const { expect } = require('@playwright/test');

async function expectNoServerError(page) {
  const body = await page.locator('body').innerText().catch(()=>'');
  expect(page.url()).not.toContain('500');
  expect(body).not.toMatch(/Internal Server Error|Traceback|Exception in ASGI application|AttributeError|UndefinedError/i);
}

async function expectBlockedOrSafe(page, response) {
  const status = response ? response.status() : 0;
  const body = await page.locator('body').innerText().catch(()=>'');
  const safeStatus = [401,403,404,405,422].includes(status);
  const safeText = /access denied|forbidden|unauthorized|not found|permission|login|required|invalid/i.test(body);
  const redirectedLogin = page.url().includes('/login');
  expect(safeStatus || safeText || redirectedLogin).toBeTruthy();
  await expectNoServerError(page);
}

async function expectSecurityHeaders(response) {
  const headers = response.headers();
  expect(headers['x-frame-options'] || headers['content-security-policy']).toBeTruthy();
  expect(headers['x-content-type-options'] || '').toMatch(/nosniff/i);
}

async function expectCookieFlags(context) {
  const cookies = await context.cookies();
  const session = cookies.find(c => /session|auth|token/i.test(c.name));
  if (!session) return;
  expect(session.httpOnly).toBeTruthy();
  expect(['Lax','Strict','None'].includes(session.sameSite)).toBeTruthy();
}

module.exports = { expectNoServerError, expectBlockedOrSafe, expectSecurityHeaders, expectCookieFlags };