import assert from 'node:assert/strict'
import type { FastifyRequest } from 'fastify'
import { getClientIp } from '../src/common/http/client-ip'
import {
  assertAuthRateLimit,
  resetAuthRateLimitForTests,
} from '../src/common/rate-limit/auth-rate-limit'

resetAuthRateLimitForTests()
process.env.TRUST_PROXY = 'true'

const attackerPeer = '203.0.113.99'
const req = {
  socket: { remoteAddress: attackerPeer },
  headers: { 'x-forwarded-for': 'fresh-spoofed-ip-1' },
} as FastifyRequest

const ip = getClientIp(req)
assert.equal(ip, attackerPeer, 'forged XFF must not become rate-limit key')

for (let i = 0; i < 30; i++) {
  assertAuthRateLimit(ip)
}
let blocked = false
try {
  assertAuthRateLimit(ip)
  blocked = true
} catch (error) {
  assert.equal((error as { status?: number }).status, 429)
}
assert.equal(blocked, false, 'rate limit must apply to real peer IP')

resetAuthRateLimitForTests()
delete process.env.TRUST_PROXY

console.log('auth-rate-limit-xff tests passed')