package auth

import (
	"path/filepath"
	"testing"
)

func TestAuthManager(t *testing.T) {
	tempDir := t.TempDir()
	dbPath := filepath.Join(tempDir, "users.json")

	mgr := NewManager(dbPath)

	// 1. Check default admin user exists
	users := mgr.ListUsers()
	if len(users) != 1 {
		t.Fatalf("expected 1 user, got %d", len(users))
	}
	if users[0].Username != "admin" || users[0].Role != RoleFull {
		t.Fatalf("unexpected admin user: %+v", users[0])
	}

	// 2. Authenticate admin with default credentials
	sess, err := mgr.Authenticate("admin", "admin")
	if err != nil {
		t.Fatalf("failed to authenticate default admin: %v", err)
	}
	if sess.Username != "admin" || sess.Role != RoleFull {
		t.Fatalf("unexpected session: %+v", sess)
	}

	// 3. Authenticate with wrong password
	if _, err := mgr.Authenticate("admin", "wrongpassword"); err != ErrInvalidCredentials {
		t.Fatalf("expected ErrInvalidCredentials, got %v", err)
	}

	// 4. Validate session
	valSess, err := mgr.ValidateSession(sess.Token)
	if err != nil {
		t.Fatalf("failed to validate valid session: %v", err)
	}
	if valSess.Username != "admin" {
		t.Fatalf("session username mismatch: %s", valSess.Username)
	}

	// 5. Create new user
	err = mgr.CreateUser(CreateUserRequest{
		Username: "operator",
		Password: "operatorpassword",
		Role:     RoleWrite,
		Comment:  "NOC operator",
	})
	if err != nil {
		t.Fatalf("failed to create user: %v", err)
	}

	// Authenticate new user
	opSess, err := mgr.Authenticate("operator", "operatorpassword")
	if err != nil {
		t.Fatalf("failed to authenticate operator: %v", err)
	}
	if opSess.Role != RoleWrite {
		t.Fatalf("expected RoleWrite, got %s", opSess.Role)
	}

	// 6. Change password
	err = mgr.ChangePassword("operator", "operatorpassword", "newpassword123", false)
	if err != nil {
		t.Fatalf("failed to change password: %v", err)
	}
	if _, err := mgr.Authenticate("operator", "newpassword123"); err != nil {
		t.Fatalf("failed to authenticate with new password: %v", err)
	}

	// 7. Cannot delete self
	if err := mgr.DeleteUser("admin", "admin"); err != ErrCannotDeleteSelf {
		t.Fatalf("expected ErrCannotDeleteSelf, got %v", err)
	}

	// 8. Delete user
	if err := mgr.DeleteUser("operator", "admin"); err != nil {
		t.Fatalf("failed to delete operator: %v", err)
	}
	if _, err := mgr.Authenticate("operator", "newpassword123"); err != ErrInvalidCredentials {
		t.Fatalf("deleted user should not be able to authenticate, got %v", err)
	}
}