import assert from 'node:assert/strict';
import { buildApp } from '../dist/app.js';
import { signAccessToken } from '../dist/auth/jwt.js';

const secret = 'test-only-platform-management-secret-32';
const token = signAccessToken({ sub: '21', sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e', tid: '7', aid: '9', rv: 1 }, secret, 900);
const config = {
  brandName: '七号棋牌', logoUrl: '', themeColor: '#1677ff', servicePhone: '4000000000',
  franchisePhone: '', shareTitle: '七号棋牌', shareImageUrl: '', defaultStoreId: '11',
  extraConfig: { bookingMode: 'STANDARD' }, bindingStatus: 'ACTIVE', isDefault: true
};
let updateInput;
let bindInput;
const app = await buildApp({
  platformManagement: {
    jwtSecret: secret,
    authRepository: { async validateSession() { return { id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e', tenantId: '7', platformAppId: '9', expiresAt: new Date(Date.now() + 60000), user: { id: '21', tenantId: '7', userType: 'STAFF', status: 'ACTIVE', roleVersion: 1, nickname: '', avatarUrl: '', phone: '' } }; } },
    accessControl: { async getAccessProfile() { return { roles: ['PLATFORM_ADMIN'], capabilities: ['platform.manage', 'tenant.manage'], storeIds: [] }; } },
    repository: {
      async listTenantApps(tenantId) { return [{ platformAppId: '9', appId: 'wx-test-app', tenantId }]; },
      async updateTenantConfig(_actor, appId, input) { updateInput = input; return { platformAppId: appId, updated: true }; },
      async bindApplication(_actor, input) { bindInput = input; return { platformAppId: '10', bound: true }; }
    }
  }
});

const listed = await app.inject({ method: 'GET', url: '/admin-api/platform-apps', headers: { authorization: `Bearer ${token}` } });
assert.equal(listed.statusCode, 200);
assert.equal(listed.json().data[0].appId, 'wx-test-app');
const updated = await app.inject({ method: 'PUT', url: '/admin-api/platform-apps/9/config', headers: { authorization: `Bearer ${token}` }, payload: config });
assert.equal(updated.statusCode, 200);
assert.equal(updateInput.defaultStoreId, '11');
const bound = await app.inject({ method: 'POST', url: '/admin-api/platform-apps/bind', headers: { authorization: `Bearer ${token}` }, payload: { appId: 'wx-new-app', appName: '新小程序', appStatus: 'ACTIVE', config } });
assert.equal(bound.statusCode, 201);
assert.equal(bindInput.appId, 'wx-new-app');
assert.equal('appSecret' in bindInput, false);
await app.close();
console.log('PASS: M08-D platform application management enforces scoped configuration without secrets.');