import { test, expect } from '@playwright/test'

test.describe('admin page access control', () => {
  test('admin page redirects or shows forbidden without auth', async ({ page }) => {
    const criticalErrors: string[] = []
    page.on('pageerror', err => {
      if (err.message.includes('ReferenceError') || err.message.includes('SyntaxError')) {
        criticalErrors.push(err.message)
      }
    })

    await page.goto('/admin')
    await page.waitForTimeout(2000)

    // Should not crash
    expect(criticalErrors).toHaveLength(0)

    // Should either show forbidden/unauthorized message or redirect away
    const url = page.url()
    const content = await page.textContent('body')

    // Valid outcomes: redirected to login/home, or shows forbidden
    const isRedirected = !url.includes('/admin')
    const showsForbidden = content?.match(/forbidden|unauthorized|not authorized|403|login/i) !== null
    const isEmptyAdmin = content?.trim().length === 0 || content?.includes('Loading')

    // At least one of these should be true
    expect(isRedirected || showsForbidden || isEmptyAdmin).toBe(true)
  })
})