package users_test

import (
	"context"
	"database/sql"
	"path/filepath"
	"testing"

	"inventree/internal/database"
	"inventree/internal/models"
	"inventree/internal/users"
)

func testDB(t *testing.T) *sql.DB {
	t.Helper()
	dir := t.TempDir()
	db, err := database.Open(filepath.Join(dir, "test.db"))
	if err != nil {
		t.Fatalf("open db: %v", err)
	}
	t.Cleanup(func() { db.Close() })
	return db
}

func TestDefaultAdminSeeded(t *testing.T) {
	ctx := context.Background()
	s := users.NewStore(testDB(t))

	u, err := s.Authenticate(ctx, "admin", "admin")
	if err != nil {
		t.Fatalf("authenticate default admin: %v", err)
	}
	if !u.IsAdmin() {
		t.Fatal("expected default admin to have admin role")
	}
}

func TestAuthenticateRejectsBadPassword(t *testing.T) {
	s := users.NewStore(testDB(t))
	if _, err := s.Authenticate(context.Background(), "admin", "wrong"); err == nil {
		t.Fatal("expected authentication to fail")
	}
}

func TestCreateUserRejectsDuplicateUsername(t *testing.T) {
	ctx := context.Background()
	s := users.NewStore(testDB(t))

	u := &models.User{Username: "admin", Role: models.RoleUser, Enabled: true}
	if err := s.Create(ctx, u, "whatever"); err != users.ErrUsernameTaken {
		t.Fatalf("expected ErrUsernameTaken, got %v", err)
	}
}

func TestCannotRemoveLastAdmin(t *testing.T) {
	ctx := context.Background()
	s := users.NewStore(testDB(t))

	admin, err := s.GetByUsername(ctx, "admin")
	if err != nil {
		t.Fatalf("get admin: %v", err)
	}

	if err := s.Delete(ctx, admin.ID); err != users.ErrLastAdmin {
		t.Fatalf("expected ErrLastAdmin on delete, got %v", err)
	}

	admin.Enabled = false
	if err := s.Update(ctx, admin); err != users.ErrLastAdmin {
		t.Fatalf("expected ErrLastAdmin on disable, got %v", err)
	}

	admin.Role = models.RoleUser
	admin.Enabled = true
	if err := s.Update(ctx, admin); err != users.ErrLastAdmin {
		t.Fatalf("expected ErrLastAdmin on demote, got %v", err)
	}
}

func TestSecondAdminAllowsRemovingFirst(t *testing.T) {
	ctx := context.Background()
	s := users.NewStore(testDB(t))

	second := &models.User{Username: "second-admin", Role: models.RoleAdmin, Enabled: true}
	if err := s.Create(ctx, second, "password123"); err != nil {
		t.Fatalf("create second admin: %v", err)
	}

	admin, err := s.GetByUsername(ctx, "admin")
	if err != nil {
		t.Fatalf("get admin: %v", err)
	}
	if err := s.Delete(ctx, admin.ID); err != nil {
		t.Fatalf("expected delete to succeed with a second admin present: %v", err)
	}
}