package httpapi

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestRouterProductionOmitsImpersonationRoutes(t *testing.T) {
	t.Parallel()
	s := testAPIServer()
	s.Config.AppEnv = "production"
	h := s.Router()

	for _, path := range []string{
		"/api/admin/users/00000000-0000-0000-0000-000000000001/impersonate",
		"/api/admin/dev/stop-impersonate",
		"/api/admin/dev/switchable-users",
	} {
		rec := httptest.NewRecorder()
		method := http.MethodPost
		if path == "/api/admin/dev/switchable-users" {
			method = http.MethodGet
		}
		h.ServeHTTP(rec, httptest.NewRequest(method, path, nil))
		// Unauthenticated session yields 401; production must not expose the route as 200/403 from the handler.
		// Mounted routes behind RequireSession return 401; unmounted chi paths under /api/admin still hit RequireSession then 404 for unknown — either way not a successful switch.
		if rec.Code == http.StatusOK {
			t.Fatalf("%s returned 200 in production", path)
		}
	}
}