package postgres

import (
	"errors"
	"strings"
	"testing"
	"time"
)

func TestAuthStoreRequiresIntegrationDatabase(t *testing.T) {
	// Real bcrypt + sessions behaviour is covered by the integration suite;
	// this unit file pins the pure helpers that gate every auth write.
	if !validUsername("yaozhanghao") || !validUsername("a.b_c-9") {
		t.Fatal("valid usernames rejected")
	}
	for _, bad := range []string{"", "a", "-lead", ".lead", "UPPER", "sp ace", strings.Repeat("x", 65)} {
		if validUsername(bad) {
			t.Fatalf("invalid username accepted: %q", bad)
		}
	}
	if !validPasswordPolicy("dobotai!") || validPasswordPolicy("short") || validPasswordPolicy(strings.Repeat("x", 129)) {
		t.Fatal("password policy wrong")
	}
	if !ValidRole(RoleViewer) || !ValidRole(RoleEngineer) || !ValidRole(RoleAdmin) || ValidRole("superuser") {
		t.Fatal("role set wrong")
	}
	if len(hashSessionToken("t")) != 64 {
		t.Fatal("session token hash must be sha256 hex")
	}
	if got := truncateUserAgent("a\nb"); got != "a b" {
		t.Fatalf("user agent control chars: %q", got)
	}
}

func TestAuthErrorsAreDistinct(t *testing.T) {
	for _, err := range []error{ErrAuthInvalidCredential, ErrAuthLocked, ErrAuthUserDisabled, ErrAuthSessionInvalid, ErrAuthLastAdmin} {
		if err == nil || errors.Is(err, ErrAuthUserNotFound) {
			t.Fatalf("auth error taxonomy broken: %v", err)
		}
	}
}

func TestAuthSessionTTLDefaults(t *testing.T) {
	// zero ttl must not create an instantly-dead session
	ttl := 12 * time.Hour
	if ttl <= 0 {
		t.Fatal("default ttl must be positive")
	}
}