package service_test

import (
	"testing"

	"github.com/pingcap/agent-git-service/internal/db"
	"github.com/pingcap/agent-git-service/internal/testharness"
)

func TestLookupOIDCIdentityWithIDToken(t *testing.T) {
	t.Run("LinkedIdentity", func(t *testing.T) {
		idToken := mustJWT(t, map[string]any{
			"sub":                "oidc|linked-subject",
			"email":              "linked@example.com",
			"preferred_username": "oidc-user",
		})
		svc, tenantHandle, cleanup := setupTestServiceWithConfig(t, testharness.ServiceConfig{
			OIDC: fakeOIDCProvider{
				issuer:   "https://example.oidc.com/",
				clientID: "test-client-id",
				idToken:  idToken,
			},
		})
		defer cleanup()

		user := db.User{Login: "oidc-user", Name: "OIDC User", Type: db.TypeUser}
		if err := tenantHandle.DB().Create(&user).Error; err != nil {
			t.Fatalf("create user: %v", err)
		}
		if err := tenantHandle.DB().Create(&db.UserIdentity{
			UserID:   user.ID,
			Provider: "test-oidc",
			Subject:  "oidc|linked-subject",
		}).Error; err != nil {
			t.Fatalf("create identity: %v", err)
		}

		result, err := svc.LookupOIDCIdentityWithIDToken(tenantHandle.Context(), idToken)
		if err != nil {
			t.Fatalf("LookupOIDCIdentityWithIDToken failed: %v", err)
		}
		if !result.Linked {
			t.Fatal("expected linked result")
		}
		if result.User.ID != user.ID {
			t.Fatalf("expected user ID %d, got %d", user.ID, result.User.ID)
		}
	})
}