package auth

import (
	"bytes"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"

	"gitea.perlbach24.de/scripte/nexarch/internal/user"
)

// Akzeptanzkriterium 2: Passwortaenderung verlangt das aktuelle Passwort.
func TestChangePassword_RequiresCurrentPassword(t *testing.T) {
	pool := setupTenantDB(t, "changepw_test_wrong")
	store := user.NewTenantUserStore(pool)
	u := createUserWithPassword(t, store, "nutzer@example.com", "altes-passwort")

	issuer := NewTokenIssuer("test-session-secret")
	sessionToken, err := issuer.Issue(u.ID, "acme")
	if err != nil {
		t.Fatalf("session-token ausstellen: %v", err)
	}

	h := NewChangePasswordHandler(store)
	body, _ := json.Marshal(map[string]string{"current_password": "falsches-altes-passwort", "new_password": "neues-passwort"})
	req := httptest.NewRequest(http.MethodPost, "/account/change-password", bytes.NewReader(body))
	req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionToken})
	rec := httptest.NewRecorder()

	RequireAuth(issuer, h.ChangePassword)(rec, req)

	if rec.Code != http.StatusBadRequest {
		t.Fatalf("status = %d, want 400 (falsches aktuelles passwort)", rec.Code)
	}

	creds, err := store.GetByIDForAuth(req.Context(), u.ID)
	if err != nil {
		t.Fatalf("credentials laden: %v", err)
	}
	if !VerifyPassword(creds.PasswordHash, "altes-passwort") {
		t.Fatal("passwort haette NICHT geaendert werden duerfen")
	}
}

func TestChangePassword_SucceedsWithCorrectCurrentPassword(t *testing.T) {
	pool := setupTenantDB(t, "changepw_test_ok")
	store := user.NewTenantUserStore(pool)
	u := createUserWithPassword(t, store, "nutzer2@example.com", "altes-passwort")

	issuer := NewTokenIssuer("test-session-secret")
	sessionToken, err := issuer.Issue(u.ID, "acme")
	if err != nil {
		t.Fatalf("session-token ausstellen: %v", err)
	}

	h := NewChangePasswordHandler(store)
	body, _ := json.Marshal(map[string]string{"current_password": "altes-passwort", "new_password": "neues-sicheres-passwort"})
	req := httptest.NewRequest(http.MethodPost, "/account/change-password", bytes.NewReader(body))
	req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionToken})
	rec := httptest.NewRecorder()

	RequireAuth(issuer, h.ChangePassword)(rec, req)

	if rec.Code != http.StatusOK {
		t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
	}

	creds, err := store.GetByIDForAuth(req.Context(), u.ID)
	if err != nil {
		t.Fatalf("credentials laden: %v", err)
	}
	if !VerifyPassword(creds.PasswordHash, "neues-sicheres-passwort") {
		t.Fatal("neues passwort wurde nicht uebernommen")
	}
}