import { ManualOperationAuditMiddleware } from './manual-operation-audit.middleware';

describe('ManualOperationAuditMiddleware', () => {
  it('records a successful authenticated mutation without storing request bodies', async () => {
    const prisma = { operationLog: { create: jest.fn().mockResolvedValue({ id: 'log-1' }) } };
    const middleware = new ManualOperationAuditMiddleware(prisma as never);
    let finish: (() => void) | undefined;
    const response = { statusCode: 200, once: (_event: 'finish', listener: () => void) => { finish = listener; } };
    const next = jest.fn();

    middleware.use({
      method: 'PUT',
      originalUrl: '/api/admin/enterprise-applications/c12345678901234567890?view=full',
      sessionUserId: 'user-1',
      header: () => 'jest',
    }, response, next);
    finish?.();
    await Promise.resolve();

    expect(next).toHaveBeenCalled();
    expect(prisma.operationLog.create).toHaveBeenCalledWith({
      data: expect.objectContaining({
        userId: 'user-1',
        action: 'manual_operation.put',
        resource: 'enterprise-applications',
        resourceId: 'c12345678901234567890',
        detail: { method: 'PUT', path: '/api/admin/enterprise-applications/c12345678901234567890', statusCode: 200 },
      }),
    });
  });

  it('does not record unauthenticated, read-only, or failed requests', () => {
    const prisma = { operationLog: { create: jest.fn() } };
    const middleware = new ManualOperationAuditMiddleware(prisma as never);
    const response = { statusCode: 500, once: (_event: 'finish', listener: () => void) => listener() };
    middleware.use({ method: 'POST', originalUrl: '/api/admin/test', sessionUserId: 'user-1', header: () => undefined }, response, jest.fn());
    middleware.use({ method: 'GET', originalUrl: '/api/admin/test', sessionUserId: 'user-1', header: () => undefined }, response, jest.fn());
    middleware.use({ method: 'POST', originalUrl: '/api/admin/test', header: () => undefined }, response, jest.fn());
    expect(prisma.operationLog.create).not.toHaveBeenCalled();
  });
});