const Fastify = require("fastify");

const usersRoutes = require("../../../src/routes/users");
const { AppError } = require("../../../src/utils/AppError");

const ACTOR_ID = "11111111-1111-4111-8111-111111111111";
const DEPARTMENT_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
const USER_ID = "22222222-2222-4222-8222-222222222222";
const MANAGER_ID = "33333333-3333-4333-8333-333333333333";

async function buildApp({
  createdEmployeeNo = "HYD000001",
  currentEmployee = null,
  actor = {
    id: ACTOR_ID,
    department_id: DEPARTMENT_ID,
    roleCodes: ["system_admin"],
    permissionCodes: ["system.accounts.manage", "system.roles.manage"],
  },
  currentRoles = ["employee"],
} = {}) {
  const app = Fastify();

  const departmentFindUnique = vi.fn().mockResolvedValue({
    id: DEPARTMENT_ID,
    archived_at: null,
  });
  const employeeCreate = vi.fn(async ({ data }) => ({
    id: USER_ID,
    employee_no: data.employee_no ?? createdEmployeeNo,
    name: data.name,
    phone: data.phone,
    email: data.email,
    status: data.status,
    department_id: data.department_id,
    title: data.title,
    direct_manager_id: data.direct_manager_id ?? null,
    hire_date: data.hire_date,
    created_at: data.created_at,
    updated_at: data.updated_at,
  }));
  const employeeFindUnique = vi
    .fn()
    .mockResolvedValue(
      currentEmployee ?? {
        id: USER_ID,
        employee_no: "HYD000321",
        name: "Alice",
        phone: "13800000000",
        email: "alice@example.com",
        status: "active",
        department_id: DEPARTMENT_ID,
        title: "员工",
        direct_manager_id: null,
        hire_date: new Date("2026-05-01T00:00:00.000Z"),
        bank_account_encrypted: "",
        bank_name: "",
        id_number_encrypted: null,
        archived_at: null,
        created_at: new Date("2026-05-01T00:00:00.000Z"),
        updated_at: new Date("2026-05-01T00:00:00.000Z"),
        roles: [{ role_code: "employee" }],
      },
    );
  const employeeUpdate = vi.fn(async ({ data }) => ({
    ...(currentEmployee ?? {
      id: USER_ID,
      employee_no: "HYD000321",
      name: "Alice",
      phone: "13800000000",
      email: "alice@example.com",
      status: "active",
      department_id: DEPARTMENT_ID,
      title: "员工",
      direct_manager_id: null,
      hire_date: new Date("2026-05-01T00:00:00.000Z"),
      archived_at: null,
      created_at: new Date("2026-05-01T00:00:00.000Z"),
      updated_at: new Date("2026-05-01T00:00:00.000Z"),
      roles: [{ role_code: "employee" }],
      wecom_identity_binding: null,
      wecom_directory_sync_runs: [],
    }),
    ...data,
  }));
  const employeeRoleCreateMany = vi.fn().mockResolvedValue({ count: 1 });
  const employeeRoleFindMany = vi.fn().mockResolvedValue(currentRoles.map((role_code) => ({ role_code })));
  const employeeRoleDeleteMany = vi.fn().mockResolvedValue({ count: currentRoles.length });
  const auditCreate = vi.fn().mockResolvedValue({ id: "audit-1" });
  const authSessionUpdateMany = vi.fn().mockResolvedValue({ count: 0 });
  const passwordResetCodeUpdateMany = vi.fn().mockResolvedValue({ count: 0 });
  const emailLoginCodeUpdateMany = vi.fn().mockResolvedValue({ count: 0 });
  const lifecycleEventCreate = vi.fn().mockResolvedValue({ id: "lifecycle-1" });
  const checklistTaskCreateMany = vi.fn().mockResolvedValue({ count: 1 });
  const wecomSyncRunCreate = vi.fn().mockResolvedValue({ id: "sync-run-1" });
  const queryRaw = vi.fn(async (strings, employeeId) => {
    const sql = Array.isArray(strings) ? strings.join(" ") : String(strings ?? "");
    if (sql.includes('FROM "employee_roles"')) {
      return currentRoles.map((role_code) => ({ role_code }));
    }
    if (sql.includes('FROM "employees"')) {
      return [{ id: employeeId }];
    }
    return [];
  });

  const tx = {
    department: {
      findUnique: departmentFindUnique,
    },
    employee: {
      create: employeeCreate,
      findUnique: employeeFindUnique,
      update: employeeUpdate,
    },
    employeeRole: {
      createMany: employeeRoleCreateMany,
      deleteMany: employeeRoleDeleteMany,
    },
    employeeLifecycleEvent: {
      create: lifecycleEventCreate,
    },
    employeeChecklistTask: {
      createMany: checklistTaskCreateMany,
    },
    auditLog: {
      create: auditCreate,
    },
    authSession: {
      updateMany: authSessionUpdateMany,
    },
    passwordResetCode: {
      updateMany: passwordResetCodeUpdateMany,
    },
    emailLoginCode: {
      updateMany: emailLoginCodeUpdateMany,
    },
    $queryRaw: queryRaw,
  };

  app.decorate("config", { employeeLifecycleEnabled: true });
  app.decorate("prisma", {
    department: {
      findUnique: departmentFindUnique,
    },
    employee: {
      findUnique: employeeFindUnique,
    },
    employeeRole: {
      findMany: employeeRoleFindMany,
    },
    featureFlag: {
      findUnique: vi.fn().mockResolvedValue({
        id: "flag-employee-lifecycle",
        flag_key: "employee_lifecycle_v1",
        override_mode: "force_on",
        rollout_type: "global",
        department_ids: [],
        version: 1,
      }),
    },
    $transaction: vi.fn(async (callback) => callback(tx)),
  });
  app.decorate("requirePermission", (permissionCode) => async (request) => {
    request.employee = actor;
    const permissions = request.employee.permissionCodes ?? [];
    if (!permissions.includes("*") && !permissions.includes(permissionCode)) {
      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
    }
  });
  app.decorate("authenticate", async (request) => {
    request.employee = actor;
  });
  app.decorate("hasPermission", (employee, permissionCode) => {
    const permissions = employee?.permissionCodes ?? [];
    return permissions.includes("*") || permissions.includes(permissionCode);
  });
  app.setErrorHandler((error, request, reply) => {
    if (error instanceof AppError) {
      return reply.status(error.statusCode).send({
        requestId: request.id,
        error: { code: error.code, message: error.message, details: error.details ?? {} },
      });
    }
    return reply.status(500).send({
      requestId: request.id,
      error: { code: error.code ?? "SYS_001", message: error.message ?? "服务器内部错误", details: error.details ?? {} },
    });
  });

  await app.register(usersRoutes, { prefix: "/api" });

  return {
    app,
    departmentFindUnique,
    employeeCreate,
    employeeFindUnique,
    employeeUpdate,
    employeeRoleCreateMany,
    employeeRoleFindMany,
    employeeRoleDeleteMany,
    auditCreate,
    authSessionUpdateMany,
    passwordResetCodeUpdateMany,
    emailLoginCodeUpdateMany,
    lifecycleEventCreate,
    checklistTaskCreateMany,
    wecomSyncRunCreate,
    queryRaw,
  };
}

describe("usersRoutes write flows", () => {
  it("creates a user without employeeNo or password and returns generated credentials", async () => {
    const { app, employeeCreate, employeeRoleCreateMany } = await buildApp();

    const response = await app.inject({
      method: "POST",
      url: "/api/users",
      payload: {
        name: "张三",
        phone: "13800000001",
        email: "ZhangSan@Example.COM",
        roles: ["employee"],
        syncWecomDirectory: false,
      },
    });

    expect(response.statusCode).toBe(200);
    expect(employeeCreate).toHaveBeenCalledWith(
      expect.objectContaining({
        data: expect.objectContaining({ email: "zhangsan@example.com" }),
      }),
    );
    expect(employeeCreate.mock.calls[0][0].data).not.toHaveProperty("employee_no");
    expect(employeeRoleCreateMany).toHaveBeenCalledWith(
      expect.objectContaining({
        data: [
          expect.objectContaining({
            employee_id: USER_ID,
            role_code: "employee",
          }),
        ],
      }),
    );

    const payload = response.json().data;
    expect(payload).toEqual(
      expect.objectContaining({
        id: USER_ID,
        employeeNo: "HYD000001",
        name: "张三",
        email: "zhangsan@example.com",
        roleCodes: ["employee"],
      }),
    );
    expect(payload.oneTimePassword).toMatch(/^ResetA1[a-f0-9]{12}$/);

    await app.close();
  });

  it("creates a user with a null phone when the field is omitted", async () => {
    const { app, employeeCreate } = await buildApp();

    const response = await app.inject({
      method: "POST",
      url: "/api/users",
      payload: {
        name: "暂缺手机号成员",
        email: "no-phone@example.com",
        roles: ["employee"],
        syncWecomDirectory: false,
      },
    });

    expect(response.statusCode).toBe(200);
    expect(employeeCreate).toHaveBeenCalledWith(expect.objectContaining({
      data: expect.objectContaining({ phone: null }),
    }));

    await app.close();
  });

  it("allows an administrator to explicitly clear an existing phone to null", async () => {
    const { app, employeeUpdate } = await buildApp();

    const response = await app.inject({
      method: "PATCH",
      url: `/api/users/${USER_ID}`,
      payload: { phone: null },
    });

    expect(response.statusCode).toBe(200);
    expect(employeeUpdate).toHaveBeenCalledWith(expect.objectContaining({
      data: expect.objectContaining({ phone: null }),
    }));

    await app.close();
  });

  it("rejects employeeNo changes on patch", async () => {
    const { app, employeeFindUnique, employeeUpdate } = await buildApp();

    const response = await app.inject({
      method: "PATCH",
      url: `/api/users/${USER_ID}`,
      payload: {
        employeeNo: "HYD999999",
        name: "李四",
      },
    });

    expect(response.statusCode).toBe(409);
    expect(response.json().error).toEqual(
      expect.objectContaining({
        code: "VALID_001",
        details: { employeeNo: "immutable" },
      }),
    );
    expect(employeeFindUnique).not.toHaveBeenCalled();
    expect(employeeUpdate).not.toHaveBeenCalled();

    await app.close();
  });

  it("prevents a system administrator from creating protected administrator roles", async () => {
    const { app, departmentFindUnique, employeeCreate } = await buildApp();

    const response = await app.inject({
      method: "POST",
      url: "/api/users",
      payload: {
        name: "受限账号",
        phone: "13800000002",
        email: "restricted@example.com",
        roles: ["employee", "system_admin"],
      },
    });

    expect(response.statusCode).toBe(403);
    expect(response.json().error.details).toEqual({ role: "protected_role_change_not_allowed" });
    expect(departmentFindUnique).not.toHaveBeenCalled();
    expect(employeeCreate).not.toHaveBeenCalled();

    await app.close();
  });

  it("prevents a system administrator from granting or revoking protected roles before mutation", async () => {
    const grantApp = await buildApp();
    const grantResponse = await grantApp.app.inject({
      method: "POST",
      url: `/api/users/${USER_ID}/roles`,
      payload: { roles: ["employee", "admin"] },
    });

    expect(grantResponse.statusCode).toBe(403);
    expect(grantApp.employeeRoleDeleteMany).not.toHaveBeenCalled();
    expect(grantApp.employeeRoleCreateMany).not.toHaveBeenCalled();
    await grantApp.app.close();

    const revokeApp = await buildApp({ currentRoles: ["employee", "system_admin"] });
    const revokeResponse = await revokeApp.app.inject({
      method: "POST",
      url: `/api/users/${USER_ID}/roles`,
      payload: { roles: ["employee"] },
    });

    expect(revokeResponse.statusCode).toBe(403);
    expect(revokeApp.employeeRoleDeleteMany).not.toHaveBeenCalled();
    expect(revokeApp.employeeRoleCreateMany).not.toHaveBeenCalled();
    await revokeApp.app.close();
  });

  it("prevents a system administrator from changing their own business roles before lookup", async () => {
    const testApp = await buildApp();

    const response = await testApp.app.inject({
      method: "POST",
      url: `/api/users/${ACTOR_ID}/roles`,
      payload: { roles: ["employee", "manager", "system_admin"] },
    });

    expect(response.statusCode).toBe(403);
    expect(response.json().error.details).toEqual({ user: "self_role_change_not_allowed" });
    expect(testApp.employeeRoleFindMany).not.toHaveBeenCalled();
    expect(testApp.employeeRoleDeleteMany).not.toHaveBeenCalled();
    expect(testApp.employeeRoleCreateMany).not.toHaveBeenCalled();

    await testApp.app.close();
  });

  it.each([
    {
      name: "批量调部门",
      url: "/api/users/batch/transfer-department",
      payload: { employeeIds: [USER_ID], departmentId: DEPARTMENT_ID },
    },
    {
      name: "批量设直属经理",
      url: "/api/users/batch/set-manager",
      payload: { employeeIds: [USER_ID], managerId: MANAGER_ID },
    },
    {
      name: "批量停用",
      url: "/api/users/batch/disable",
      payload: { employeeIds: [USER_ID] },
    },
    {
      name: "批量启用",
      url: "/api/users/batch/enable",
      payload: { employeeIds: [USER_ID] },
    },
  ])("rejects $name when any target has a protected role before all writes", async ({ url, payload }) => {
    const testApp = await buildApp({ currentRoles: ["employee", "system_admin"] });

    const response = await testApp.app.inject({ method: "POST", url, payload });

    expect(response.statusCode).toBe(403);
    expect(response.json().error.details).toEqual({ user: "protected_account_not_manageable" });
    expect(testApp.queryRaw).toHaveBeenCalledTimes(2);
    expect(testApp.employeeUpdate).not.toHaveBeenCalled();
    expect(testApp.lifecycleEventCreate).not.toHaveBeenCalled();
    expect(testApp.checklistTaskCreateMany).not.toHaveBeenCalled();
    expect(testApp.authSessionUpdateMany).not.toHaveBeenCalled();
    expect(testApp.auditCreate).not.toHaveBeenCalled();
    expect(testApp.wecomSyncRunCreate).not.toHaveBeenCalled();

    await testApp.app.close();
  });

  it.each([
    { name: "更新账号", method: "PATCH", path: "", payload: { name: "受保护账号" } },
    { name: "归档账号", method: "POST", path: "/archive" },
    { name: "停用账号", method: "POST", path: "/disable" },
    { name: "启用账号", method: "POST", path: "/enable" },
    { name: "解锁账号", method: "POST", path: "/unlock" },
  ])("rejects $name for a protected target before account side effects", async ({ method, path, payload }) => {
    const testApp = await buildApp({ currentRoles: ["employee", "admin"] });

    const response = await testApp.app.inject({
      method,
      url: `/api/users/${USER_ID}${path}`,
      ...(payload ? { payload } : {}),
    });

    expect(response.statusCode).toBe(403);
    expect(response.json().error.details).toEqual({ user: "protected_account_not_manageable" });
    expect(testApp.employeeUpdate).not.toHaveBeenCalled();
    expect(testApp.authSessionUpdateMany).not.toHaveBeenCalled();
    expect(testApp.auditCreate).not.toHaveBeenCalled();
    expect(testApp.wecomSyncRunCreate).not.toHaveBeenCalled();

    await testApp.app.close();
  });

  it("allows an emergency administrator to assign system_admin with before/after role audit", async () => {
    const testApp = await buildApp({
      actor: {
        id: ACTOR_ID,
        department_id: DEPARTMENT_ID,
        roleCodes: ["admin"],
        permissionCodes: ["*"],
      },
    });

    const response = await testApp.app.inject({
      method: "POST",
      url: `/api/users/${USER_ID}/roles`,
      payload: { roles: ["employee", "system_admin"] },
    });

    expect(response.statusCode).toBe(200);
    expect(testApp.employeeRoleDeleteMany).toHaveBeenCalledTimes(1);
    expect(testApp.auditCreate).toHaveBeenCalledWith({
      data: expect.objectContaining({
        action: "SYSTEM_USER_ROLES_SET",
        extra: {
          beforeRoleCodes: ["employee"],
          afterRoleCodes: ["employee", "system_admin"],
        },
      }),
    });

    await testApp.app.close();
  });

  it("prevents a system administrator from resetting a protected account", async () => {
    const testApp = await buildApp({ currentRoles: ["employee", "admin"] });

    const response = await testApp.app.inject({
      method: "POST",
      url: `/api/users/${USER_ID}/reset-password`,
      payload: { newPassword: "AdministratorReset1234" },
    });

    expect(response.statusCode).toBe(403);
    expect(response.json().error.details).toEqual({ user: "protected_account_not_manageable" });
    expect(testApp.employeeUpdate).not.toHaveBeenCalled();
    expect(testApp.authSessionUpdateMany).not.toHaveBeenCalled();
    expect(testApp.auditCreate).not.toHaveBeenCalled();

    await testApp.app.close();
  });

  it("revokes sessions and outstanding challenges during an administrator password reset", async () => {
    const {
      app,
      employeeUpdate,
      authSessionUpdateMany,
      passwordResetCodeUpdateMany,
      emailLoginCodeUpdateMany,
      auditCreate,
    } = await buildApp();

    const response = await app.inject({
      method: "POST",
      url: `/api/users/${USER_ID}/reset-password`,
      payload: { newPassword: "AdministratorReset1234" },
    });

    expect(response.statusCode).toBe(200);
    expect(response.json().data).toEqual({
      id: USER_ID,
      oneTimePassword: "AdministratorReset1234",
    });
    expect(employeeUpdate).toHaveBeenCalledWith({
      where: { id: USER_ID },
      data: expect.objectContaining({
        must_change_password: true,
        token_version: { increment: 1 },
        email_login_code_failed_count: 0,
        password_reset_failed_count: 0,
        password_reset_request_count: 0,
      }),
    });
    expect(authSessionUpdateMany).toHaveBeenCalledWith({
      where: { employee_id: USER_ID, revoked_at: null },
      data: { revoked_at: expect.any(Date), last_seen_at: expect.any(Date) },
    });
    expect(passwordResetCodeUpdateMany).toHaveBeenCalledWith({
      where: { employee_id: USER_ID, invalidated_at: null },
      data: { invalidated_at: expect.any(Date) },
    });
    expect(emailLoginCodeUpdateMany).toHaveBeenCalledWith({
      where: { employee_id: USER_ID, used_at: null },
      data: { used_at: expect.any(Date) },
    });
    expect(auditCreate).toHaveBeenCalledWith({
      data: expect.objectContaining({ action: "SYSTEM_USER_PASSWORD_RESET" }),
    });

    await app.close();
  });
});