import assert from 'node:assert/strict';
import { buildApp } from '../dist/app.js';
import { signAccessToken } from '../dist/auth/jwt.js';
import { maskIp, maskPhone, UserManagementRepository } from '../dist/auth/user-management-repository.js';

assert.equal(maskPhone('13800138000'), '138****8000');
assert.equal(maskIp('192.168.10.22'), '192.168.*.*');

const calls = [];
const connection = {
  async beginTransaction() { calls.push('begin'); },
  async commit() { calls.push('commit'); },
  async rollback() { calls.push('rollback'); },
  release() { calls.push('release'); },
  async execute(sql) {
    calls.push(sql);
    if (sql.includes('SELECT u.id')) return [[{ id: '22' }], []];
    return [{ affectedRows: 1, insertId: 22 }, []];
  }
};
const repository = new UserManagementRepository({
  async getConnection() { return connection; },
  async execute() { return [[], []]; }
});
const actor = {
  tenantId: '7',
  userId: '21',
  access: { roles: ['TENANT_ADMIN'], capabilities: ['tenant.manage'], storeIds: [] },
  traceId: 'trace-test',
  ip: '127.0.0.1',
  userAgent: 'test'
};
await repository.updateUser(actor, '22', {
  status: 'DISABLED',
  roles: ['STAFF'],
  storeIds: ['11'],
  note: '离职'
});
assert.ok(calls.some((sql) => typeof sql === 'string' && sql.includes('qipai_audit_logs')));
assert.ok(calls.some((sql) => typeof sql === 'string' && sql.includes("revoke_reason = 'ACCESS_CHANGED'")));
assert.ok(calls.includes('commit'));

const secret = 'test-only-jwt-secret-with-at-least-32-characters';
const token = signAccessToken({
  sub: '21',
  sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
  tid: '7',
  aid: '9',
  rv: 1
}, secret, 900);
let createdInput;
let listedInput;
let updatedInput;
const app = await buildApp({
  userManagement: {
    jwtSecret: secret,
    authRepository: {
      async validateSession() {
        return {
          id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
          tenantId: '7',
          platformAppId: '9',
          expiresAt: new Date(Date.now() + 60_000),
          user: {
            id: '21', tenantId: '7', userType: 'STAFF', status: 'ACTIVE',
            roleVersion: 1, nickname: '管理员', avatarUrl: '', phone: '13800138000'
          }
        };
      }
    },
    accessControl: {
      async getAccessProfile() {
        return { roles: ['TENANT_ADMIN'], capabilities: ['tenant.manage'], storeIds: [] };
      }
    },
    repository: {
      async listUsers(input) {
        listedInput = input;
        return { items: [], total: 0 };
      },
      async createStaff(_actor, input) {
        createdInput = input;
        return { userId: '22' };
      },
      async updateUser(_actor, _userId, input) {
        updatedInput = input;
        return { userId: '22' };
      },
      async resetSessions() { return { userId: '22', revokedSessions: 2 }; }
    }
  }
});
const created = await app.inject({
  method: 'POST',
  url: '/admin-api/staff',
  headers: { authorization: `Bearer ${token}` },
  payload: {
    nickname: '测试员工',
    phone: '13800138001',
    roles: ['STAFF'],
    storeIds: ['11']
  }
});
assert.equal(created.statusCode, 201);
assert.equal(created.json().data.userId, '22');
assert.deepEqual(createdInput.storeIds, ['11']);

const cleaners = await app.inject({
  method: 'GET',
  url: '/admin-api/users?role=CLEANER&status=ACTIVE&search=%E4%BF%9D%E6%B4%81',
  headers: { authorization: `Bearer ${token}` }
});
assert.equal(cleaners.statusCode, 200);
assert.equal(listedInput.role, 'CLEANER');
assert.equal(listedInput.status, 'ACTIVE');
assert.equal(listedInput.search, '保洁');

const updated = await app.inject({
  method: 'PATCH',
  url: '/admin-api/users/22',
  headers: { authorization: `Bearer ${token}` },
  payload: {
    nickname: '保洁一号',
    phone: '13800138009',
    roles: ['CLEANER'],
    storeIds: ['11'],
    note: '夜班'
  }
});
assert.equal(updated.statusCode, 200);
assert.equal(updatedInput.phone, '13800138009');
assert.deepEqual(updatedInput.roles, ['CLEANER']);

const unauthenticated = await app.inject({ method: 'GET', url: '/admin-api/users' });
assert.equal(unauthenticated.statusCode, 401);
await app.close();

console.log('PASS: M02-D staff management, session revocation, audit and masked fields are present.');