import assert from "node:assert/strict";
import test from "node:test";
import { prepareAccounts, localAccounts } from "../prepare-local-e2e-accounts.mjs";

const input = { origin: "http://127.0.0.1:12345", databaseName: "hyb_oa_webgate_synthetic", initialPassword: "Initial!synthetic-only-123456789" };

test("preparation refuses remote origins, wrong database and reused initial credentials before any request", async () => {
  for (const change of [{ origin: "https://example.invalid" }, { origin: "http://127.0.0.1:1/api" },
    { databaseName: "production" }, { initialPassword: localAccounts[0].password }]) {
    let calls = 0;
    await assert.rejects(prepareAccounts({ ...input, ...change, fetchImpl: async () => { calls++; } }));
    assert.equal(calls, 0);
  }
});

test("all roles must really require change, reject old password and login again; receipts contain no credentials", async () => {
  const calls = [];
  const result = await prepareAccounts({ ...input, fetchImpl: async (url, request) => {
    const step = calls.length % 4;
    calls.push({ url, body: JSON.parse(request.body) });
    assert.equal(request.redirect, "error");
    assert.equal(new URL(url).pathname, step === 1 ? "/api/auth/change-password" : "/api/auth/login");
    if (step === 1) assert.equal(request.headers.authorization, "Bearer synthetic");
    return { status: step === 2 ? 401 : 200, json: async () => ({ data: { accessToken: "synthetic", mustChangePassword: step === 0 } }) };
  } });
  assert.equal(calls.length, localAccounts.length * 4);
  assert.equal(result.accounts.length, 8);
  assert.ok(!JSON.stringify(result).includes(input.initialPassword));
  assert.ok(localAccounts.every(a => !JSON.stringify(result).includes(a.password)));
});

test("one false precondition stops before changing any further account", async () => {
  for (const failingStep of [0, 1, 2, 3]) {
    let calls = 0;
    await assert.rejects(prepareAccounts({ ...input, fetchImpl: async () => {
      const step = calls++;
      return { status: step === failingStep ? 503 : step === 2 ? 401 : 200,
        json: async () => ({ data: { accessToken: "synthetic", mustChangePassword: step === 0 } }) };
    } }));
    assert.equal(calls, failingStep + 1);
  }
});