import { expect, test } from "@playwright/test";
import {
  getSetCookies,
  readCookieFromSetCookieHeader,
} from "../helpers/auth-assertions.ts";

test.describe("Auth Session Isolation", () => {
  test("login bootstrap emits distinct auth_trace_id values", async ({ playwright }) => {
    const contextA = await playwright.request.newContext({
      baseURL: "http://127.0.0.1:8080",
    });
    const contextB = await playwright.request.newContext({
      baseURL: "http://127.0.0.1:8080",
    });

    const responseA = await contextA.get(
      "/auth/login?return_path=/landlord/dashboard",
      {
        maxRedirects: 0,
      },
    );
    const responseB = await contextB.get(
      "/auth/login?return_path=/landlord/dashboard",
      {
        maxRedirects: 0,
      },
    );

    const traceA = readCookieFromSetCookieHeader(
      getSetCookies(responseA),
      "auth_trace_id",
    );
    const traceB = readCookieFromSetCookieHeader(
      getSetCookies(responseB),
      "auth_trace_id",
    );

    expect(traceA).toBeTruthy();
    expect(traceB).toBeTruthy();
    expect(traceA).not.toBe(traceB);

    await contextA.dispose();
    await contextB.dispose();
  });

  test("login bootstrap clears stale auth cookies every time", async ({ request }) => {
    const response = await request.get("/auth/login", { maxRedirects: 0 });
    const setCookies = getSetCookies(response).join("\n");

    expect(setCookies).toContain("session=");
    expect(setCookies).toContain("xx_state_id=");
  });
});