import { ForbiddenException, NotFoundException } from '@nestjs/common';
import { B2cAnalyzeController, B2cUserController } from './analyze.controller';

describe('B2cAnalyzeController auth', () => {
  it('blocks B2C result reads without the verified birth cookie', async () => {
    const svc = { getBasicList: jest.fn() };
    const ctrl = new B2cAnalyzeController(svc as any, {} as any);

    await expect(
      ctrl.getB2cBasicList(123, {} as any, { cookies: {} } as any),
    ).rejects.toBeInstanceOf(ForbiddenException);
    expect(svc.getBasicList).not.toHaveBeenCalled();
  });

  it('checks child detail ids against the owner bodId cookie', async () => {
    const svc = { getB2cDetailList: jest.fn().mockResolvedValue({ basic: {}, list: [] }) };
    const repo = { getB2cBasicById: jest.fn().mockResolvedValue({ basbId: 10, bodId: 123 }) };
    const ctrl = new B2cAnalyzeController(svc as any, repo as any);

    await expect(
      ctrl.getB2cDetailList(10, {} as any, { cookies: { b2c_auth_999: 'verified' } } as any),
    ).rejects.toBeInstanceOf(ForbiddenException);

    await expect(
      ctrl.getB2cDetailList(10, {} as any, { cookies: { b2c_auth_123: 'verified' } } as any),
    ).resolves.toEqual({ basic: {}, list: [] });
  });

  it('does not expose legacy B2C PII lookup endpoints', async () => {
    const analyzeCtrl = new B2cAnalyzeController({} as any, {} as any);
    const userCtrl = new B2cUserController();

    await expect(analyzeCtrl.getB2cUser(1)).rejects.toBeInstanceOf(NotFoundException);
    await expect(userCtrl.findB2cUser('010', 'name', '900101')).rejects.toBeInstanceOf(NotFoundException);
  });
});