.mock('../../lib/redis', () => ({
  redis: { on: vi.fn(), get: vi.fn(), set: vi.fn(), del: vi.fn(), quit: vi.fn() },
}))

import request from 'supertest'
import { describe, expect, it } from 'vitest'
import { createApp } from '../../app'

const app = createApp()

describe('protected auth boundaries e2e smoke', () => {
  it('keeps company, tenant, and admin protected surfaces closed without credentials', async () => {
    const vehicles = await request(app).get('/api/v1/vehicles')
    const team = await request(app).get('/api/v1/team')
    const admin = await request(app).get('/api/v1/admin/companies')

    expect(vehicles.status).toBe(401)
    expect(vehicles.body.error).toBe('unauthenticated')
    expect(team.status).toBe(401)
    expect(team.body.error).toBe('unauthenticated')
    expect(admin.status).toBe(401)
    expect(admin.body.error).toBe('unauthenticated')
  })
})
