import assert from 'node:assert/strict';
import { buildApp } from '../dist/app.js';
import { signAccessToken } from '../dist/auth/jwt.js';

const secret = 'test-only-order-state-jwt-secret-32-chars';
const token = signAccessToken({
  sub: '21', sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
  tid: '7', aid: '9', rv: 1
}, secret, 900);
let transitionInput;
const options = {
  jwtSecret: secret,
  authRepository: {
    async validateSession() {
      return {
        id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
        tenantId: '7', platformAppId: '9',
        expiresAt: new Date(Date.now() + 60000),
        user: {
          id: '21', tenantId: '7', userType: 'ADMIN', status: 'ACTIVE',
          roleVersion: 1, nickname: '', avatarUrl: '', phone: ''
        }
      };
    }
  },
  accessControl: {
    async getAccessProfile() {
      return { roles: ['TENANT_ADMIN'], capabilities: ['tenant.manage'], storeIds: [] };
    }
  },
  repository: {
    async transition(actor, orderId, action, reason) {
      transitionInput = { actor, orderId, action, reason };
      return { orderId, status: action === 'CANCEL' ? 'CANCELLED' : 'PAID' };
    },
    async history() { return []; }
  }
};
const app = await buildApp({ orderState: options });

const rejectedTarget = await app.inject({
  method: 'POST',
  url: '/admin-api/orders/31/actions',
  headers: { authorization: `Bearer ${token}` },
  payload: { action: 'CONFIRM_PAYMENT', targetStatus: 'FINISHED' }
});
assert.equal(rejectedTarget.statusCode, 400);

const transitioned = await app.inject({
  method: 'POST',
  url: '/admin-api/orders/31/actions',
  headers: {
    authorization: `Bearer ${token}`,
    'x-trace-id': 'm04b-route-transition'
  },
  payload: { action: 'CONFIRM_PAYMENT', reason: 'sanitized callback rehearsal' }
});
assert.equal(transitioned.statusCode, 200);
assert.equal(transitionInput.orderId, '31');
assert.equal(transitionInput.action, 'CONFIRM_PAYMENT');
assert.equal(transitionInput.actor.source, 'ADMIN');
assert.equal(transitionInput.actor.traceId, 'm04b-route-transition');

const cancelled = await app.inject({
  method: 'POST',
  url: '/app-api/orders/31/cancel',
  headers: { authorization: `Bearer ${token}` },
  payload: { reason: 'customer changed plans' }
});
assert.equal(cancelled.statusCode, 200);
assert.equal(transitionInput.action, 'CANCEL');
assert.equal(transitionInput.actor.source, 'APP');

await app.close();
console.log('PASS: M04-B routes accept business actions and reject direct target statuses.');