import { expect, test } from "@playwright/test";
import { API_URL, registerVerifyLogin, uniqueEmail } from "../helpers/api";

test.describe("§15.7 scenario 8: IDOR", () => {
  test("user A cannot patch user B via admin route", async ({ request }) => {
    const userA = await registerVerifyLogin(request, uniqueEmail("e2e-a"));
    const userB = await registerVerifyLogin(request, uniqueEmail("e2e-b"));

    const forbidden = await request.patch(`${API_URL}/api/v1/admin/users/${userB.user.id}`, {
      headers: { Authorization: `Bearer ${userA.accessToken}` },
      data: { status: "blocked" }
    });
    expect(forbidden.status()).toBe(403);
  });
});