package server

import (
	"context"
	"path/filepath"
	"testing"
	"time"

	"github.com/glebarez/sqlite"
	"github.com/stretchr/testify/require"
	"gorm.io/gorm"

	"github.com/tidbcloud/AgentTeam/internal/service/repotokens"
	"github.com/tidbcloud/AgentTeam/internal/service/resource/repos"
	store "github.com/tidbcloud/AgentTeam/internal/store/repotokens"
)

func TestRepositorySyncTokenIssuerUsesMeshXCredentialAuthority(t *testing.T) {
	db, err := gorm.Open(sqlite.Open("file:"+filepath.Join(t.TempDir(), "repository-access-tokens.db")+"?mode=memory&cache=shared"), &gorm.Config{})
	require.NoError(t, err)
	require.NoError(t, db.AutoMigrate(&store.Token{}, &store.Event{}, &store.AgentSuppression{}))
	now := time.Date(2026, 7, 16, 4, 30, 0, 0, time.UTC)
	issuer := repositorySyncTokenIssuerOption(repotokens.NewService(store.New(db), func() time.Time { return now }))

	lease, err := issuer.CreateRepositorySyncToken(context.Background(), repos.RepositorySyncTokenRequest{
		WorkspaceID: "wsp_1", ActorPrincipalID: "daemon_1", DisplayName: "Skill sync",
		Repositories: []string{"pingcap/skill"},
		Capabilities: []string{repos.RepositorySyncCapabilityRead, repos.RepositorySyncCapabilityClone},
	})
	require.NoError(t, err)
	require.Contains(t, lease.Token, "ags_rat_")
	require.Equal(t, now.Add(30*time.Minute), lease.ExpiresAt)

	var count int64
	require.NoError(t, db.Model(&store.Token{}).Where("workspace_id = ? AND type = ?", "wsp_1", repotokens.TokenTypeSyncLease).Count(&count).Error)
	require.EqualValues(t, 1, count)
}