package repotokens

import (
	"context"
	"testing"
	"time"

	"github.com/glebarez/sqlite"
	"github.com/stretchr/testify/require"
	"gorm.io/gorm"
)

func TestStorePersistsTokenMetadataWithoutPlaintext(t *testing.T) {
	db, err := gorm.Open(sqlite.Open("file::memory:?cache=shared"), &gorm.Config{})
	require.NoError(t, err)
	require.NoError(t, db.AutoMigrate(&Token{}, &Event{}, &AgentSuppression{}))

	store := New(db)
	now := time.Date(2026, 7, 16, 3, 30, 0, 0, time.UTC)
	token := Token{
		PublicID:            "rat_test",
		AGSTokenID:          "ags_tok_test",
		VerifierHash:        "sha256:irreversible",
		Fingerprint:         "0123456789abcdef",
		Type:                "human",
		DisplayName:         "Docs",
		OwnerPrincipalID:    "usr_1",
		WorkspaceID:         "wsp_1",
		ProviderHost:        "github.com",
		RepositoryScopeJSON: `{"mode":"repositories","repositories":["pingcap/agentteam"]}`,
		CapabilitiesJSON:    `["repo:read"]`,
		Status:              "active",
		CreatedAt:           now,
		UpdatedAt:           now,
	}

	created, err := store.CreateToken(context.Background(), token, Event{
		EventID:          "ratevt_test",
		Type:             "created",
		ActorPrincipalID: "usr_1",
		CreatedAt:        now,
	})
	require.NoError(t, err)
	require.NotZero(t, created.ID)

	loaded, err := store.GetByPublicID(context.Background(), "wsp_1", "rat_test")
	require.NoError(t, err)
	require.Equal(t, "sha256:irreversible", loaded.VerifierHash)

	var columns []struct{ Name string }
	require.NoError(t, db.Raw("PRAGMA table_info(repository_access_tokens)").Scan(&columns).Error)
	for _, column := range columns {
		require.NotEqual(t, "plaintext", column.Name)
	}
}

func TestStoreForceSuppressionSurvivesServiceInstances(t *testing.T) {
	db, err := gorm.Open(sqlite.Open("file:suppression?mode=memory&cache=shared"), &gorm.Config{})
	require.NoError(t, err)
	require.NoError(t, db.AutoMigrate(&Token{}, &Event{}, &AgentSuppression{}))

	now := time.Date(2026, 7, 16, 3, 30, 0, 0, time.UTC)
	require.NoError(t, New(db).SuppressAgent(context.Background(), AgentSuppression{
		WorkspaceID:      "wsp_1",
		AgentID:          "agt_1",
		ActorPrincipalID: "security",
		Reason:           "security_response",
		SuppressedAt:     now,
		CreatedAt:        now,
		UpdatedAt:        now,
	}))

	suppressed, err := New(db).AgentSuppressed(context.Background(), "wsp_1", "agt_1")
	require.NoError(t, err)
	require.True(t, suppressed)
}