package user

import (
	"bytes"
	"context"
	"encoding/base64"
	"strings"
	"testing"

	"git.golem15.com/golem15/sm-user-plugin/models"
	"git.golem15.com/golem15/summercms/modules/backpack"
	"git.golem15.com/golem15/summercms/modules/bonfire"
	"git.golem15.com/golem15/summercms/modules/pact"
	"gorm.io/gorm"
)

func TestRequirePasswordChange(t *testing.T) {
	app, gdb := sessionApp(t, "0s")
	user := insertUser(t, gdb, "alice@example.com", "correct-horse")
	p := &Plugin{app: app}
	var _ pact.HasCommands = p
	cmd := commandNamed(t, p.Commands(), "user:require-password-change")
	var buf bytes.Buffer
	out := bonfire.NewOutput(nil, &buf, &buf)
	if err := cmd.Run(context.Background(), emailArg{email: "alice@example.com"}, out); err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(buf.String(), "alice@example.com") {
		t.Fatalf("output = %q", buf.String())
	}
	var fresh models.User
	if err := gdb.First(&fresh, user.ID).Error; err != nil {
		t.Fatal(err)
	}
	if !fresh.MustChangePassword {
		t.Fatal("must_change_password stayed false")
	}
	if err := cmd.Run(context.Background(), emailArg{email: "missing@example.com"}, out); err == nil {
		t.Fatal("unknown email returned nil error")
	}
}

func TestAPITokenCreateCommand(t *testing.T) {
	app, gdb := sessionApp(t, "0s")
	user := insertUser(t, gdb, "pat@example.com", "correct-horse")
	cmd := commandNamed(t, (&Plugin{app: app}).Commands(), "user:token:create")
	var buf bytes.Buffer
	out := bonfire.NewOutput(nil, &buf, &buf)
	if err := cmd.Run(context.Background(), tokenCreateArg{email: user.Email, name: "rome scripts", scopes: "read,write"}, out); err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(buf.String(), "usr_") {
		t.Fatalf("secret missing from output %q", buf.String())
	}
	var n int64
	if err := gdb.Model(&models.APIToken{}).Where("user_id = ? AND revoked_at IS NULL", user.ID).Count(&n).Error; err != nil {
		t.Fatal(err)
	}
	if n != 1 {
		t.Fatalf("tokens = %d", n)
	}
}

func TestConsoleWithDBOpensFromConfigWhenUnpublished(t *testing.T) {
	p := &Plugin{app: backpack.New(sessionConfig(t))}
	err := p.withDB(context.Background(), func(*gorm.DB) error {
		t.Fatal("fn should not run without a DSN")
		return nil
	})
	if err == nil {
		t.Fatal("expected OpenFromApp to fail")
	}
	if strings.Contains(err.Error(), "database is not configured") {
		t.Fatalf("still the Lookup-only error: %v", err)
	}
	if !strings.Contains(err.Error(), "database.dsn is empty") {
		t.Fatalf("got %v", err)
	}
}

// TestBackfillHandlesOpensFromConfigWhenUnpublished runs user:backfill-handles
// as the console does: no published database, only database.dsn in the config.
func TestBackfillHandlesOpensFromConfigWhenUnpublished(t *testing.T) {
	_, gdb := sessionApp(t, "0s")
	user := insertUser(t, gdb, "backfill-unpublished@example.test", "correct-horse")
	if err := gdb.Model(user).Update("handle", nil).Error; err != nil {
		t.Fatal(err)
	}
	app := backpack.New(sessionConfig(t))
	if err := app.Config.Set("database.dsn", sessionDSN); err != nil {
		t.Fatal(err)
	}
	// Opening a database also loads the encryption keys from app.key.
	if err := app.Config.Set("app.key", base64.StdEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef"))); err != nil {
		t.Fatal(err)
	}
	if _, ok := app.Lookup[*gorm.DB](); ok {
		t.Fatal("setup: a database is published")
	}
	cmd := commandNamed(t, (&Plugin{app: app}).Commands(), "user:backfill-handles")
	var buf bytes.Buffer
	out := bonfire.NewOutput(nil, &buf, &buf)
	if err := cmd.Run(context.Background(), emailArg{}, out); err != nil {
		t.Fatalf("run: %v (output %q)", err, buf.String())
	}
	var fresh models.User
	if err := gdb.First(&fresh, user.ID).Error; err != nil {
		t.Fatal(err)
	}
	if fresh.Handle == nil || *fresh.Handle == "" {
		t.Fatal("the user still has no handle")
	}
}

func commandNamed(t *testing.T, cmds []bonfire.Command, name string) bonfire.Command {
	t.Helper()
	for _, candidate := range cmds {
		if candidate.Name == name {
			return candidate
		}
	}
	t.Fatalf("commands = %#v", cmds)
	return bonfire.Command{}
}

type emailArg struct{ email string }

func (e emailArg) Args() []string { return []string{e.email} }

func (e emailArg) Argument(name string) (string, bool) {
	if name == "email" {
		return e.email, true
	}
	return "", false
}

func (e emailArg) Flag(string) (string, bool) { return "", false }

func (e emailArg) Flags(string) []string { return nil }

type tokenCreateArg struct{ email, name, scopes string }

func (a tokenCreateArg) Args() []string { return []string{a.email} }

func (a tokenCreateArg) Argument(name string) (string, bool) {
	if name == "email" {
		return a.email, true
	}
	return "", false
}

func (a tokenCreateArg) Flag(name string) (string, bool) {
	switch name {
	case "name":
		return a.name, true
	case "scopes":
		return a.scopes, true
	default:
		return "", false
	}
}

func (a tokenCreateArg) Flags(string) []string { return nil }