package service

import (
	"database/sql"
	"errors"
	"testing"
	"time"

	"golang.org/x/crypto/bcrypt"

	"cmautobuy/admin/model"
	"cmautobuy/admin/repository"
)

func TestCreatePurchaser_固定角色且用户名不区分大小写唯一(t *testing.T) {
	db := newSyncTestDB(t)
	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
	admin := prepareAdminUser(t, db, now)
	if err := CreatePurchaser(db, admin, "buyer", "123456", "123456", now); err != nil {
		t.Fatalf("创建采购员失败: %v", err)
	}
	buyer, err := repository.FindUserByUsername(db, "BUYER")
	if err != nil {
		t.Fatal(err)
	}
	if buyer.Role != model.RolePurchaser || buyer.Status != model.UserActive {
		t.Fatalf("新账号角色或状态错误: %+v", buyer)
	}
	if buyer.PasswordHash == "123456" ||
		bcrypt.CompareHashAndPassword([]byte(buyer.PasswordHash), []byte("123456")) != nil {
		t.Fatal("采购员密码必须保存为可验证的 bcrypt 哈希")
	}
	if err := CreatePurchaser(db, admin, "BUYER", "other-password", "other-password", now); !errors.Is(err, repository.ErrUsernameExists) {
		t.Fatalf("大小写不同的重复用户名应被拒绝，实际 %v", err)
	}
}

func TestChangeUserStatus_禁用撤销全部Session且启用后可重新登录(t *testing.T) {
	db := newSyncTestDB(t)
	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
	admin := prepareAdminUser(t, db, now)
	if err := CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil {
		t.Fatal(err)
	}
	buyer, _ := repository.FindUserByUsername(db, "buyer")
	token, _, _, err := Login(db, "buyer", "buyer-password", now)
	if err != nil {
		t.Fatal(err)
	}
	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserDisabled, now.Add(time.Minute)); err != nil {
		t.Fatal(err)
	}
	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) {
		t.Fatalf("禁用后旧 Session 应失效，实际 %v", err)
	}
	if _, _, _, err := Login(db, "buyer", "buyer-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) {
		t.Fatalf("禁用账号不应登录，实际 %v", err)
	}
	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserActive, now.Add(3*time.Minute)); err != nil {
		t.Fatal(err)
	}
	if _, _, _, err := Login(db, "buyer", "buyer-password", now.Add(4*time.Minute)); err != nil {
		t.Fatalf("重新启用后应可登录: %v", err)
	}
}

func TestResetUserPassword_原子撤销Session并更换凭据(t *testing.T) {
	db := newSyncTestDB(t)
	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
	admin := prepareAdminUser(t, db, now)
	if err := CreatePurchaser(db, admin, "buyer", "old-password", "old-password", now); err != nil {
		t.Fatal(err)
	}
	buyer, _ := repository.FindUserByUsername(db, "buyer")
	token, _, _, _ := Login(db, "buyer", "old-password", now)
	if err := ResetUserPassword(db, admin, buyer.UserID, "654321", "654321", now.Add(time.Minute)); err != nil {
		t.Fatal(err)
	}
	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) {
		t.Fatalf("重置密码后旧 Session 应失效，实际 %v", err)
	}
	if _, _, _, err := Login(db, "buyer", "old-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) {
		t.Fatalf("旧密码应失效，实际 %v", err)
	}
	if _, _, _, err := Login(db, "buyer", "654321", now.Add(2*time.Minute)); err != nil {
		t.Fatalf("新密码应可登录: %v", err)
	}
}

func TestChangeUserStatus_最后管理员保护同时保留Session(t *testing.T) {
	db := newSyncTestDB(t)
	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
	admin := prepareAdminUser(t, db, now)
	token, _, _, err := Login(db, "admin", "admin-password", now)
	if err != nil {
		t.Fatal(err)
	}
	err = ChangeUserStatus(db, admin, admin.UserID, model.UserDisabled, now.Add(time.Minute))
	if !errors.Is(err, repository.ErrLastActiveAdmin) {
		t.Fatalf("禁用最后管理员应拒绝，实际 %v", err)
	}
	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); err != nil {
		t.Fatalf("失败事务不能撤销管理员 Session: %v", err)
	}
}

func TestUserManagement_采购员无权调用且搜索转义通配符(t *testing.T) {
	db := newSyncTestDB(t)
	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
	admin := prepareAdminUser(t, db, now)
	if err := CreatePurchaser(db, admin, "buyer%", "buyer-password", "buyer-password", now); err != nil {
		t.Fatal(err)
	}
	buyer, _ := repository.FindUserByUsername(db, "buyer%")
	result, err := ListUsers(db, admin, "%", "", 1)
	if err != nil {
		t.Fatal(err)
	}
	if result.Total != 1 || len(result.Rows) != 1 || result.Rows[0].Username != "buyer%" {
		t.Fatalf("搜索中的 %% 应按字面量处理: %+v", result)
	}
	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserDisabled, now); err != nil {
		t.Fatal(err)
	}
	disabled, err := ListUsers(db, admin, "", model.UserDisabled, 1)
	if err != nil || disabled.Total != 1 || disabled.Rows[0].Username != "buyer%" {
		t.Fatalf("禁用状态筛选错误: result=%+v err=%v", disabled, err)
	}
	if _, err := ListUsers(db, buyer, "", "", 1); !errors.Is(err, ErrAdminRequired) {
		t.Fatalf("采购员不应列出用户，实际 %v", err)
	}
	if err := CreatePurchaser(db, buyer, "other", "other-password", "other-password", now); !errors.Is(err, ErrAdminRequired) {
		t.Fatalf("采购员不应创建用户，实际 %v", err)
	}
}

func prepareAdminUser(t *testing.T, db *sql.DB, now time.Time) *model.User {
	t.Helper()
	if err := SetupInitialAdmin(db, "admin", "admin-password", "admin-password", now); err != nil {
		t.Fatalf("准备管理员失败: %v", err)
	}
	admin, err := repository.FindUserByUsername(db, "admin")
	if err != nil {
		t.Fatalf("读取管理员失败: %v", err)
	}
	return admin
}