import { Test } from '@nestjs/testing';
import type { INestApplication } from '@nestjs/common';
import request from 'supertest';

process.env.SAPB1_SL_URL ??= 'https://sap.invalid:50000/b1s/v1';
process.env.SAPB1_SL_COMPANYDB ??= 'DB';
process.env.SAPB1_SL_USER ??= 'u';
process.env.SAPB1_SL_PASSWORD ??= 'p';

const EMPLOYEES = [
  { EmployeeID: 7, FirstName: 'Ana', LastName: 'Pérez', Active: 'tYES', U_WEB_USER: 'ana', U_WEB_PASS: 'secreto' },
];

describe('Auth (e2e, SAP simulado)', () => {
  let app: INestApplication;

  beforeEach(async () => {
    const { AppModule } = await import('../src/app.module.js');
    const { SapClientService } = await import('../src/sap/sap-client.service.js');
    const { SapSessionService } = await import('../src/sap/sap-session.service.js');
    const moduleRef = await Test.createTestingModule({ imports: [AppModule] })
      .overrideProvider(SapClientService)
      .useValue({
        get: async (_path: string, q: { $filter: string }) => ({
          data: { value: q.$filter === "U_WEB_USER eq 'ana'" ? EMPLOYEES : [] },
        }),
      })
      .overrideProvider(SapSessionService)
      .useValue({ getSession: async () => ({}), status: () => ({ connected: true }), onModuleDestroy: () => undefined })
      .compile();
    app = moduleRef.createNestApplication();
    app.setGlobalPrefix('api');
    await app.init();
  });

  afterEach(async () => {
    await app.close();
  });

  const login = (username: string, password: string) =>
    request(app.getHttpServer()).post('/api/auth/login').send({ username, password });

  it('/health es público, /health/sap exige sesión', async () => {
    await request(app.getHttpServer()).get('/api/health').expect(200);
    await request(app.getHttpServer()).get('/api/health/sap').expect(401);
  });

  it('flujo completo: login -> me -> ruta protegida -> logout -> 401', async () => {
    const res = await login('ana', 'secreto').expect(200);
    expect(res.body.user).toMatchObject({ webUser: 'ana', empId: 7, firstName: 'Ana' });
    expect(JSON.stringify(res.body)).not.toContain('secreto');
    const auth = { Authorization: `Bearer ${res.body.token}` };

    const me = await request(app.getHttpServer()).get('/api/auth/me').set(auth).expect(200);
    expect(me.body.user.webUser).toBe('ana');
    await request(app.getHttpServer()).get('/api/health/sap').set(auth).expect(200);

    await request(app.getHttpServer()).post('/api/auth/logout').set(auth).expect(204);
    await request(app.getHttpServer()).get('/api/auth/me').set(auth).expect(401);
  });

  it('un segundo login invalida el token del primero', async () => {
    const t1 = (await login('ana', 'secreto').expect(200)).body.token;
    const t2 = (await login('ana', 'secreto').expect(200)).body.token;
    await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', `Bearer ${t1}`).expect(401);
    await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', `Bearer ${t2}`).expect(200);
  });

  it('credenciales inválidas -> 401 y cuerpo inválido -> 400', async () => {
    await login('ana', 'mala').expect(401);
    await login('nadie', 'x').expect(401);
    await request(app.getHttpServer()).post('/api/auth/login').send({ username: 'ana' }).expect(400);
  });

  it('sin token o con token falso -> 401', async () => {
    await request(app.getHttpServer()).get('/api/auth/me').expect(401);
    await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', 'Bearer falso').expect(401);
  });

  it('tras 5 intentos fallidos responde 429', async () => {
    for (let i = 0; i < 5; i++) await login('ana', 'mala').expect(401);
    await login('ana', 'secreto').expect(429);
  });
});