import { waitForLatestOtc, clearMailpit } from './mailpit.js'

// Sign in through the §6.2 OTC path, leaving the rfc_session cookie on the
// page's browser context (page.request shares the page context's cookie jar,
// so a subsequent page.goto is authenticated). The Tier-1 seed pre-provisions
// `e2e-owner@example.test` as a granted deployment owner, so signing in as that
// address yields write access to the metadata edit/bulk paths (SLICE-4/5).
export async function signIn(page, email) {
  await clearMailpit()
  const req = await page.request.post('/auth/otc/request', { data: { email } })
  if (!req.ok()) throw new Error(`otc request failed: ${req.status()}`)
  const code = await waitForLatestOtc(email)
  const verify = await page.request.post('/auth/otc/verify', { data: { email, code } })
  if (!verify.ok()) throw new Error(`otc verify failed: ${verify.status()}`)
}

export const OWNER_EMAIL = 'e2e-owner@example.test'