// @ts-check
// Scenario: Unauthenticated guest is redirected to SSO login
const { test, expect } = require("@playwright/test");
const { resolveTimeout } = require("./timeouts");
const { gotoOnion } = require("./personas");

test.use({ ignoreHTTPSErrors: true });

function decodeDotenvQuotedValue(value) {
  if (typeof value !== "string" || value.length < 2) return value;
  if (!(value.startsWith('"') && value.endsWith('"'))) return value;
  const encoded = value.slice(1, -1);
  try { return JSON.parse(`"${encoded}"`).replace(/\$\$/g, "$"); }
  catch { return encoded.replace(/\$\$/g, "$"); }
}

const oidcIssuerUrl = decodeDotenvQuotedValue(process.env.OIDC_ISSUER_URL);
const piholeBaseUrl = decodeDotenvQuotedValue(process.env.PIHOLE_BASE_URL);

test.beforeEach(() => {
  test.skip(!oidcIssuerUrl, "SSO not enabled — skipping guest redirect test");
  expect(piholeBaseUrl, "PIHOLE_BASE_URL must be set").toBeTruthy();
});

test("guest: is redirected to SSO login", async ({ page }) => {
  const expectedOidcAuthUrl = `${oidcIssuerUrl.replace(/\/$/, "")}/protocol/openid-connect/auth`;
  await gotoOnion(page, `${piholeBaseUrl.replace(/\/$/, "")}/`);
  await expect
    .poll(() => page.url(), { timeout: resolveTimeout(30_000), message: "Expected redirect to Keycloak OIDC auth" })
    .toContain(expectedOidcAuthUrl);
});