package integration

import (
	"context"
	"errors"
	"testing"

	"git.sundynix.cn/Blizzard/Veyra/internal/apperror"
	"git.sundynix.cn/Blizzard/Veyra/internal/repository"
	"git.sundynix.cn/Blizzard/Veyra/internal/service"
	"github.com/jackc/pgx/v5/pgxpool"
)

func testDevelopmentUserCredentialChange(t *testing.T, ctx context.Context, pool *pgxpool.Pool, auth *service.AuthService) {
	t.Helper()
	user, err := auth.ProvisionUser(ctx, "maintenance_user", "a-maintenance-password", "Maintenance", "USER")
	if err != nil {
		t.Fatal(err)
	}
	session, err := auth.Login(ctx, "maintenance_user", "a-maintenance-password", "app")
	if err != nil {
		t.Fatal(err)
	}
	repo := repository.NewIdentityRepository(pool)
	updater := service.NewDevelopmentUserCredentialService(repo, true)
	if _, err := service.NewDevelopmentUserCredentialService(repo, false).Set(ctx, "maintenance_user", "maintenance_new", "tiny"); !errors.Is(err, apperror.ErrForbidden) {
		t.Fatal("production maintenance allowed")
	}
	if _, err := updater.Set(ctx, "operator", "maintenance_new", "tiny"); !errors.Is(err, apperror.ErrForbidden) {
		t.Fatal("administrator changed through USER command")
	}
	if _, err := updater.Set(ctx, "maintenance_user", "maintenance_new", "abc"); !errors.Is(err, apperror.ErrInvalidInput) {
		t.Fatal("invalid password accepted")
	}
	if _, err := updater.Set(ctx, "maintenance_user", "bob", "tiny"); !errors.Is(err, apperror.ErrConflict) {
		t.Fatal("duplicate login accepted")
	}
	if _, err := auth.Authenticate(ctx, session.Token, "app"); err != nil {
		t.Fatal("failed change revoked session")
	}
	id, err := updater.Set(ctx, "maintenance_user", "maintenance_new", "tiny")
	if err != nil || id != user.ID {
		t.Fatal("user identity not preserved")
	}
	if _, err := auth.Authenticate(ctx, session.Token, "app"); !errors.Is(err, apperror.ErrUnauthenticated) {
		t.Fatal("old session remained valid")
	}
	if _, err := auth.Login(ctx, "maintenance_user", "a-maintenance-password", "app"); !errors.Is(err, apperror.ErrUnauthenticated) {
		t.Fatal("old credentials remained valid")
	}
	login, err := auth.Login(ctx, "maintenance_new", "tiny", "app")
	if err != nil || login.User.ID != user.ID {
		t.Fatal("new credentials failed")
	}
	if _, err := auth.Login(ctx, "maintenance_new", "tiny", "admin"); !errors.Is(err, apperror.ErrUnauthenticated) && !errors.Is(err, apperror.ErrForbidden) {
		t.Fatal("USER authenticated as administrator")
	}
	_, credential, err := repo.FindCredential(ctx, "maintenance_new")
	if err != nil || credential.PasswordHash == "tiny" {
		t.Fatal("password stored without hashing")
	}
}