import { test, expect } from "@playwright/test";

const apiBaseURL = process.env.API_BASE_URL ?? "http://localhost:3000";
const runE2E = process.env.RUN_E2E === "true";

test.skip(!runE2E, "RUN_E2E=true requis");

test.describe("extended endpoint coverage", () => {
  test("public endpoints without auth", async ({ request }) => {
    // List themes
    const themesResp = await request.get(`${apiBaseURL}/api/themes`);
    expect([200, 400, 404]).toContain(themesResp.status());

    // Get public config
    const configResp = await request.get(`${apiBaseURL}/api/config/public`);
    expect([200, 400, 404]).toContain(configResp.status());

    // List levels
    const levelsResp = await request.get(`${apiBaseURL}/api/levels`);
    expect([200, 400, 404]).toContain(levelsResp.status());

    // List avatar packs
    const avatarsResp = await request.get(`${apiBaseURL}/api/shop/avatars`);
    expect([200, 400, 404]).toContain(avatarsResp.status());

    // List ball skins
    const skinsResp = await request.get(`${apiBaseURL}/api/shop/ball-skins`);
    expect([200, 400, 404]).toContain(skinsResp.status());

    // List gamemodes
    const modesResp = await request.get(`${apiBaseURL}/api/gamemodes`);
    expect([200, 400, 404]).toContain(modesResp.status());
  });

  test("protected endpoints require auth or are accessible", async ({
    request,
  }) => {
    // Try wallet balance without auth - should be 401 or 404 if endpoint doesn't exist
    const walletResp = await request.get(`${apiBaseURL}/api/wallet/balance`);
    expect([401, 404, 400]).toContain(walletResp.status());

    // Try settings without auth
    const settingsResp = await request.get(`${apiBaseURL}/api/settings`);
    expect([401, 404, 400]).toContain(settingsResp.status());

    // Try daily without auth
    const dailyResp = await request.get(`${apiBaseURL}/api/daily`);
    expect([401, 404, 400]).toContain(dailyResp.status());

    // Try weekly without auth
    const weeklyResp = await request.get(`${apiBaseURL}/api/weekly`);
    expect([401, 404, 400]).toContain(weeklyResp.status());
  });

  test("admin endpoints require admin role", async ({ request }) => {
    // Try audit log without auth - might be 401 or 404
    const noAuthResp = await request.get(`${apiBaseURL}/api/admin/audit-log`);
    expect([401, 404]).toContain(noAuthResp.status());
  });

  test("stats with authenticated user", async ({ request }) => {
    // Create auth token
    const timestamp = Date.now();
    const email = `extended-${timestamp}@rollerlogic.test`;
    const registerResp = await request.post(`${apiBaseURL}/api/auth/register`, {
      data: { email, password: "Pass!234", displayName: "Tester" },
    });
    expect(registerResp.ok()).toBe(true);
    const { token } = await registerResp.json();

    // Get stats with auth
    const statsResp = await request.get(`${apiBaseURL}/api/stats/me`, {
      headers: { authorization: `Bearer ${token}` },
    });
    expect([200, 400, 404]).toContain(statsResp.status());
  });
});