import { describe, expect, it, vi } from 'vitest'

vi.mock('../../lib/prisma', () => ({ prisma: {} }))
vi.mock('../../lib/redis', () => ({
  redis: { on: vi.fn(), get: vi.fn(), set: vi.fn(), del: vi.fn(), quit: vi.fn() },
}))
vi.mock('../../middleware/requireAdminAuth', () => ({
  requireAdminAuth: (req: any, _res: any, next: any) => {
    req.admin = { id: 'admin_1', role: 'VIEWER', isActive: true }
    next()
  },
  requireAdminRole: () => (_req: any, res: any) => res.status(403).json({ code: 'forbidden' }),
  requireFreshAdmin2FA: (_req: any, _res: any, next: any) => next(),
}))
vi.mock('../../modules/menu/menu.service', () => ({
  listMenuItems: vi.fn(),
  createMenuItem: vi.fn(),
  getMenuItem: vi.fn(),
  updateMenuItem: vi.fn(),
  setMenuItemStatus: vi.fn(),
  deleteMenuItem: vi.fn(),
  assignMenuItemToPlans: vi.fn(),
  removeMenuItemFromPlan: vi.fn(),
  assignMenuItemToCompanies: vi.fn(),
  removeMenuItemFromCompany: vi.fn(),
  previewCompanyMenu: vi.fn(),
  listMenuAuditLogs: vi.fn(),
}))

import request from 'supertest'
import { createApp } from '../../app'

const app = createApp()

describe('admin menu e2e boundary smoke', () => {
  it('keeps menu administration behind admin role checks', async () => {
    const res = await request(app)
      .post('/api/v1/admin/menu-items')
      .send({ label: 'Fleet', itemType: 'INTERNAL_PAGE', routeOrUrl: '/fleet' })

    expect(res.status).toBe(403)
    expect(res.body).toMatchObject({ code: 'forbidden' })
  })
})
