import assert from 'node:assert/strict';
import { buildApp } from '../dist/app.js';
import { signAccessToken } from '../dist/auth/jwt.js';

const secret = 'test-only-order-share-jwt-secret-32-chars';
const token = signAccessToken({
  sub: '21', sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
  tid: '7', aid: '9', rv: 1
}, secret, 900);
let createInput;
let resolveInput;
const shareToken = 'a'.repeat(43);
const app = await buildApp({
  orderShare: {
    jwtSecret: secret,
    authRepository: {
      async validateSession() {
        return {
          id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
          tenantId: '7', platformAppId: '9', expiresAt: new Date(Date.now() + 60000),
          user: {
            id: '21', tenantId: '7', userType: 'CUSTOMER', status: 'ACTIVE',
            roleVersion: 1, nickname: '', avatarUrl: '', phone: ''
          }
        };
      }
    },
    accessControl: {
      async getAccessProfile() {
        return { roles: ['CUSTOMER'], capabilities: ['order.self.read'], storeIds: [] };
      }
    },
    repository: {
      async create(input) {
        createInput = input;
        return {
          shareId: '41', token: shareToken,
          permissions: input.permissions ?? ['VIEW_ROOM', 'OPEN_DOOR']
        };
      },
      async revoke() { return { shareId: '41', revoked: true }; },
      async resolve(tokenValue, permission) {
        resolveInput = { tokenValue, permission };
        return {
          shareId: '41',
          order: {
            orderId: '31', orderNo: 'QP-SAFE', status: 'PAID',
            startAt: new Date(), endAt: new Date()
          },
          grantedPermission: permission
        };
      }
    }
  }
});

const created = await app.inject({
  method: 'POST',
  url: '/app-api/orders/31/shares',
  headers: { authorization: `Bearer ${token}` },
  payload: {}
});
assert.equal(created.statusCode, 201);
assert.equal(createInput.orderId, '31');
assert.deepEqual(created.json().data.permissions, ['VIEW_ROOM', 'OPEN_DOOR']);

const resolved = await app.inject({
  method: 'POST',
  url: `/app-api/order-shares/${shareToken}/resolve`,
  payload: { permission: 'OPEN_DOOR' }
});
assert.equal(resolved.statusCode, 200);
assert.deepEqual(resolveInput, { tokenValue: shareToken, permission: 'OPEN_DOOR' });
const response = JSON.stringify(resolved.json());
assert.doesNotMatch(response, /phone|balance|payment/i);

const invalidPermission = await app.inject({
  method: 'POST',
  url: `/app-api/order-shares/${shareToken}/resolve`,
  payload: { permission: 'ADMIN' }
});
assert.equal(invalidPermission.statusCode, 400);

await app.close();
console.log('PASS: M04-D routes provide minimal share permissions without private fields.');