import test from 'node:test';import assert from 'node:assert/strict';
import {spawn} from 'node:child_process';import {once} from 'node:events';import {fileURLToPath} from 'node:url';
const root=fileURLToPath(new URL('../',import.meta.url)),port=4321,base=`http://127.0.0.1:${port}`;
test('local HTTP preview/apply/undo boundaries',async(t)=>{
 const child=spawn(process.execPath,['src/server.mjs'],{cwd:root,env:{...process.env,PORT:String(port)},stdio:'ignore'});
 const exited=once(child,'exit').catch(()=>{});
 try{
  let ready=false;for(let i=0;i<100;i++){try{const r=await fetch(base+'/api/sample');if(r.ok){ready=true;break;}}catch{}await new Promise(resolve=>setTimeout(resolve,50));}
  assert.ok(ready,'server starts');
  const post=(path,data,headers={})=>fetch(base+path,{method:'POST',headers:{'Content-Type':'application/json',...headers},body:JSON.stringify(data)});
  await t.test('reject cross-origin writes and malformed issue inputs',async()=>{
   assert.equal((await post('/api/triage',{issues:[]},{Origin:'https://untrusted.example'})).status,403);
   assert.equal((await post('/api/triage',{issues:[]})).status,400);
   assert.equal((await post('/api/triage',{issues:[{id:1,title:'a'},{id:1,title:'b'}]})).status,400);
  });
  await t.test('apply and undo only mutate a reviewable local copy',async()=>{
   const source=await (await fetch(base+'/api/sample')).json(),run=await (await post('/api/triage',source)).json();
   assert.equal(run.execution.status,'success');
   const selected=run.items.find(x=>!x.needsReview);
   const applied=await(await post('/api/apply',{runId:run.runId,decisions:[{id:selected.id,label:selected.suggestedLabel}]})).json();
   assert.equal(applied.appliedCount,1);assert.notDeepEqual(applied.issues,source.issues);
   const restored=await(await post('/api/undo',{revisionId:applied.revisionId})).json();
   assert.deepEqual(restored.issues,source.issues);
   assert.deepEqual(await(await fetch(base+'/api/sample')).json(),source);
   assert.equal((await post('/api/undo',{revisionId:applied.revisionId})).status,400);
   assert.equal((await post('/api/apply',{runId:'stale',decisions:[{id:selected.id,label:'bug'}]})).status,400);
  });
  await t.test('page has strict no-external-resource policy',async()=>{
   const response=await fetch(base+'/');assert.equal(response.status,200);
   assert.match(response.headers.get('content-security-policy'),/connect-src 'self'/);
   assert.equal((await fetch(base+'/../../etc/passwd')).status,404);
  });
 }finally{if(child.exitCode===null&&child.signalCode===null)child.kill('SIGTERM');await exited;}
});