import { describe, expect, mock, test } from "bun:test";
import { Database } from "bun:sqlite";
import { applyCombinedSchema } from "./test-schema.test-helper";
import type { Viewer } from "~/lib/types";

mock.module("cloudflare:workers", () => ({ env: { PUBLIC_URL: "https://forge.example.com" } }));
mock.module("@tanstack/react-start/server", () => ({ getRequestHeader: () => undefined }));

const db = new Database(":memory:");
applyCombinedSchema(db);

mock.module("./db", () => ({
  first: async (sql: string, ...params: unknown[]) => db.query(sql).get(...(params as never[])) ?? null,
  all: async (sql: string, ...params: unknown[]) => db.query(sql).all(...(params as never[])),
  run: async () => ({ meta: { changes: 0 } }),
  batch: async () => [],
  stmt: (sql: string, ...params: unknown[]) => ({ sql, params }),
  placeholders: (count: number) => Array(count).fill("?").join(", "),
  chunks: <T>(items: T[]) => [items],
  MAX_IN_LIST: 90,
}));

const { visibleReposClause } = await import("./repos");

db.exec(`
  INSERT INTO accounts (id, name, kind, created_at) VALUES ('org', 'acme', 'org', 0), ('owner', 'owner', 'user', 0),
    ('member', 'member', 'user', 0), ('reader', 'reader', 'user', 0), ('stranger', 'stranger', 'user', 0);
  INSERT INTO users (account_id, email, is_admin) VALUES ('owner', 'o@x', 0), ('member', 'm@x', 0), ('reader', 'r@x', 0), ('stranger', 's@x', 0);
  UPDATE accounts SET org_default_permission = 'read' WHERE id = 'org';
  INSERT INTO repos (id, owner_id, name, visibility, status, default_branch, artifacts_name, artifacts_remote, created_at, updated_at) VALUES
    ('ready', 'org', 'ready', 'public', 'ready', 'main', 'a1', 'r1', 0, 0),
    ('failed', 'org', 'failed-import', 'public', 'failed', 'main', 'a2', 'r2', 0, 0),
    ('importing', 'org', 'importing', 'public', 'importing', 'main', 'a3', 'r3', 0, 0),
    ('private-failed', 'org', 'private-failed', 'private', 'failed', 'main', 'a4', 'r4', 0, 0);
  INSERT INTO org_members (org_id, user_id, role, created_at) VALUES ('org', 'owner', 'owner', 0), ('org', 'member', 'member', 0);
  INSERT INTO collaborators (repo_id, user_id, permission, created_at) VALUES ('failed', 'reader', 'read', 0);
`);

function viewer(id: string): Viewer {
  return { id, name: id, displayName: null, email: `${id}@x`, isAdmin: false, emailVerified: true };
}

function listed(who: Viewer | null, options?: { adminSeesAll?: boolean }): string[] {
  const { clause, viewerId } = visibleReposClause(who, options);
  const rows = db.query(`SELECT r.id FROM repos r WHERE ${clause} ORDER BY r.id`).all(viewerId) as { id: string }[];
  return rows.map((row) => row.id);
}

describe("visibleReposClause hides unfinished imports from listings", () => {
  test("admins see every repo unless a discovery surface opts out", () => {
    const admin = { ...viewer("admin"), isAdmin: true, emailVerified: true };
    expect(listed(admin).length).toBeGreaterThan(1);
    expect(listed(admin, { adminSeesAll: false })).toEqual(["ready"]);
  });

  test("anonymous and unrelated users only see ready public repos", () => {
    expect(listed(null)).toEqual(["ready"]);
    expect(listed(viewer("stranger"))).toEqual(["ready"]);
  });

  test("read-only collaborators and read-by-default org members do not see failed or importing repos", () => {
    expect(listed(viewer("reader"))).toEqual(["ready"]);
    expect(listed(viewer("member"))).toEqual(["ready"]);
  });

  test("people who can act on the repo see it in every state", () => {
    expect(listed(viewer("owner"))).toEqual(["failed", "importing", "private-failed", "ready"]);
  });
});