<?php
// tests/test-auth.php — Verify unauthenticated requests are blocked
require_once __DIR__ . '/run.php';

$base = defined('TEST_BASE_URL') ? TEST_BASE_URL : 'http://localhost/supercerebro';

$endpoints = [
    'api/reports.php?action=list&client_id=1',
    'api/meta-data.php?action=overview&client_id=1',
    'api/tiktok-data.php?action=overview&client_id=1',
    'api/google-ads.php?action=campaigns&client_id=1',
    'api/avi.php',
];

foreach ($endpoints as $ep) {
    $url = "{$base}/{$ep}";
    $ch  = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_FOLLOWLOCATION => false,
        CURLOPT_TIMEOUT        => 10,
        CURLOPT_NOBODY         => false,
    ]);
    $raw  = curl_exec($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    $json = json_decode($raw, true);
    $blocked = ($code === 401 || $code === 302 || $code === 403)
            || ($json && isset($json['ok']) && $json['ok'] === false);

    dm_assert("Auth block: {$ep}", $blocked,
        "Expected 401/302/403 or ok:false, got HTTP {$code}");
}
