import { expect, test } from "bun:test";
import { assignInitialRole } from "../src/server/auth";
import { syncClaimGroups, groupsFromClaims } from "../src/server/auth/groups";
import { forEachDb } from "./helpers";
import { cookieFrom, makeApp } from "./app";

forEachDb("first sign-up becomes owner, later ones learners", async (db) => {
  const t = await makeApp(db);
  const ownerCookie = await t.signUp("owner@example.com");
  const me = await (await t.call("GET", "/api/me", { cookie: ownerCookie })).json();
  expect(me.user.email).toBe("owner@example.com");
  expect(me.user.roles).toEqual(["owner"]);
  const second = await t.signUp("learner@example.com");
  expect((await (await t.call("GET", "/api/me", { cookie: second })).json()).user.roles).toEqual(["learner"]);
  expect((await (await t.call("GET", "/api/me")).json()).user).toBeNull();
}, 20_000);

forEachDb("sign in with password and sign out", async (db) => {
  const t = await makeApp(db);
  await t.signUp("a@example.com", "A", "pw-123456789");
  const bad = await t.call("POST", "/api/auth/sign-in/email", { body: { email: "a@example.com", password: "nope-nope-nope" } });
  expect(bad.status).toBe(401);
  const ok = await t.call("POST", "/api/auth/sign-in/email", { body: { email: "a@example.com", password: "pw-123456789" } });
  expect(ok.status).toBe(200);
  const cookie = cookieFrom(ok);
  expect((await (await t.call("GET", "/api/me", { cookie })).json()).user.name).toBe("A");
  const out = await t.call("POST", "/api/auth/sign-out", { cookie, body: {} });
  expect(out.status).toBe(200);
  // the session row is gone: the old token no longer resolves once the cookie cache is dropped
  const sessionOnly = cookie.split("; ").filter((c) => !c.includes("session_data")).join("; ");
  expect((await (await t.call("GET", "/api/me", { cookie: sessionOnly })).json()).user).toBeNull();
}, 20_000);

forEachDb("owner claim is exclusive under concurrency", async (db) => {
  const roles = await Promise.all(["u1", "u2", "u3", "u4"].map((u) => assignInitialRole(db, u)));
  expect(roles.filter((r) => r === "owner").length).toBe(1);
});

forEachDb("SSO provider administration is owner-only", async (db) => {
  const t = await makeApp(db);
  await t.signUp("owner@example.com");
  const learner = await t.signUp("l@example.com");
  expect((await t.call("POST", "/api/auth/sso/register", { cookie: learner, body: {} })).status).toBe(403);
  expect((await t.call("POST", "/api/auth/sso/register", { body: {} })).status).toBe(403);
}, 20_000);

forEachDb("claim groups sync keeps manual memberships", async (db) => {
  await db.sql`INSERT INTO groups (id, name) VALUES ('staff', 'Staff')`;
  await db.sql`INSERT INTO group_members (group_id, user_id) VALUES ('staff', 'u1')`;
  await syncClaimGroups(db, "u1", ["Staff", "DevOps Team"]);
  const ids = async () => (await db.sql`SELECT group_id FROM group_members WHERE user_id = 'u1' ORDER BY group_id`).map((r: { group_id: string }) => r.group_id);
  expect(await ids()).toEqual(["devops-team", "staff"]);
  await syncClaimGroups(db, "u1", []);
  expect(await ids()).toEqual(["staff"]); // manual one stays, claim one goes
});

test("groupsFromClaims reads arrays and strings", () => {
  expect(groupsFromClaims({ groups: ["a", "b", "a"] })).toEqual(["a", "b"]);
  expect(groupsFromClaims({ roles: "x, y" }, "roles")).toEqual(["x", "y"]);
  expect(groupsFromClaims({ extraFields: { groups: ["z"] } })).toEqual(["z"]);
  expect(groupsFromClaims(null)).toEqual([]);
});