import assert from 'node:assert/strict';
import test from 'node:test';
import { buildApp } from '../../src/app/build-app.js';
import { createInventoryImageService } from '../../src/modules/inventory/services/inventory-image-service.js';

test('rejects malformed image updates without writes and accepts normalized boundary values', async (context) => {
  const writes = [];
  const app = buildApp({
    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
    inventoryImageService: createInventoryImageService({ inventoryImageRepository: {
      async updateOrderForSeller(id, sortOrder, sellerId) { writes.push({ id, sortOrder, sellerId }); return { id, sortOrder }; },
      async updateAltTextForSeller(id, altText, sellerId) { writes.push({ id, altText, sellerId }); return { id, altText }; },
    } }),
  });
  context.after(() => app.close());
  const patch = (path, payload) => app.inject({ method: 'PATCH', url: `/api/v1/admin/images/image-1/${path}`, payload });
  for (const payload of [{}, { sortOrder: -1 }, { sortOrder: 0.2 }, { sortOrder: '1' }, { sortOrder: null }, { sortOrder: 2147483648 }, { sortOrder: 0, sellerId: 'other' }]) {
    const response = await patch('order', payload);
    assert.equal(response.statusCode, 400);
    assert.equal(response.json().error.code, 'VALIDATION_ERROR');
  }
  for (const payload of [{}, { altText: 1 }, { altText: {} }, { altText: [] }, { altText: 'x'.repeat(1001) }, { altText: 'Front', private: true }]) {
    assert.equal((await patch('alt-text', payload)).statusCode, 400);
  }
  assert.deepEqual(writes, []);
  for (const sortOrder of [0, 2147483647]) assert.equal((await patch('order', { sortOrder })).json().data.sortOrder, sortOrder);
  for (const [altText, expected] of [[' Front ', 'Front'], ['   ', ''], [null, null], ['x'.repeat(1000), 'x'.repeat(1000)]]) {
    const response = await patch('alt-text', { altText });
    assert.equal(response.statusCode, 200);
    assert.equal(response.json().data.altText, expected);
  }
  assert.ok(writes.every(({ sellerId }) => sellerId === 'seller-1'));
});

test('image update validation does not bypass authentication or CSRF', async (context) => {
  for (const signedIn of [false, true]) {
    const app = buildApp({
      authenticateAdmin: async () => signedIn ? { sellerId: 'seller-1' } : null,
      authorizeUnsafeRequest: async () => { throw Object.assign(new Error('Forbidden'), { statusCode: 403 }); },
      inventoryImageService: {
        async updateOrder() { assert.fail('blocked request reached order service'); },
        async updateAltText() { assert.fail('blocked request reached alt-text service'); },
      },
    });
    context.after(() => app.close());
    for (const path of ['order', 'alt-text']) {
      const response = await app.inject({ method: 'PATCH', url: `/api/v1/admin/images/image-1/${path}`, payload: {} });
      assert.equal(response.statusCode, signedIn ? 403 : 401);
    }
  }
});