package main

import (
	"fmt"
	"time"

	"kra/internal/service/dto"
)

func verifyCatalog(admin, public, viewer *apiClient, f *fixtures, report *acceptanceReport) {
	var category dto.LiveCategoryResponse
	name := fmt.Sprintf("T%d", time.Now().UnixMilli()%100000000)
	input := dto.LiveCategoryRequest{Name: name, Icon: "video", Sort: 2, Enabled: false}
	must(admin.call("POST", "/live/admin/categories", input, &category))
	if category.Enabled {
		report.Findings = append(report.Findings, "Creating a category with enabled:false returns enabled:true")
	}
	input.Enabled = true
	must(admin.call("PUT", fmt.Sprintf("/live/admin/categories/%d", category.ID), input, &category))
	check(category.Enabled, "category update did not preserve enabled:true")
	var room dto.LiveRoomResponse
	roomInput := makeRoom("API Disabled Test", category.ID, f.Anchor.ID, "", false)
	must(admin.call("POST", "/live/admin/rooms", roomInput, &room))
	if room.Enabled {
		report.Findings = append(report.Findings, "Creating a room with enabled:false returns enabled:true and exposes the room publicly")
	}
	must(admin.call("PATCH", adminRoomPath(room.ID)+"/status", dto.LiveStatusRequest{Enabled: false}, nil))
	check(public.call("GET", roomPath(room.ID), nil, nil) != nil, "room remains public after disabling")
	check(viewer.call("GET", adminRoomPath(room.ID), nil, nil) != nil, "PC viewer accessed an administration room")
	roomInput.Enabled = true
	roomInput.Intro = "Updated through API"
	must(admin.call("PUT", adminRoomPath(room.ID), roomInput, &room))
	check(room.Intro == roomInput.Intro && room.Enabled, "room update did not persist")
	input.Enabled = false
	must(admin.call("PUT", fmt.Sprintf("/live/admin/categories/%d", category.ID), input, nil))
	check(public.call("GET", roomPath(room.ID), nil, nil) != nil, "room in a disabled category was exposed")
	input.Enabled = true
	must(admin.call("PUT", fmt.Sprintf("/live/admin/categories/%d", category.ID), input, nil))
	must(admin.call("DELETE", adminRoomPath(room.ID), nil, nil))
	check(public.call("GET", roomPath(room.ID), nil, nil) != nil, "deleted room remained public")
	must(admin.call("DELETE", fmt.Sprintf("/live/admin/categories/%d", category.ID), nil, nil))

	var gift dto.GiftResponse
	giftInput := dto.GiftRequest{Name: name, Icon: "star", Price: 9, Tiers: []int{1, 10}, Enabled: true, Sort: 2}
	must(admin.call("POST", "/live/admin/gifts", giftInput, &gift))
	giftInput.Description = "Updated through API"
	must(admin.call("PUT", fmt.Sprintf("/live/admin/gifts/%d", gift.ID), giftInput, &gift))
	check(gift.Description == giftInput.Description, "gift update did not persist")
	must(admin.call("PATCH", fmt.Sprintf("/live/admin/gifts/%d/status", gift.ID), dto.LiveStatusRequest{Enabled: false}, nil))
	must(admin.call("DELETE", fmt.Sprintf("/live/admin/gifts/%d", gift.ID), nil, nil))
	passed(report, "administrator category, room and gift CRUD; category/room disabling; client administration access denied")
}

func verifyDisabledAccount(admin, other *apiClient, f *fixtures, report *acceptanceReport) {
	path := fmt.Sprintf("/live/admin/users/%d/status", f.Other.ID)
	if err := admin.call("PATCH", path, dto.LiveStatusRequest{Enabled: false}, nil); err != nil {
		report.Findings = append(report.Findings, "Administrator cannot disable the client user: "+err.Error())
		return
	}
	defer func() {
		must(admin.call("PATCH", path, dto.LiveStatusRequest{Enabled: true}, nil))
	}()
	check(admin.call("PATCH", fmt.Sprintf("/live/admin/users/%d/status", f.Admin.ID), dto.LiveStatusRequest{Enabled: false}, nil) != nil, "administrator disabled their own account")
	_, err := login(f.Other, false)
	check(err != nil, "disabled account could still log in")
	check(other.call("GET", "/live/client/balance", nil, nil) != nil, "disabled account token remained authorized")
	passed(report, "disabled user cannot log in or use an existing authenticated API token")
}