package api

import (
	"io"
	"log"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

// R-970 (v0.322.0): the router has no /config routes at all — even a SIGNED-IN request gets the router's 404 for every
// method, and the settings file is neither served nor written.
// RED-PROOF (2026-10-16, REPORT): with the `/config` GET case put back, this failed at „GET /api/config answered 200".
func TestR970_ConfigRoutesAreGone(t *testing.T) {
	dir := t.TempDir()
	path := filepath.Join(dir, "controller.yaml")
	planted := "customer:\n  id: t\n  domain: example.hu\nhub:\n  api_key: TESTONLY-key-r970\n"
	if err := os.WriteFile(path, []byte(planted), 0o600); err != nil {
		t.Fatal(err)
	}
	r := &Router{configPath: path, logger: log.New(io.Discard, "", 0)}
	r.restart = func() { t.Fatal("a /config request restarted the controller") }
	for _, p := range []string{"/api/config", "/api/config/", "/api/config/apply", "/api/config/hash"} {
		for _, m := range []string{http.MethodGet, http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch} {
			w := httptest.NewRecorder()
			r.ServeHTTP(w, httptest.NewRequest(m, p, strings.NewReader("customer:\n  id: evil\n  domain: e.example\n")))
			if w.Code != http.StatusNotFound {
				t.Errorf("%s %s answered %d, want the router's 404", m, p, w.Code)
			}
			if strings.Contains(w.Body.String(), "TESTONLY-key-r970") {
				t.Fatalf("%s %s served the settings file", m, p)
			}
		}
	}
	if got, _ := os.ReadFile(path); string(got) != planted {
		t.Fatal("the settings file was written")
	}
}