import { GUARDS_METADATA } from '@nestjs/common/constants';
import { AuthController } from './auth.controller';
import { AuthRegisterLoginDto } from './dto/auth-register-login.dto';

describe('AuthController session enforcement', () => {
  it('protects GET auth/me with JWT validation', () => {
    const guards = Reflect.getMetadata(
      GUARDS_METADATA,
      AuthController.prototype.me,
    );

    expect(guards).toBeDefined();
    expect(guards).toHaveLength(1);
  });

  it('does not expose self-deletion that can race with an admin promotion', () => {
    expect(AuthController.prototype).not.toHaveProperty('delete');
  });

  it('uses the narrow validated registration DTO instead of an untyped body', () => {
    const parameterTypes = Reflect.getMetadata(
      'design:paramtypes',
      AuthController.prototype,
      'register',
    );

    expect(parameterTypes[0]).toBe(AuthRegisterLoginDto);
    expect(AuthRegisterLoginDto.prototype).not.toHaveProperty('linkPlayerId');
  });
});
