import { describe, expect, it } from "vitest";
import { createTestApp } from "./test-app.js";

describe("report download API", () => {
  it("requires a known Session and serves only a fixed report format with sandbox and no-store headers", async () => {
    const { app } = createTestApp({
      readReport: (_session, _report, format) => Promise.resolve({ bytes: Buffer.from("<!doctype html><p>report</p>"), contentType: format === "html" ? "text/html" : "application/json" }),
    });
    try {
      const response = await app.inject({ method: "GET", url: "/api/sessions/ses_1/reports/rpt_test/html" });
      expect(response.statusCode).toBe(200);
      expect(response.body).toContain("<p>report</p>");
      expect(response.headers["cache-control"]).toBe("no-store");
      expect(response.headers["content-security-policy"]).toContain("sandbox");
      expect(response.headers["content-disposition"]).toContain("attachment");
      expect((await app.inject({ method: "GET", url: "/api/sessions/ses_missing/reports/rpt_test/html" })).statusCode).toBe(404);
      expect((await app.inject({ method: "GET", url: "/api/sessions/ses_1/reports/rpt_test/env" })).statusCode).toBe(400);
    } finally { await app.close(); }
  });
});