import { expect, test } from "@playwright/test";

// With ONLY the homepage session cookies, a direct visit to every
// outpost-guarded vhost must resolve through Anubis + authentik silently and
// land on the app - no login form, no challenge, no IdP error page.
// Single-login enforcement (SSO across hosts). Loki serves no web UI beyond
// its API surface, so a sub-500 answer is its pass condition.

const GUARDED = ["search", "romm", "files", "seerr", "grafana", "prometheus", "loki"].map(
  (sub) => `https://${sub}.franksdank.cloud/`,
);

for (const vhost of GUARDED) {
  test(`SSO passes silently for ${new URL(vhost).hostname}`, async ({ page }) => {
    test.setTimeout(180_000);
    await page.goto(vhost);
    await expect
      .poll(
        async () => !(await page.locator("body").innerText()).includes("Making sure you're not a bot"),
        { timeout: 90_000 },
      )
      .toBe(true);
    await expect
      .poll(() => new URL(page.url()).hostname, { timeout: 60_000 })
      .toBe(new URL(vhost).hostname);
    const body = await page.locator("body").innerText();
    expect(body).not.toContain("Sign in"); // authentik identification stage
    expect(body).not.toContain("Making sure you're not a bot");
    const resp = await page.request.get(page.url());
    expect(resp.status()).toBeLessThan(500);
  });
}