package httpapi

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestQAOperationsFailClosedWithoutBreakingGovernance(t *testing.T) {
	auth := newFakeAuthStore()
	auth.sessions["admin-qa-fixture"] = "usr-boss"
	handler, err := NewHandler(Config{Store: &fakeJobStore{}, Auth: &AuthConfig{Store: auth}})
	if err != nil {
		t.Fatal(err)
	}
	request := httptest.NewRequest(http.MethodGet, "/api/v1/qa-ops/records?start=2026-10-14T00:00:00Z&end=2026-10-15T00:00:00Z", nil)
	request.AddCookie(&http.Cookie{Name: sessionCookieName, Value: "admin-qa-fixture"})
	response := httptest.NewRecorder()
	handler.ServeHTTP(response, request)
	if response.Code != http.StatusServiceUnavailable {
		t.Fatalf("unconfigured source must not be an empty list: status=%d body=%s", response.Code, response.Body.String())
	}
	health := httptest.NewRecorder()
	handler.ServeHTTP(health, httptest.NewRequest(http.MethodGet, "/livez", nil))
	if health.Code != http.StatusOK {
		t.Fatalf("external source must not stop governance liveness: %d", health.Code)
	}
}