package api

import (
	"testing"

	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
	"gitea.dooplex.hu/admin/felhom-hub/internal/offsitekeys"
)

// R-895 slice 2: the hub's own snapshot-listing events are operator-only AND hub-origin only — not in
// allowedEventTypes, so no box can POST one to /api/v1/event (a box faking "your history vanished", or drowning a
// real one). Both registers pinned in one test (REUSE.md: fixing one and not the other is the realistic mistake).
func TestR895_SnapshotEventsAreOperatorOnlyAndHubOrigin(t *testing.T) {
	for _, et := range []string{offsitekeys.EventSnapshotsVanished, offsitekeys.EventSnapshotsUnexplained} {
		if !notify.IsOperatorOnly(et) {
			t.Errorf("%s is not operator-only", et)
		}
		if allowedEventTypes[et] {
			t.Errorf("%s is in allowedEventTypes — a box could POST it", et)
		}
	}
}