package auth_test

import (
	"context"
	"errors"
	"strings"
	"testing"

	"chat-agent-system/internal/auth"
	"chat-agent-system/internal/config"
)

// failRoleStore wraps MemoryStore and forces UpdateUserRole to fail.
type failRoleStore struct {
	*auth.MemoryStore
	failRole bool
}

func (s *failRoleStore) UpdateUserRole(ctx context.Context, id int64, roleID, position string) (*auth.UserAccount, error) {
	if s.failRole {
		return nil, errors.New("forced UpdateUserRole failure")
	}
	return s.MemoryStore.UpdateUserRole(ctx, id, roleID, position)
}

func TestBootstrapAdminFromConfig_PromotesExistingUserToAdmin(t *testing.T) {
	cfg := &config.Config{
		AdminUsername: "opsadmin",
		AdminPassword: "bootstrap-pass-999",
		Env:           "dev",
	}
	base := auth.NewMemoryStore(&config.Config{Env: "dev", AdminUsername: "other", AdminPassword: "x"})
	ctx := context.Background()
	created, err := base.CreateUser(ctx, &auth.UserAccount{
		Username:     "opsadmin",
		Name:         "临时账号",
		PasswordHash: "hash",
		Status:       auth.StatusActive,
		RoleID:       "role-guest",
		Position:     "访客/待指派",
		EmployeeID:   "TMP-1",
	})
	if err != nil {
		t.Fatalf("CreateUser: %v", err)
	}
	if created.RoleID == "role-admin" {
		t.Fatal("precondition: seed must not already be role-admin")
	}

	if err := auth.BootstrapAdminFromConfig(ctx, base, cfg); err != nil {
		t.Fatalf("BootstrapAdminFromConfig: %v", err)
	}
	got, err := base.GetUserByUsername(ctx, "opsadmin")
	if err != nil {
		t.Fatal(err)
	}
	if got.RoleID != "role-admin" {
		t.Fatalf("want role-admin after bootstrap, got %s", got.RoleID)
	}
	if got.Position != "系统管理员" {
		t.Fatalf("want 系统管理员 position, got %s", got.Position)
	}
}

func TestBootstrapAdminFromConfig_UpdateUserRoleErrorNotSwallowed(t *testing.T) {
	cfg := &config.Config{
		AdminUsername: "opsadmin2",
		AdminPassword: "bootstrap-pass-999",
		Env:           "dev",
	}
	base := auth.NewMemoryStore(&config.Config{Env: "dev", AdminUsername: "other", AdminPassword: "x"})
	ctx := context.Background()
	_, err := base.CreateUser(ctx, &auth.UserAccount{
		Username:     "opsadmin2",
		Name:         "临时账号",
		PasswordHash: "hash",
		Status:       auth.StatusActive,
		RoleID:       "role-guest",
		Position:     "访客/待指派",
		EmployeeID:   "TMP-2",
	})
	if err != nil {
		t.Fatalf("CreateUser: %v", err)
	}

	wrapped := &failRoleStore{MemoryStore: base, failRole: true}
	err = auth.BootstrapAdminFromConfig(ctx, wrapped, cfg)
	if err == nil {
		t.Fatal("expected BootstrapAdminFromConfig to surface UpdateUserRole error")
	}
	if !strings.Contains(err.Error(), "UpdateUserRole") {
		t.Fatalf("error should mention UpdateUserRole, got %v", err)
	}
}