/**
 * MfaPromptBanner security contract tests.
 *
 * Verifies structural properties of MfaPromptBanner.tsx via source analysis:
 *   - Snooze is user-scoped (userId in the localStorage key)
 *   - Default snooze is at least 1 day
 *   - Banner always links to /account/security
 *   - Component does not persist sensitive data (MFA secret or token) to localStorage
 *
 * The vitest environment for apps/web is "node" so source analysis is the
 * correct testing approach here (same pattern as MfaSetup.test.ts).
 */

import { readFileSync } from "node:fs";
import { resolve } from "node:path";
import { describe, expect, it } from "vitest";

const SOURCE_PATH = resolve(__dirname, "./MfaPromptBanner.tsx");
const source = readFileSync(SOURCE_PATH, "utf-8");

describe("MfaPromptBanner — localStorage user-scoping", () => {
  it("includes userId in the localStorage key to prevent cross-user snooze leakage", () => {
    // The key must interpolate userId, e.g. `${SNOOZE_KEY}_${userId}`
    expect(source).toMatch(/\$\{.*userId\}/);
  });

  it("persists snooze timestamp as a number, not session/token data", () => {
    // localStorage.setItem should write a numeric timestamp (Date.now() + offset)
    expect(source).toMatch(/Date\.now\(\)/);
  });
});

describe("MfaPromptBanner — snooze duration", () => {
  it("snoozed for at least 1 day (86 400 000 ms)", () => {
    // Extract the SNOOZE_DAYS constant value from the source
    const match = source.match(/SNOOZE_DAYS\s*=\s*(\d+)/);
    expect(match).not.toBeNull();
    const days = Number(match![1]);
    expect(days).toBeGreaterThanOrEqual(1);
  });
});

describe("MfaPromptBanner — navigation target", () => {
  it("links to /account/security for MFA setup", () => {
    expect(source).toMatch(/\/account\/security/);
  });
});

describe("MfaPromptBanner — no sensitive data in localStorage", () => {
  it("does not store TOTP secret in localStorage", () => {
    expect(source).not.toMatch(/localStorage.*secret/i);
    expect(source).not.toMatch(/localStorage.*totp/i);
  });

  it("does not store authentication tokens in localStorage", () => {
    expect(source).not.toMatch(/localStorage.*token/i);
  });
});

describe("MfaPromptBanner — accessibility", () => {
  it("has a role=alert or aria-label to be announced by screen readers", () => {
    expect(source).toMatch(/role=["']alert["']|aria-label/);
  });
});
