import { afterAll, beforeAll, describe, expect, it } from "vitest";
import { createHarness, type Harness, pgAvailable } from "./harness.ts";

// FIX-8 站点账号凭证:同类账号更新时密码 / Cookie / API Key 留空 = 保持,TOTP 省略保持、null 清除;
// 新账号或换类型时必须填。明文不出 API。

const up = await pgAvailable();

// biome-ignore lint/suspicious/noExplicitAny: 响应体断言
const json = async (r: Response): Promise<any> => {
  const body = await r.json();
  if (!r.ok) throw new Error(`${r.status} ${JSON.stringify(body)}`);
  return body.data;
};

describe.skipIf(!up)("站点凭证留空不变 / 显式清除", () => {
  let h: Harness;
  let siteId: string;
  const put = (body: unknown) => h.req(`/sites/${siteId}/credentials`, { method: "PUT", body });
  const account = () =>
    h.db
      .selectFrom("site_account")
      .selectAll()
      .where("site_id", "=", siteId)
      .where("label", "=", "default")
      .executeTakeFirstOrThrow();

  beforeAll(async () => {
    h = await createHarness("credkeep");
    const site = await json(
      await h.req("/sites", {
        body: { key: "audiences", name: "观众", adapter: "nexusphp", baseUrl: "http://127.0.0.1:1/" },
      }),
    );
    siteId = site.id;
  }, 60_000);
  afterAll(async () => {
    await h?.close();
  });

  it("新账号不填密码 → 422", async () => {
    expect((await put({ kind: "password", username: "alice" })).status).toBe(422);
    expect((await put({ kind: "password", username: "alice", password: "  " })).status).toBe(422);
  });

  it("账密:改登录名不填密码 = 保持密码与 TOTP;null 清除 TOTP", async () => {
    const r = await json(await put({ kind: "password", username: "alice", password: "pw-1", totpSecret: "JBSWY3DP" }));
    expect(JSON.stringify(r)).not.toContain("pw-1");
    const a1 = await account();
    expect(h.secrets.plain.get(a1.secret_ref!)).toBe("pw-1");
    expect(a1.totp_secret_ref).toBeTruthy();

    await json(await put({ kind: "password", username: "alice2", password: "", userAgent: "UA/1" }));
    const a2 = await account();
    expect(a2.secret_ref).toBe(a1.secret_ref);
    expect(h.secrets.plain.get(a2.secret_ref!)).toBe("pw-1");
    expect(a2.totp_secret_ref).toBe(a1.totp_secret_ref);
    expect(a2.login_name).toBe("alice2");
    expect(a2.user_agent).toBe("UA/1");

    await json(await put({ kind: "password", username: "alice2", totpSecret: null }));
    const a3 = await account();
    expect(a3.totp_secret_ref).toBeNull();
    expect(h.secrets.plain.get(a3.secret_ref!)).toBe("pw-1");
    expect(h.secrets.plain.has(a1.totp_secret_ref!)).toBe(false);

    await json(await put({ kind: "password", username: "alice2", password: "pw-2" }));
    expect(h.secrets.plain.get((await account()).secret_ref!)).toBe("pw-2");
  });

  it("换类型必须填新凭证;同类 Cookie / API Key 留空保持", async () => {
    expect((await put({ kind: "cookie" })).status).toBe(422);
    await json(await put({ kind: "cookie", cookie: "a=1" }));
    const c1 = await account();
    await json(await put({ kind: "cookie", cookie: "", userAgent: "UA/2" }));
    const c2 = await account();
    expect(c2.secret_ref).toBe(c1.secret_ref);
    expect(h.secrets.plain.get(c2.secret_ref!)).toBe("a=1");

    expect((await put({ kind: "api_key", apiKey: "" })).status).toBe(422);
    await json(await put({ kind: "api_key", apiKey: "k-1" }));
    const k1 = await account();
    await json(await put({ kind: "api_key" }));
    expect(h.secrets.plain.get((await account()).secret_ref!)).toBe("k-1");
    expect((await account()).secret_ref).toBe(k1.secret_ref);
  });
});