<?php

/** Real sessions in a transaction; all account/session changes are rolled back. */
require dirname(__DIR__) . '/vendor/autoload.php';
\Dotenv\Dotenv::createUnsafeMutable(dirname(__DIR__))->load();
\support\App::loadAllConfig(['route']);

use app\miniapi\auth\TestPhoneIdentityProvider;
use app\miniapi\auth\SessionVerifier;
use app\miniapi\exception\ApiException;
use app\miniapi\model\MiniUser;
use app\miniapi\model\MiniSession;
use app\miniapi\service\TestPhoneLogin;
use app\miniapi\service\AuthService;

$checks = 0;
function check(bool $ok, string $label): void
{
    global $checks;
    $checks++;
    if (!$ok) {
        throw new RuntimeException($label);
    }
}
function reject(callable $action, int $code): void
{
    try {
        $action();
    } catch (ApiException $error) {
        check($error->getCode() === $code, 'Expected rejection ' . $code);

        return;
    }
    throw new RuntimeException('Missing rejection ' . $code);
}
function settings(array $changes): void
{
    $property = new ReflectionProperty(\Webman\Config::class, 'config');
    $all = $property->getValue();
    $all['mini_api'] = array_replace($all['mini_api'], $changes);
    $property->setValue(null, $all);
    (new ReflectionProperty(\Webman\Config::class, 'flatCache'))->setValue(null, []);
}
$original = config('mini_api');
$db = (new MiniUser())->getConnection();
$db->beginTransaction();
try {
    $service = new TestPhoneLogin();
    $input = ['phone' => TestPhoneIdentityProvider::PHONES['enterprise_admin'], 'code' => '66666'];
    settings(['environment' => 'production', 'test_phone_login' => true]);
    reject(fn () => $service->login($input), 50301);
    settings(['environment' => 'local', 'test_phone_login' => false]);
    reject(fn () => $service->login($input), 50301);
    settings(['environment' => 'local', 'test_phone_login' => true]);
    settings(['test_phone_allowed_ips' => ['127.0.0.1', '::1']]);
    $service->assertSourceAllowed('127.0.0.1');
    reject(fn () => $service->assertSourceAllowed('192.168.1.10'), 40301);
    reject(fn () => $service->login($input + ['user_id' => 1]), 42201);
    reject(fn () => $service->login(['phone' => '13012345681', 'code' => '66666']), 40102);
    reject(fn () => $service->login(['phone' => '13012345678', 'code' => '66665']), 40102);
    reject(fn () => $service->login(['phone' => ['13012345678'], 'code' => '66666']), 42201);

    $users = [];
    foreach (TestPhoneIdentityProvider::PHONES as $role => $phone) {
        $users[$role] = MiniUser::query()->firstOrCreate(
            ['appid' => TestPhoneIdentityProvider::APP_ID, 'openid' => $phone],
            ['nickname' => 'test', 'status' => 1, 'created_at' => date('Y-m-d H:i:s'), 'updated_at' => date('Y-m-d H:i:s')]
        );
    }
    $count = MiniUser::query()->count();
    $sessions = [];
    foreach (TestPhoneIdentityProvider::PHONES as $role => $phone) {
        $sessions[$role] = $service->login(['phone' => $phone, 'code' => '66666']);
        check($sessions[$role]['user_id'] === (string) $users[$role]->id, 'Correct account for ' . $role);
        check(count($sessions[$role]['identities']) <= 1, 'At most one role for ' . $role);
    }
    check(count(array_unique(array_column($sessions, 'user_id'))) === 3, 'Distinct test accounts');
    check(MiniUser::query()->count() === $count, 'No duplicate users');
    $one = $sessions['enterprise_admin'];
    $two = $service->login($input);
    check($one['user_id'] === $two['user_id'], 'Stable identity');
    check($one['access_token'] !== $two['access_token'], 'Fresh random sessions');
    check((new SessionVerifier())->verify($one['access_token'])->userId === (string) $users['enterprise_admin']->id, 'Session authenticated');
    check(MiniSession::query()->where('token_hash', hash('sha256', $one['access_token']))->exists(), 'Token hash stored');
    settings(['test_phone_login' => false]);
    reject(fn () => (new SessionVerifier())->verify($one['access_token']), 40101);
    settings(['test_phone_login' => true, 'environment' => 'production']);
    reject(fn () => (new SessionVerifier())->verify($one['access_token']), 40101);
    settings(['environment' => 'local']);
    MiniUser::query()->where('id', $users['enterprise_admin']->id)->update(['status' => 0]);
    reject(fn () => $service->login($input), 40302);
    reject(fn () => (new SessionVerifier())->verify($one['access_token']), 40101);
    MiniUser::query()->where('id', $users['enterprise_admin']->id)->update(['status' => 1]);
    (new AuthService())->logout($one['access_token']);
    reject(fn () => (new SessionVerifier())->verify($one['access_token']), 40101);
    check((new SessionVerifier())->verify($two['access_token'])->userId === (string) $users['enterprise_admin']->id, 'Other session still works');
} finally {
    $db->rollBack();
    settings($original);
}
echo "PASS: $checks test phone checks, database changes rolled back.\n";