oauth-db-cli 0.1.0

use assert_cmd::Command;
use predicates::prelude::*;
use serial_test::serial;
use std::fs;
use std::path::PathBuf;
use std::sync::Mutex;

// Global lock to ensure tests don't interfere with each other
static CONFIG_LOCK: Mutex<()> = Mutex::new(());

/// Helper to get real config directory for testing
fn get_real_config_dir() -> PathBuf {
    directories::ProjectDirs::from("com", "oauth-db", "oauth-db-cli")
        .expect("Failed to get config dir")
        .config_dir()
        .to_path_buf()
}

/// Backup existing config if it exists
fn backup_config() -> Option<String> {
    let config_path = get_real_config_dir().join("config.toml");
    if config_path.exists() {
        fs::read_to_string(&config_path).ok()
    } else {
        None
    }
}

/// Restore config from backup
fn restore_config(backup: Option<String>) {
    let config_path = get_real_config_dir().join("config.toml");
    if let Some(content) = backup {
        fs::write(&config_path, content).ok();
    } else {
        fs::remove_file(&config_path).ok();
    }
}

/// Setup a logged-in admin account with valid token
fn setup_admin_account() {
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "admin@localhost"
server = "http://localhost:28080"
username = "admin"
token = "admin_valid_token"
default = true
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();
}

/// Setup a logged-in regular user account (non-admin)
fn setup_regular_user_account() {
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "user@localhost"
server = "http://localhost:28080"
username = "user"
token = "user_valid_token"
default = true
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();
}

/// Generate unique username for testing
fn generate_username() -> String {
    use std::time::{SystemTime, UNIX_EPOCH};
    let timestamp = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs();
    format!("test_user_{}", timestamp)
}

/// Test listing platform users
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_list() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .assert()
        .success()
        .stdout(
            predicates::str::contains("USER ID")
                .or(predicates::str::contains("No users found")),
        );

    restore_config(backup);
}

/// Test listing platform users with role filter
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_list_with_role() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    // List admin users
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .arg("--role")
        .arg("admin")
        .assert()
        .success();

    // List regular users
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .arg("--role")
        .arg("user")
        .assert()
        .success();

    restore_config(backup);
}

/// Test listing platform users with status filter
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_list_with_status() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    // List active users
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .arg("--status")
        .arg("active")
        .assert()
        .success();

    // List disabled users
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .arg("--status")
        .arg("disabled")
        .assert()
        .success();

    restore_config(backup);
}

/// Test listing platform users with pagination
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_list_with_pagination() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .arg("--page")
        .arg("1")
        .arg("--page-size")
        .arg("10")
        .assert()
        .success()
        .stdout(predicates::str::contains("page"));

    restore_config(backup);
}

/// Test showing platform user details
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_show() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let username = generate_username();
    let email = format!("{}@example.com", username);

    // First create a user
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    let output = cmd
        .arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg(&email)
        .arg("--password")
        .arg("testpass123")
        .output()
        .unwrap();

    let stdout = String::from_utf8_lossy(&output.stdout);

    // Extract user_id from output
    if let Some(user_id) = stdout
        .lines()
        .find(|line| line.contains("User ID:"))
        .and_then(|line| line.split(':').nth(1))
        .map(|s| s.trim())
    {
        // Show user details
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("show")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains("User Details"))
            .stdout(predicates::str::contains("User ID:"))
            .stdout(predicates::str::contains("Username:"))
            .stdout(predicates::str::contains("Email:"))
            .stdout(predicates::str::contains("Role:"))
            .stdout(predicates::str::contains("Status:"))
            .stdout(predicates::str::contains(&username));
    }

    restore_config(backup);
}

/// Test showing platform user details in JSON format
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_show_json() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let username = generate_username();
    let email = format!("{}@example.com", username);

    // First create a user
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    let output = cmd
        .arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg(&email)
        .arg("--password")
        .arg("testpass123")
        .output()
        .unwrap();

    let stdout = String::from_utf8_lossy(&output.stdout);

    if let Some(user_id) = stdout
        .lines()
        .find(|line| line.contains("User ID:"))
        .and_then(|line| line.split(':').nth(1))
        .map(|s| s.trim())
    {
        // Show user in JSON format
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("show")
            .arg(user_id)
            .arg("--output")
            .arg("json")
            .assert()
            .success()
            .stdout(predicates::str::contains("user_id"))
            .stdout(predicates::str::contains("username"))
            .stdout(predicates::str::contains("email"))
            .stdout(predicates::str::contains("role"))
            .stdout(predicates::str::contains("status"));
    }

    restore_config(backup);
}

/// Test creating a platform user
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_create() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let username = generate_username();
    let email = format!("{}@example.com", username);

    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg(&email)
        .arg("--password")
        .arg("testpass123")
        .assert()
        .success()
        .stdout(predicates::str::contains("User created successfully"))
        .stdout(predicates::str::contains("User ID:"))
        .stdout(predicates::str::contains(&username));

    restore_config(backup);
}

/// Test creating a platform user with admin role
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_create_with_role() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let username = generate_username();
    let email = format!("{}@example.com", username);

    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg(&email)
        .arg("--role")
        .arg("admin")
        .arg("--password")
        .arg("testpass123")
        .assert()
        .success()
        .stdout(predicates::str::contains("User created successfully"))
        .stdout(predicates::str::contains("Role: admin"));

    restore_config(backup);
}

/// Test enabling and disabling a platform user
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_enable_disable() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let username = generate_username();
    let email = format!("{}@example.com", username);

    // First create a user
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    let output = cmd
        .arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg(&email)
        .arg("--password")
        .arg("testpass123")
        .output()
        .unwrap();

    let stdout = String::from_utf8_lossy(&output.stdout);

    if let Some(user_id) = stdout
        .lines()
        .find(|line| line.contains("User ID:"))
        .and_then(|line| line.split(':').nth(1))
        .map(|s| s.trim())
    {
        // Disable user
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("disable")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains("User disabled successfully"));

        // Verify status changed by showing user
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("show")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains("Status: disabled"));

        // Enable user
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("enable")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains("User enabled successfully"));

        // Verify status changed back
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("show")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains("Status: active"));
    }

    restore_config(backup);
}

/// Test setting user role
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_set_role() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let username = generate_username();
    let email = format!("{}@example.com", username);

    // First create a user (default role: user)
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    let output = cmd
        .arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg(&email)
        .arg("--password")
        .arg("testpass123")
        .output()
        .unwrap();

    let stdout = String::from_utf8_lossy(&output.stdout);

    if let Some(user_id) = stdout
        .lines()
        .find(|line| line.contains("User ID:"))
        .and_then(|line| line.split(':').nth(1))
        .map(|s| s.trim())
    {
        // Set role to admin
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("set-role")
            .arg(user_id)
            .arg("admin")
            .assert()
            .success()
            .stdout(predicates::str::contains("User role updated successfully"));

        // Verify role changed
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("show")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains("Role: admin"));

        // Set role back to user
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("set-role")
            .arg(user_id)
            .arg("user")
            .assert()
            .success()
            .stdout(predicates::str::contains("User role updated successfully"));

        // Verify role changed back
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("show")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains("Role: user"));
    }

    restore_config(backup);
}

/// Test viewing system statistics
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_stats() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .success()
        .stdout(predicates::str::contains("System Statistics"))
        .stdout(predicates::str::contains("Total Users:"))
        .stdout(predicates::str::contains("Total Apps:"))
        .stdout(predicates::str::contains("Total App Users:"))
        .stdout(predicates::str::contains("Active Connections:"))
        .stdout(predicates::str::contains("Total Storage:"));

    restore_config(backup);
}

/// Test viewing system statistics in JSON format
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_stats_json() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .arg("--output")
        .arg("json")
        .assert()
        .success()
        .stdout(predicates::str::contains("total_users"))
        .stdout(predicates::str::contains("total_apps"))
        .stdout(predicates::str::contains("total_app_users"))
        .stdout(predicates::str::contains("active_connections"))
        .stdout(predicates::str::contains("total_storage_mb"));

    restore_config(backup);
}

/// Test admin operations with non-admin user
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_operations_not_admin() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_regular_user_account();

    // Try to list users as non-admin
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .assert()
        .failure()
        .stderr(
            predicates::str::contains("Permission denied")
                .or(predicates::str::contains("admin role required")),
        );

    restore_config(backup);
}

/// Test admin operations when not logged in
#[tokio::test]
#[serial(config)]
async fn test_admin_operations_not_logged_in() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();

    // Setup empty config (no accounts)
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try to list users without login
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .assert()
        .failure()
        .stderr(
            predicates::str::contains("Not logged in")
                .or(predicates::str::contains("Admin commands not yet implemented"))
                .or(predicates::str::contains("Error"))
        );

    restore_config(backup);
}

/// Test complete admin user lifecycle workflow
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_user_lifecycle_workflow() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let username = generate_username();
    let email = format!("{}@example.com", username);

    // 1. Create user
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    let output = cmd
        .arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg(&email)
        .arg("--password")
        .arg("testpass123")
        .output()
        .unwrap();

    assert!(output.status.success());
    let stdout = String::from_utf8_lossy(&output.stdout);

    if let Some(user_id) = stdout
        .lines()
        .find(|line| line.contains("User ID:"))
        .and_then(|line| line.split(':').nth(1))
        .map(|s| s.trim())
    {
        // 2. List users and verify it appears
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("list")
            .assert()
            .success()
            .stdout(predicates::str::contains(user_id));

        // 3. Show user details
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("show")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains(&username));

        // 4. Set role to admin
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("set-role")
            .arg(user_id)
            .arg("admin")
            .assert()
            .success();

        // 5. Verify role changed
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("show")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains("Role: admin"));

        // 6. Disable user
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("disable")
            .arg(user_id)
            .assert()
            .success();

        // 7. Verify status changed
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("show")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains("Status: disabled"));

        // 8. Enable user
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("enable")
            .arg(user_id)
            .assert()
            .success();

        // 9. Verify status changed back
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("show")
            .arg(user_id)
            .assert()
            .success()
            .stdout(predicates::str::contains("Status: active"));

        // 10. View system stats
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("stats")
            .assert()
            .success();
    }

    restore_config(backup);
}

/// Test creating user with invalid email
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_create_invalid_email() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let username = generate_username();

    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg("invalid-email")
        .arg("--password")
        .arg("testpass123")
        .assert()
        .failure()
        .stderr(
            predicates::str::contains("Invalid email")
                .or(predicates::str::contains("email format")),
        );

    restore_config(backup);
}

/// Test creating user with duplicate username
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_create_duplicate_username() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let username = generate_username();
    let email = format!("{}@example.com", username);

    // Create first user
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg(&email)
        .arg("--password")
        .arg("testpass123")
        .assert()
        .success();

    // Try to create duplicate
    let email2 = format!("{}2@example.com", username);
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg(&email2)
        .arg("--password")
        .arg("testpass123")
        .assert()
        .failure()
        .stderr(
            predicates::str::contains("already exists")
                .or(predicates::str::contains("duplicate")),
        );

    restore_config(backup);
}

/// Test showing non-existent user
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_show_not_found() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("show")
        .arg("00000000-0000-0000-0000-000000000000")
        .assert()
        .failure()
        .stderr(
            predicates::str::contains("not found")
                .or(predicates::str::contains("does not exist")),
        );

    restore_config(backup);
}

/// Test setting invalid role
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_users_set_role_invalid() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let username = generate_username();
    let email = format!("{}@example.com", username);

    // First create a user
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    let output = cmd
        .arg("admin")
        .arg("users")
        .arg("create")
        .arg(&username)
        .arg(&email)
        .arg("--password")
        .arg("testpass123")
        .output()
        .unwrap();

    let stdout = String::from_utf8_lossy(&output.stdout);

    if let Some(user_id) = stdout
        .lines()
        .find(|line| line.contains("User ID:"))
        .and_then(|line| line.split(':').nth(1))
        .map(|s| s.trim())
    {
        // Try to set invalid role
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("admin")
            .arg("users")
            .arg("set-role")
            .arg(user_id)
            .arg("superadmin")
            .assert()
            .failure()
            .stderr(
                predicates::str::contains("Invalid role")
                    .or(predicates::str::contains("must be 'user' or 'admin'")),
            );
    }

    restore_config(backup);
}

/// Test admin stats with detailed breakdown
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_admin_stats_detailed() {
    let _lock = CONFIG_LOCK.lock().unwrap();
    let backup = backup_config();
    setup_admin_account();

    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .success()
        .stdout(predicates::str::contains("System Statistics"))
        .stdout(predicates::str::contains("Total Users:"))
        .stdout(predicates::str::contains("Active Users:"))
        .stdout(predicates::str::contains("Disabled Users:"))
        .stdout(predicates::str::contains("Total Apps:"))
        .stdout(predicates::str::contains("Active Apps:"))
        .stdout(predicates::str::contains("Total App Users:"))
        .stdout(predicates::str::contains("Active Connections:"))
        .stdout(predicates::str::contains("Total Storage:"));

    restore_config(backup);
}