const assert = require("node:assert/strict");

async function main() {
  const baseUrl = String(process.env.PUBLIC_APP_URL || "http://127.0.0.1:3000").replace(/\/$/, "");

  for (const role of ["admin", "coach", "client"]) {
    const login = await fetch(`${baseUrl}/api/auth/signin/demo`, {
      method: "POST",
      headers: { "content-type": "application/json", origin: baseUrl },
      body: JSON.stringify({ role }),
    });
    assert.equal(login.status, 200, role);

    const cookie = login.headers.get("set-cookie");
    assert.match(cookie, /coaching_session=/);

    const me = await fetch(`${baseUrl}/api/auth/me`, {
      headers: { cookie },
    });
    assert.equal(me.status, 200, role);

    const blockedWrite = await fetch(`${baseUrl}/api/coaching/clients`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        cookie,
        origin: baseUrl,
      },
      body: JSON.stringify({ name: "Must not persist" }),
    });
    assert.equal(blockedWrite.status, 403, role);
  }

  console.log("Live fictional demo login check passed");
}

main().catch((error) => {
  console.error(error);
  process.exit(1);
});
