import { expect, test } from "@playwright/test";

// The admin panel as a homepage-admins member. The 200 itself is the RBAC
// allow-leg: the same path returns 403 for the standard user (10-homepage).

test("admin panel renders admin-category services", async ({ page }) => {
  await page.goto("/admin/");
  await expect(page).toHaveTitle(/frank — admin/, { timeout: 60_000 });

  const registry: { name: string; category: string }[] = await (await page.request.get("/services.json")).json();
  const adminNames = registry.filter((s) => s.category === "admin").map((s) => s.name);

  // Panels hydrate client-side; poll the count, then compare exact sets.
  await expect
    .poll(() => page.locator("#grid .panel .name").count(), { timeout: 60_000 })
    .toBe(adminNames.length);
  const names = await page.locator("#grid .panel .name").allTextContents();

  expect([...names].sort()).toEqual([...adminNames].sort());
  // RBAC tripwire: a user-category panel in the admin grid means category leakage.
  expect(names).not.toContain("SearXNG");
});

test("admin open links reach their apps through SSO", async ({ page }) => {
  test.setTimeout(240_000);
  await page.goto("/admin/");
  await expect(page.locator("#grid a.open")).toHaveCount(3); // grafana, prometheus, loki
  const hrefs = await page.locator("#grid a.open").evaluateAll((els) =>
    els.map((el) => (el as HTMLAnchorElement).href),
  );

  for (const href of hrefs) {
    const target = new URL(href);
    await page.goto(href);
    // Every guarded vhost runs its own Anubis proof-of-work on first visit.
    await expect
      .poll(
        () => page.locator("body").innerText().then((t) => !t.includes("Making sure you're not a bot")),
        { timeout: 60_000 },
      )
      .toBe(true);
    await expect
      .poll(() => new URL(page.url()).hostname, { timeout: 60_000 })
      .toBe(target.hostname);
    expect(await page.locator('input[name="uidField"]').count()).toBe(0);
    const resp = await page.request.get(page.url());
    expect(resp.status(), `${target.hostname} must answer, not error`).toBeLessThan(500);
  }
});