import assert from 'node:assert/strict';
import { buildApp } from '../dist/app.js';
import { signAccessToken } from '../dist/auth/jwt.js';

const secret = 'test-only-pricing-jwt-secret-with-32-characters';
const token = signAccessToken({
  sub: '21',
  sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
  tid: '7',
  aid: '9',
  rv: 1
}, secret, 900);
let reserveInput;
const app = await buildApp({
  pricing: {
    jwtSecret: secret,
    authRepository: {
      async validateSession() {
        return {
          id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
          tenantId: '7',
          platformAppId: '9',
          expiresAt: new Date(Date.now() + 60000),
          user: {
            id: '21',
            tenantId: '7',
            userType: 'CUSTOMER',
            status: 'ACTIVE',
            roleVersion: 1,
            nickname: '',
            avatarUrl: '',
            phone: ''
          }
        };
      }
    },
    accessControl: {
      async getAccessProfile() {
        return { roles: ['CUSTOMER'], capabilities: [], storeIds: [] };
      }
    },
    repository: {
      async quote() {
        return { totalCents: 2500, depositCents: 500 };
      },
      async reserve(input) {
        reserveInput = input;
        return { orderId: '31', reservationId: '41', quote: { totalCents: 2500 } };
      },
      async releaseExpired() {
        return { released: 0 };
      }
    }
  }
});

const startAt = new Date(Date.now() + 3600000);
const endAt = new Date(startAt.getTime() + 7200000);
const reserved = await app.inject({
  method: 'POST',
  url: '/app-api/orders/reserve',
  headers: { authorization: `Bearer ${token}` },
  payload: {
    roomId: '11',
    startAt: startAt.toISOString(),
    endAt: endAt.toISOString(),
    pricingMode: 'HOURLY',
    benefits: {
      couponGrantId: '401',
      packageHoldingId: '501',
      packageMinutes: 60,
      packageCreditCents: 2000,
      clientRequestId: 'benefit-route-0001'
    },
    totalCents: 1,
    discountCents: 999999
  }
});
assert.equal(reserved.statusCode, 201);
assert.equal(reserveInput.tenantId, '7');
assert.equal(reserveInput.userId, '21');
assert.equal('totalCents' in reserveInput, false);
assert.equal('discountCents' in reserveInput, false);
assert.deepEqual(reserveInput.benefits, {
  couponGrantId: '401',
  packageHoldingId: '501',
  packageMinutes: 60,
  packageCreditCents: 2000,
  clientRequestId: 'benefit-route-0001'
});

const unauthenticated = await app.inject({
  method: 'POST',
  url: '/app-api/pricing/quote',
  payload: {
    roomId: '11',
    startAt: startAt.toISOString(),
    endAt: endAt.toISOString()
  }
});
assert.equal(unauthenticated.statusCode, 401);
await app.close();

console.log('PASS: M04-A pricing routes ignore client totals and require an authenticated session.');