//go:build integration

package packs

import (
	"context"
	"database/sql"
	"fmt"
	"os"
	"testing"

	_ "github.com/go-sql-driver/mysql"
)

// TestSeedSystemPermissionsIdempotency_ApiEnabledStandardUser is a Lane B
// triple-test (idempotency probe) for issue #427.
//
// Verifies that calling SeedSystemPermissions (which performs INSERT IGNORE
// into _System_PermissionSetPermission for declared defaultGrantedTo audiences)
// produces exactly one ApiEnabled grant row for the standard_user
// profile's backing PermissionSet, and that running it N times never
// creates duplicate rows (INSERT IGNORE + UNIQUE KEY on (PermissionSetId,
// PermissionApiName) guarantee this).
//
// Run with: TIDB_HOST=127.0.0.1 TIDB_PORT=4001 TIDB_DATABASE=nexuscrm_pillar4_ssot \
//
//	go test -count=1 -tags integration ./internal/controlplane/packs/ -run TestSeedSystemPermissionsIdempotency_ApiEnabledStandardUser -v
func TestSeedSystemPermissionsIdempotency_ApiEnabledStandardUser(t *testing.T) {
	host := getEnvOrDefault("TIDB_HOST", "127.0.0.1")
	port := getEnvOrDefault("TIDB_PORT", "4001")
	user := getEnvOrDefault("TIDB_USER", "root")
	pass := getEnvOrDefault("TIDB_PASSWORD", "")
	dbName := getEnvOrDefault("TIDB_DATABASE", "nexuscrm_pillar4_ssot")

	var dsn string
	if pass != "" {
		dsn = fmt.Sprintf("%s:%s@tcp(%s:%s)/%s?parseTime=true", user, pass, host, port, dbName)
	} else {
		dsn = fmt.Sprintf("%s@tcp(%s:%s)/%s?parseTime=true", user, host, port, dbName)
	}

	db, err := sql.Open("mysql", dsn)
	if err != nil {
		t.Fatalf("open db: %v", err)
	}
	defer db.Close()

	if err := db.Ping(); err != nil {
		t.Skipf("DB not reachable (%v) — skipping integration test", err)
	}

	ctx := context.Background()

	countQuery := `
		SELECT COUNT(*) FROM _System_PermissionSetPermission psp
		JOIN PermissionSet ps ON psp.PermissionSetId = ps.Id
		WHERE ps.ProfileId = 'standard_user' AND ps.IsOwnedByProfile = 1
		  AND psp.PermissionApiName = 'ApiEnabled'`

	var pre int
	if err := db.QueryRowContext(ctx, countQuery).Scan(&pre); err != nil {
		t.Fatalf("pre-run count: %v", err)
	}
	t.Logf("Pre-run count: %d", pre)

	for run := 1; run <= 3; run++ {
		if err := SeedSystemPermissions(ctx, db); err != nil {
			t.Fatalf("SeedSystemPermissions run %d: %v", run, err)
		}
		var count int
		if err := db.QueryRowContext(ctx, countQuery).Scan(&count); err != nil {
			t.Fatalf("count after run %d: %v", run, err)
		}
		t.Logf("After run %d: ApiEnabled grant count for standard_user = %d", run, count)
		if count != 1 {
			t.Errorf("after run %d: want 1 ApiEnabled grant for standard_user, got %d", run, count)
		}
	}
}

func getEnvOrDefault(key, def string) string {
	if v := os.Getenv(key); v != "" {
		return v
	}
	return def
}