server.test.js

import { describe, test, expect, beforeAll } from 'vitest';
import request from 'supertest';

describe('Server API', () => {
  let app;

  beforeAll(() => {
    // Set environment variables before loading server
    process.env.PORT = '3001';
    process.env.FRONTEND_URL = 'http://localhost:3000';
    process.env.BACKEND_URL = 'http://localhost:3001';
    process.env.SPOTIFY_CLIENT_SECRET = 'test_spotify_secret';

    // Load server
    app = require('./server.js');
  });

  describe('Health Check', () => {
    test('should return health status with correct structure', async () => {
      const response = await request(app).get('/health');

      expect(response.status).toBe(200);
      expect(response.body).toHaveProperty('status', 'ok');
      expect(response.body).toHaveProperty('timestamp');
      expect(response.body).toHaveProperty('uptime');
      expect(response.body).toHaveProperty('youtube');
      expect(response.body.youtube).toHaveProperty('configured');
      expect(response.body.youtube).toHaveProperty('authenticated');
    });

    test('should return valid timestamp in ISO format', async () => {
      const response = await request(app).get('/health');

      expect(response.status).toBe(200);
      expect(new Date(response.body.timestamp).toISOString()).toBe(response.body.timestamp);
    });

    test('should return positive uptime', async () => {
      const response = await request(app).get('/health');

      expect(response.status).toBe(200);
      expect(response.body.uptime).toBeGreaterThan(0);
    });
  });

  describe('Security Headers', () => {
    test('should set Content-Security-Policy header', async () => {
      const response = await request(app).get('/health');

      expect(response.headers).toHaveProperty('content-security-policy');
      expect(response.headers['content-security-policy']).toContain("default-src 'self'");
    });

    test('should set X-Frame-Options to DENY', async () => {
      const response = await request(app).get('/health');

      expect(response.headers).toHaveProperty('x-frame-options', 'DENY');
    });

    test('should set X-Content-Type-Options to nosniff', async () => {
      const response = await request(app).get('/health');

      expect(response.headers).toHaveProperty('x-content-type-options', 'nosniff');
    });

    test('should set X-XSS-Protection header', async () => {
      const response = await request(app).get('/health');

      expect(response.headers).toHaveProperty('x-xss-protection', '1; mode=block');
    });

    test('should set Referrer-Policy header', async () => {
      const response = await request(app).get('/health');

      expect(response.headers).toHaveProperty('referrer-policy', 'strict-origin-when-cross-origin');
    });
  });

  describe('Spotify Token Exchange - Input Validation', () => {
    test('should reject empty code parameter', async () => {
      const response = await request(app)
        .post('/api/spotify/token')
        .send({
          code: '',
          codeVerifier: 'valid_verifier',
          redirectUri: 'http://localhost:3000/spotify',
          clientId: 'test_client_id'
        });

      expect(response.status).toBe(400);
      expect(response.body.error).toBe('Invalid code parameter');
    });

    test('should reject code that is too long', async () => {
      const response = await request(app)
        .post('/api/spotify/token')
        .send({
          code: 'x'.repeat(1001),
          codeVerifier: 'valid_verifier',
          redirectUri: 'http://localhost:3000/spotify',
          clientId: 'test_client_id'
        });

      expect(response.status).toBe(400);
      expect(response.body.error).toBe('Invalid code parameter');
    });

    test('should reject non-string code', async () => {
      const response = await request(app)
        .post('/api/spotify/token')
        .send({
          code: 123,
          codeVerifier: 'valid_verifier',
          redirectUri: 'http://localhost:3000/spotify',
          clientId: 'test_client_id'
        });

      expect(response.status).toBe(400);
      expect(response.body.error).toBe('Invalid code parameter');
    });

    test('should reject empty codeVerifier', async () => {
      const response = await request(app)
        .post('/api/spotify/token')
        .send({
          code: 'valid_code',
          codeVerifier: '',
          redirectUri: 'http://localhost:3000/spotify',
          clientId: 'test_client_id'
        });

      expect(response.status).toBe(400);
      expect(response.body.error).toBe('Invalid codeVerifier parameter');
    });

    test('should reject codeVerifier that is too long', async () => {
      const response = await request(app)
        .post('/api/spotify/token')
        .send({
          code: 'valid_code',
          codeVerifier: 'x'.repeat(201),
          redirectUri: 'http://localhost:3000/spotify',
          clientId: 'test_client_id'
        });

      expect(response.status).toBe(400);
      expect(response.body.error).toBe('Invalid codeVerifier parameter');
    });

    test('should reject invalid redirectUri format', async () => {
      const response = await request(app)
        .post('/api/spotify/token')
        .send({
          code: 'valid_code',
          codeVerifier: 'valid_verifier',
          redirectUri: 'not-a-url',
          clientId: 'test_client_id'
        });

      expect(response.status).toBe(400);
      expect(response.body.error).toBe('Invalid redirectUri parameter');
    });

    test('should reject empty clientId', async () => {
      const response = await request(app)
        .post('/api/spotify/token')
        .send({
          code: 'valid_code',
          codeVerifier: 'valid_verifier',
          redirectUri: 'http://localhost:3000/spotify',
          clientId: ''
        });

      expect(response.status).toBe(400);
      expect(response.body.error).toBe('Invalid clientId parameter');
    });

    test('should reject clientId that is too long', async () => {
      const response = await request(app)
        .post('/api/spotify/token')
        .send({
          code: 'valid_code',
          codeVerifier: 'valid_verifier',
          redirectUri: 'http://localhost:3000/spotify',
          clientId: 'x'.repeat(201)
        });

      expect(response.status).toBe(400);
      expect(response.body.error).toBe('Invalid clientId parameter');
    });

    test('should reject missing parameters', async () => {
      const response = await request(app)
        .post('/api/spotify/token')
        .send({});

      expect(response.status).toBe(400);
      expect(response.body.error).toContain('Invalid');
    });
  });

  describe('YouTube Config Status', () => {
    test('should return configuration status', async () => {
      const response = await request(app).get('/api/youtube/config/status');

      expect(response.status).toBe(200);
      expect(response.body).toHaveProperty('configured');
      expect(response.body).toHaveProperty('reason');
      expect(typeof response.body.configured).toBe('boolean');
      expect(typeof response.body.reason).toBe('string');
    });
  });

  describe('YouTube Auth URL', () => {
    test('should handle missing credentials gracefully', async () => {
      const response = await request(app).get('/api/youtube/auth-url');

      // Should either return an auth URL or an error
      if (response.status === 200) {
        expect(response.body).toHaveProperty('authUrl');
        expect(response.body.authUrl).toContain('accounts.google.com');
      } else {
        expect(response.status).toBe(400);
        expect(response.body).toHaveProperty('error');
      }
    });
  });

  describe('YouTube Token Status', () => {
    test('should return token validity status', async () => {
      const response = await request(app).get('/api/youtube/token/status');

      expect(response.status).toBe(200);
      expect(response.body).toHaveProperty('valid');
      expect(response.body).toHaveProperty('reason');
      expect(typeof response.body.valid).toBe('boolean');
    });

    test('should include expiry when token exists', async () => {
      const response = await request(app).get('/api/youtube/token/status');

      expect(response.status).toBe(200);
      // If valid is true, expiry should be present
      if (response.body.valid) {
        expect(response.body).toHaveProperty('expiry');
      }
    });
  });

  describe('YouTube Token Get', () => {
    test('should return error or token', async () => {
      const response = await request(app).get('/api/youtube/token');

      // Should either return a token or an error
      if (response.status === 200) {
        expect(response.body).toHaveProperty('access_token');
        expect(response.body).toHaveProperty('expires_in');
        expect(response.body.expires_in).toBeGreaterThan(0);
      } else {
        expect([400, 401]).toContain(response.status);
        expect(response.body).toHaveProperty('error');
      }
    });
  });

  describe('YouTube Callback - Input Validation', () => {
    test('should reject missing code parameter', async () => {
      const response = await request(app).get('/api/youtube/callback');

      expect(response.status).toBe(400);
      expect(response.text).toContain('Invalid');
    });

    test('should reject code that is too long', async () => {
      const response = await request(app)
        .get('/api/youtube/callback')
        .query({ code: 'x'.repeat(1001) });

      // May be rate limited (429) or rejected (400)
      expect([400, 429]).toContain(response.status);
      if (response.status === 400) {
        expect(response.text).toContain('Invalid');
      }
    });
  });

  describe('YouTube Refresh Token', () => {
    test('should return error when no token available', async () => {
      const response = await request(app).post('/api/youtube/refresh');

      // Without a valid token, should return an error (or rate limited)
      expect([400, 401, 429]).toContain(response.status);
      if (response.status !== 429) {
        expect(response.body).toHaveProperty('error');
      }
    });
  });

  describe('Rate Limiting', () => {
    test('should apply rate limiting to API routes', async () => {
      // Make multiple requests quickly
      const requests = [];
      for (let i = 0; i < 5; i++) {
        requests.push(request(app).get('/api/youtube/config/status'));
      }

      const responses = await Promise.all(requests);

      // All should succeed within reasonable limits
      responses.forEach(response => {
        expect(response.status).toBe(200);
      });

      // Check that rate limit headers are present
      const lastResponse = responses[responses.length - 1];
      expect(lastResponse.headers).toHaveProperty('ratelimit-limit');
      expect(lastResponse.headers).toHaveProperty('ratelimit-remaining');
    });
  });

  describe('CORS Configuration', () => {
    test('should include CORS headers', async () => {
      const response = await request(app)
        .get('/health')
        .set('Origin', 'http://localhost:3000');

      // CORS middleware should add appropriate headers
      expect(response.headers).toHaveProperty('access-control-allow-origin');
    });
  });

  describe('JSON Size Limit', () => {
    test('should accept reasonably sized JSON payloads', async () => {
      const smallPayload = {
        code: 'test_code',
        codeVerifier: 'test_verifier',
        redirectUri: 'http://localhost:3000/spotify',
        clientId: 'test_client'
      };

      const response = await request(app)
        .post('/api/spotify/token')
        .send(smallPayload);

      // Should process the request (even if it fails validation)
      expect(response.status).toBeLessThan(500);
    });
  });

  describe('Error Handling', () => {
    test('should return 404 for unknown routes', async () => {
      const response = await request(app).get('/api/unknown/endpoint');

      expect(response.status).toBe(404);
    });

    test('should handle malformed JSON', async () => {
      const response = await request(app)
        .post('/api/spotify/token')
        .set('Content-Type', 'application/json')
        .send('invalid json{');

      expect(response.status).toBe(400);
    });
  });
});