const { test, expect, request } = require('@playwright/test');
require('dotenv').config();
const { login, fillFirst, clickFirst } = require('../fixtures/auth');
const { expectBlockedOrSafe, expectNoServerError, expectSecurityHeaders } = require('../fixtures/assertions');

test('VAPT-TARGET-001 security headers on login', async ({ page }) => {
  const resp = await page.goto('/login');
  await expectSecurityHeaders(resp);
});

test('VAPT-TARGET-002 unauthorized protected URL redirects or blocks', async ({ page }) => {
  const resp = await page.goto('/notice-cases');
  await expectBlockedOrSafe(page, resp);
});

test('VAPT-TARGET-003 CSRF negative request should not create case', async () => {
  const api = await request.newContext({ baseURL: process.env.BASE_URL });
  const resp = await api.post('/notice-cases/new', { form: { title: 'csrf-negative', reference_no: 'CSRF-NEG' } });
  expect([400,401,403,404,405,422,303].includes(resp.status())).toBeTruthy();
});

test('VAPT-TARGET-004 basic XSS payload should not execute in notice case list', async ({ page }) => {
  await login(page, 'System Admin');
  await page.goto('/notice-cases');
  await expectNoServerError(page);
  const body = await page.locator('body').innerText().catch(()=>'');
  expect(body).not.toContain('<script>alert(1)</script>');
});

test('VAPT-TARGET-005 OTP brute force does not crash and should throttle/block', async ({ page }) => {
  await page.goto('/login');
  await fillFirst(page, ['input[name="email"]','input[name="login_id"]','input[type="email"]'], process.env.SYSTEM_ADMIN_EMAIL || 'admin@auditfirm.local');
  await fillFirst(page, ['input[name="password"]','input[type="password"]'], process.env.SYSTEM_ADMIN_PASSWORD || 'admin123');
  await clickFirst(page, ['button[type="submit"]','input[type="submit"]']);
  await page.waitForLoadState('domcontentloaded').catch(()=>{});
  if (!page.url().includes('/otp')) test.skip(true, 'OTP page not enabled in this environment');
  for (let i=0;i<8;i++) {
    await fillFirst(page, ['input[name="otp"]','input[name="code"]','input[type="text"]'], '000000');
    await clickFirst(page, ['button[type="submit"]','input[type="submit"]']);
    await page.waitForLoadState('domcontentloaded').catch(()=>{});
  }
  await expectNoServerError(page);
});