import assert from "node:assert/strict"
import Fastify from "fastify"
import {SignJWT} from "jose"
process.env.AUTH_REQUIRED="true"
process.env.AUTH_JWT_SECRET="optimizer-test-secret"
process.env.AUTH_ISSUER="https://auth.test.local"
process.env.NODE_ENV="test"
const {default:authPlugin,requireAuth}=await import("./auth.js")
const app=Fastify()
await app.register(authPlugin)
app.addHook("preHandler",requireAuth)
let reads=0,writes=0
app.post("/api/servers/:id/ospf/optimize/preview",async()=>{reads++;return {ok:true}})
app.post("/api/servers/:id/ospf/optimize",async()=>{writes++;return {ok:true}})
const secret=new TextEncoder().encode("optimizer-test-secret")
for(const permission of ["mm:network:read","mm:network:write","mm:servers:write"]){
 const token=await new SignJWT({sub:"reader",apps:["mm"],permissions:[permission]}).setProtectedHeader({alg:"HS256"}).setIssuer("https://auth.test.local").setExpirationTime("1h").sign(secret)
 const headers={authorization:"Bearer "+token}
 const preview=await app.inject({method:"POST",url:"/api/servers/1/ospf/optimize/preview",headers})
 const apply=await app.inject({method:"POST",url:"/api/servers/1/ospf/optimize",headers})
 assert.equal(preview.statusCode,permission==="mm:servers:write"?403:200)
 assert.equal(apply.statusCode,permission==="mm:network:write"?200:403)
}
assert.equal(reads,2);assert.equal(writes,1)
assert.equal((await app.inject({method:"POST",url:"/api/servers/1/ospf/optimize"})).statusCode,401)
await app.close()
console.log("OSPF optimizer RBAC: signed JWT read/write/servers-only, no DB/RouterOS")