import assert from 'node:assert/strict';

const base = process.env.SMOKE_WEB_BASE ?? 'http://127.0.0.1:5173';
const origin = process.env.APP_ORIGIN ?? 'https://dev.evebot.app';
for (const path of ['/', '/assets', '/characters']) {
  const response = await fetch(`${base}${path}`, { redirect: 'manual' });
  assert.equal(response.status, 200, `SSR ${path}`);
  assert(!(await response.text()).includes('FIXTURE DEMO'), 'live app must not be demo mode');
}
for (const message of ['/assets', '/value']) {
  const response = await fetch(`${base}/api/chat`, {
    method: 'POST', headers: { origin, 'content-type': 'application/json' },
    body: JSON.stringify({ message, requestId: crypto.randomUUID() }),
  });
  assert.equal(response.status, 200);
  const result = await response.json();
  assert.equal(result.status, 'authentication_required');
  assert.equal(result.operation?.status, 'authentication_required');
}
assert.equal((await fetch(`${base}/api/session/token`)).status, 401);
assert.equal((await fetch(`${base}/api/sync`, { method: 'POST', headers: { origin: 'https://untrusted.example' } })).status, 403);
console.log('Live anonymous web smoke passed: SSR, no demo fallback, asset/chat authentication gates, session-token protection, and CSRF. No EVE login or character data accessed.');