import { UsersController } from './users.controller';
import { ForbiddenException } from '@nestjs/common';

describe('UsersController admin mutation isolation', () => {
  it('does not expose generic create, update, or delete handlers that bypass safeguards', () => {
    expect(UsersController.prototype).not.toHaveProperty('create');
    expect(UsersController.prototype).not.toHaveProperty('update');
    expect(UsersController.prototype).not.toHaveProperty('remove');
    expect(UsersController.prototype).not.toHaveProperty('findAll');
    expect(UsersController.prototype).not.toHaveProperty('findOne');
  });

  it('restricts team bootstrap to the authenticated user id', async () => {
    const service = { findMyTeams: jest.fn(() => []) };
    const controller = new UsersController(service as any);
    const request = { user: { id: 7, role: { id: 2 } } };

    expect(() => (controller as any).findTeamsOfPlayer(request, 8)).toThrow(
      ForbiddenException,
    );
    await (controller as any).findTeamsOfPlayer(request, 7);

    expect(service.findMyTeams).toHaveBeenCalledWith(7);
  });
});
