package httpapi

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestRouterProductionMountsImpersonationBehindAuth(t *testing.T) {
	t.Parallel()
	s := testAPIServer()
	s.Config.AppEnv = "production"
	h := s.Router()

	for _, path := range []string{
		"/api/admin/users/00000000-0000-0000-0000-000000000001/impersonate",
		"/api/admin/dev/stop-impersonate",
		"/api/admin/dev/switchable-users",
		"/api/admin/users/00000000-0000-0000-0000-000000000001/dev-password",
	} {
		rec := httptest.NewRecorder()
		method := http.MethodPost
		if path == "/api/admin/dev/switchable-users" {
			method = http.MethodGet
		}
		h.ServeHTTP(rec, httptest.NewRequest(method, path, nil))
		// Unauthenticated: RequireSession → 401. Must not succeed without a session.
		if rec.Code == http.StatusOK {
			t.Fatalf("%s returned 200 without auth in production", path)
		}
	}
}