package auth_test

import (
	"context"
	"testing"

	"chat-agent-system/internal/auth"
	"chat-agent-system/internal/config"
)

func TestPasswordCrypto(t *testing.T) {
	password := "SecretPass123"
	hash, err := auth.HashPassword(password)
	if err != nil {
		t.Fatalf("HashPassword failed: %v", err)
	}
	if hash == "" || hash == password {
		t.Fatalf("Invalid hash generated: %s", hash)
	}

	if !auth.CheckPassword(hash, password) {
		t.Errorf("CheckPassword should return true for matching password")
	}

	if auth.CheckPassword(hash, "WrongPass") {
		t.Errorf("CheckPassword should return false for incorrect password")
	}
}

func TestAuthStoreMemory_Operations(t *testing.T) {
	cfg := &config.Config{
		AdminUsername:           "superadmin",
		AdminPassword:           "admin-test-pass-999",
		AuthRegistrationEnabled: true,
		AuthRequireApproval:     false,
	}

	store := auth.NewMemoryStore(cfg)
	ctx := context.Background()

	// 1. Verify default admin account exists
	admin, err := store.GetUserByUsername(ctx, "superadmin")
	if err != nil {
		t.Fatalf("Failed to get admin user: %v", err)
	}
	if admin.RoleID != "role-admin" {
		t.Errorf("Expected admin role 'role-admin', got %s", admin.RoleID)
	}
	if !auth.CheckPassword(admin.PasswordHash, "admin-test-pass-999") {
		t.Errorf("Admin password hash mismatch")
	}

	// 2. Create standard user
	user1 := &auth.UserAccount{
		Username:           "engineer_zhang",
		Name:               "张工",
		RoleID:             "role-engineer",
		Position:           "方案工程师",
		Department:         "研发中心",
		EmployeeID:         "RD-001",
		Status:             auth.StatusActive,
		MustChangePassword: false,
	}
	hashed, _ := auth.HashPassword("InitialPass1")
	user1.PasswordHash = hashed

	created, err := store.CreateUser(ctx, user1)
	if err != nil {
		t.Fatalf("CreateUser failed: %v", err)
	}
	if created.ID == 0 {
		t.Errorf("Created user ID should be assigned, got 0")
	}

	// 3. Duplicate username should fail
	_, err = store.CreateUser(ctx, user1)
	if err == nil {
		t.Errorf("Expected error on duplicate username, got nil")
	}

	// 4. Update Role and Position
	updated, err := store.UpdateUserRole(ctx, created.ID, "role-director", "研发总监")
	if err != nil {
		t.Fatalf("UpdateUserRole failed: %v", err)
	}
	if updated.RoleID != "role-director" || updated.Position != "研发总监" {
		t.Errorf("Role update failed: %+v", updated)
	}

	// 5. Update Status
	statusUpdated, err := store.UpdateUserStatus(ctx, created.ID, auth.StatusDisabled)
	if err != nil {
		t.Fatalf("UpdateUserStatus failed: %v", err)
	}
	if statusUpdated.Status != auth.StatusDisabled {
		t.Errorf("Expected status disabled, got %s", statusUpdated.Status)
	}

	// 6. Update Password and clear MustChangePassword
	newHash, _ := auth.HashPassword("NewBrandPass123")
	passUpdated, err := store.UpdateUserPassword(ctx, created.ID, newHash, false)
	if err != nil {
		t.Fatalf("UpdateUserPassword failed: %v", err)
	}
	if passUpdated.MustChangePassword {
		t.Errorf("MustChangePassword should be false")
	}
	if !auth.CheckPassword(passUpdated.PasswordHash, "NewBrandPass123") {
		t.Errorf("Updated password check failed")
	}

	// 7. Config get and update
	sysCfg, err := store.GetConfig(ctx)
	if err != nil {
		t.Fatalf("GetConfig failed: %v", err)
	}
	if !sysCfg.AllowRegistration || sysCfg.RequireApproval {
		t.Errorf("Initial config mismatch: %+v", sysCfg)
	}

	err = store.UpdateConfig(ctx, auth.SystemAuthConfig{
		AllowRegistration: false,
		RequireApproval:   true,
	})
	if err != nil {
		t.Fatalf("UpdateConfig failed: %v", err)
	}

	sysCfgAfter, _ := store.GetConfig(ctx)
	if sysCfgAfter.AllowRegistration || !sysCfgAfter.RequireApproval {
		t.Errorf("Updated config mismatch: %+v", sysCfgAfter)
	}
}