oauth-db-cli 0.1.0

use assert_cmd::Command;
use predicates::prelude::*;
use serial_test::serial;
use std::fs;
use std::path::PathBuf;
use std::sync::Mutex;

// Global lock to ensure tests don't interfere with each other
static CONFIG_LOCK: Mutex<()> = Mutex::new(());

/// Helper to get real config directory for testing
fn get_real_config_dir() -> PathBuf {
    directories::ProjectDirs::from("com", "oauth-db", "oauth-db-cli")
        .expect("Failed to get config dir")
        .config_dir()
        .to_path_buf()
}

/// Backup existing config if it exists
fn backup_config() -> Option<String> {
    let config_path = get_real_config_dir().join("config.toml");
    if config_path.exists() {
        fs::read_to_string(&config_path).ok()
    } else {
        None
    }
}

/// Restore config from backup
fn restore_config(backup: Option<String>) {
    let config_path = get_real_config_dir().join("config.toml");
    if let Some(content) = backup {
        fs::write(&config_path, content).ok();
    } else {
        fs::remove_file(&config_path).ok();
    }
}

/// Create a complete config with required sections
fn create_config(accounts: &str) -> String {
    format!(
        r#"[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

{}"#,
        accounts
    )
}

/// Test that regular user cannot execute admin commands
#[tokio::test]
#[serial(config)]
async fn test_regular_user_cannot_execute_admin_commands() {
    let backup = backup_config();

    // Setup: Create a regular user account (developer role)
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try to execute admin command - should fail
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .assert()
        .failure()
        .stderr(predicates::str::contains("developer"))
        .stderr(predicates::str::contains("admin"))
        .stderr(predicates::str::contains("required"));

    restore_config(backup);
}

/// Test that admin can execute all commands
#[tokio::test]
#[serial(config)]
async fn test_admin_can_execute_admin_commands() {

    let backup = backup_config();

    // Setup: Create an admin account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "admin@localhost"
server = "http://localhost:28080"
username = "admin"
token = "admin_token"
default = true
role = "admin"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Execute admin command - should pass permission check (but fail at API level since not implemented)
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .assert()
        .failure()
        .stderr(predicates::str::contains("not yet implemented").or(
            predicates::str::contains("Phase 5")
        ));

    restore_config(backup);
}

/// Test whoami displays role correctly for admin
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_whoami_displays_admin_role() {

    let backup = backup_config();

    // Setup: Create admin account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "admin@localhost"
server = "http://localhost:28080"
username = "admin"
token = "admin_token"
default = true
role = "admin"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Execute whoami
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("whoami")
        .assert()
        .success()
        .stdout(predicates::str::contains("Role"))
        .stdout(predicates::str::contains("admin"));

    restore_config(backup);
}

/// Test whoami displays role correctly for developer
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_whoami_displays_developer_role() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Execute whoami
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("whoami")
        .assert()
        .success()
        .stdout(predicates::str::contains("Role"))
        .stdout(predicates::str::contains("developer"));

    restore_config(backup);
}

/// Test accounts list displays roles correctly
#[tokio::test]
#[serial(config)]
async fn test_accounts_list_displays_roles() {

    let backup = backup_config();

    // Setup: Create multiple accounts with different roles
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "admin@localhost"
server = "http://localhost:28080"
username = "admin"
token = "admin_token"
default = true
role = "admin"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = false
role = "developer"

[[accounts]]
name = "norole@localhost"
server = "http://localhost:28080"
username = "norole"
token = "norole_token"
default = false
role = "user"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Execute accounts list
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("accounts")
        .arg("list")
        .assert()
        .success()
        .stdout(predicates::str::contains("admin@localhost"))
        .stdout(predicates::str::contains("developer@localhost"))
        .stdout(predicates::str::contains("norole@localhost"))
        .stdout(predicates::str::contains("admin"))
        .stdout(predicates::str::contains("developer"));

    restore_config(backup);
}

/// Test that developer can execute app commands
#[tokio::test]
#[serial(config)]
async fn test_developer_can_execute_app_commands() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Execute app list command - should not fail on permission check
    // (will fail at API level since token is fake, but that's expected)
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("app")
        .arg("list")
        .assert()
        .failure()
        .stderr(
            predicates::str::contains("Connection refused")
                .or(predicates::str::contains("Failed to connect"))
                .or(predicates::str::contains("error sending request"))
                .or(predicates::str::contains("Resource not found"))
                .or(predicates::str::contains("Unauthorized"))
        );

    restore_config(backup);
}

/// Test that admin has all permissions (can execute developer commands)
#[tokio::test]
#[serial(config)]
async fn test_admin_has_all_permissions() {

    let backup = backup_config();

    // Setup: Create admin account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "admin@localhost"
server = "http://localhost:28080"
username = "admin"
token = "admin_token"
default = true
role = "admin"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Admin should be able to execute app commands (developer permission)
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("app")
        .arg("list")
        .assert()
        .failure()
        .stderr(
            predicates::str::contains("Connection refused")
                .or(predicates::str::contains("Failed to connect"))
                .or(predicates::str::contains("error sending request"))
                .or(predicates::str::contains("Resource not found"))
                .or(predicates::str::contains("Unauthorized"))
        );

    restore_config(backup);
}

/// Test permission check with user role (lowest privilege)
#[tokio::test]
#[serial(config)]
async fn test_user_role_cannot_execute_admin_commands() {

    let backup = backup_config();

    // Setup: Create user account (regular user role)
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "user@localhost"
server = "http://localhost:28080"
username = "user"
token = "user_token"
default = true
role = "user"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try to execute admin command - should fail
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .failure()
        .stderr(predicates::str::contains("user"))
        .stderr(predicates::str::contains("admin"))
        .stderr(predicates::str::contains("required"));

    restore_config(backup);
}

/// Test multiple accounts with different roles can be managed
#[tokio::test]
#[serial(config)]
async fn test_multiple_accounts_different_roles() {

    let backup = backup_config();

    // Setup: Create multiple accounts with different roles
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "admin@localhost"
server = "http://localhost:28080"
username = "admin"
token = "admin_token"
default = true
role = "admin"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = false
role = "developer"

[[accounts]]
name = "user@localhost"
server = "http://localhost:28080"
username = "user"
token = "user_token"
default = false
role = "user"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // 1. Admin can execute admin commands
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .failure()
        .stderr(predicates::str::contains("not yet implemented"));

    // 2. Switch to developer
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("accounts")
        .arg("switch")
        .arg("developer@localhost")
        .assert()
        .success();

    // 3. Developer cannot execute admin commands
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .failure()
        .stderr(predicates::str::contains("developer"))
        .stderr(predicates::str::contains("admin"));

    // 4. Switch to user
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("accounts")
        .arg("switch")
        .arg("user@localhost")
        .assert()
        .success();

    // 5. User cannot execute admin commands
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .failure()
        .stderr(predicates::str::contains("user"))
        .stderr(predicates::str::contains("admin"));

    restore_config(backup);
}

/// Test role persistence across commands
#[tokio::test]
#[serial(config)]
async fn test_role_persistence() {

    let backup = backup_config();

    // Setup: Create account with role
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "admin@localhost"
server = "http://localhost:28080"
username = "admin"
token = "admin_token"
default = true
role = "admin"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Execute multiple commands to verify role persists in config
    for _ in 0..3 {
        let mut cmd = Command::cargo_bin("oauth-db").unwrap();
        cmd.arg("accounts")
            .arg("list")
            .assert()
            .success()
            .stdout(predicates::str::contains("admin"));
    }

    restore_config(backup);
}

// ============================================================================
// Login Flow Tests (requires real backend)
// ============================================================================

/// Test login saves role information correctly for admin
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server with admin user
async fn test_login_saves_admin_role() {

    let backup = backup_config();

    // Login as admin
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("login")
        .arg("--username")
        .arg("admin")
        .arg("--password")
        .arg("admin123")
        .arg("--server")
        .arg("http://localhost:28080")
        .assert()
        .success()
        .stdout(predicates::str::contains("admin"));

    // Verify role is saved in config
    let config_path = get_real_config_dir().join("config.toml");
    let config_content = fs::read_to_string(&config_path).unwrap();
    assert!(config_content.contains("role = \"admin\""));

    restore_config(backup);
}

/// Test login saves role information correctly for developer
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server with developer user
async fn test_login_saves_developer_role() {

    let backup = backup_config();

    // Login as developer
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("login")
        .arg("--username")
        .arg("developer")
        .arg("--password")
        .arg("dev123")
        .arg("--server")
        .arg("http://localhost:28080")
        .assert()
        .success()
        .stdout(predicates::str::contains("developer"));

    // Verify role is saved in config
    let config_path = get_real_config_dir().join("config.toml");
    let config_content = fs::read_to_string(&config_path).unwrap();
    assert!(config_content.contains("role = \"developer\""));

    restore_config(backup);
}

/// Test login success message displays role information
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server
async fn test_login_success_message_shows_role() {

    let backup = backup_config();

    // Login and check success message
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("login")
        .arg("--username")
        .arg("admin")
        .arg("--password")
        .arg("admin123")
        .arg("--server")
        .arg("http://localhost:28080")
        .assert()
        .success()
        .stdout(predicates::str::contains("Successfully logged in"))
        .stdout(predicates::str::contains("Role"))
        .stdout(predicates::str::contains("admin"));

    restore_config(backup);
}

/// Test login with different roles
#[tokio::test]
#[serial(config)]
#[ignore] // Requires real backend server with multiple users
async fn test_login_different_roles() {

    let backup = backup_config();

    // Login as admin
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("login")
        .arg("--username")
        .arg("admin")
        .arg("--password")
        .arg("admin123")
        .arg("--server")
        .arg("http://localhost:28080")
        .assert()
        .success()
        .stdout(predicates::str::contains("admin"));

    // Login as developer (should add second account)
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("login")
        .arg("--username")
        .arg("developer")
        .arg("--password")
        .arg("dev123")
        .arg("--server")
        .arg("http://localhost:28080")
        .assert()
        .success()
        .stdout(predicates::str::contains("developer"));

    // Verify both accounts exist with correct roles
    let config_path = get_real_config_dir().join("config.toml");
    let config_content = fs::read_to_string(&config_path).unwrap();
    assert!(config_content.contains("role = \"admin\""));
    assert!(config_content.contains("role = \"developer\""));

    restore_config(backup);
}

// ============================================================================
// Admin Subcommand Permission Tests
// ============================================================================

/// Test admin users list permission check
#[tokio::test]
#[serial(config)]
async fn test_admin_users_list_permission() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"
url = "http://localhost:28080"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try admin users list - should fail
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .assert()
        .failure()
        .stderr(predicates::str::contains("developer"))
        .stderr(predicates::str::contains("admin"))
        .stderr(predicates::str::contains("required"));

    restore_config(backup);
}

/// Test admin users show permission check
#[tokio::test]
#[serial(config)]
async fn test_admin_users_show_permission() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try admin users show - should fail
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("show")
        .arg("some-user-id")
        .assert()
        .failure()
        .stderr(predicates::str::contains("developer"))
        .stderr(predicates::str::contains("admin"))
        .stderr(predicates::str::contains("required"));

    restore_config(backup);
}

/// Test admin users create permission check
#[tokio::test]
#[serial(config)]
async fn test_admin_users_create_permission() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try admin users create - should fail
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("create")
        .arg("--username")
        .arg("newuser")
        .arg("--email")
        .arg("new@example.com")
        .arg("--password")
        .arg("pass123")
        .assert()
        .failure()
        .stderr(predicates::str::contains("developer"))
        .stderr(predicates::str::contains("admin"))
        .stderr(predicates::str::contains("required"));

    restore_config(backup);
}

/// Test admin users enable permission check
#[tokio::test]
#[serial(config)]
async fn test_admin_users_enable_permission() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try admin users enable - should fail
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("enable")
        .arg("some-user-id")
        .assert()
        .failure()
        .stderr(predicates::str::contains("developer"))
        .stderr(predicates::str::contains("admin"))
        .stderr(predicates::str::contains("required"));

    restore_config(backup);
}

/// Test admin users disable permission check
#[tokio::test]
#[serial(config)]
async fn test_admin_users_disable_permission() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try admin users disable - should fail
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("disable")
        .arg("some-user-id")
        .assert()
        .failure()
        .stderr(predicates::str::contains("developer"))
        .stderr(predicates::str::contains("admin"))
        .stderr(predicates::str::contains("required"));

    restore_config(backup);
}

/// Test admin users set-role permission check
#[tokio::test]
#[serial(config)]
async fn test_admin_users_set_role_permission() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try admin users set-role - should fail
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("set-role")
        .arg("some-user-id")
        .arg("--role")
        .arg("admin")
        .assert()
        .failure()
        .stderr(predicates::str::contains("developer"))
        .stderr(predicates::str::contains("admin"))
        .stderr(predicates::str::contains("required"));

    restore_config(backup);
}

/// Test admin stats permission check
#[tokio::test]
#[serial(config)]
async fn test_admin_stats_permission() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try admin stats - should fail
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .failure()
        .stderr(predicates::str::contains("developer"))
        .stderr(predicates::str::contains("admin"))
        .stderr(predicates::str::contains("required"));

    restore_config(backup);
}

/// Test all admin subcommands pass permission check for admin role
#[tokio::test]
#[serial(config)]
async fn test_admin_role_passes_all_permission_checks() {

    let backup = backup_config();

    // Setup: Create admin account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "admin@localhost"
server = "http://localhost:28080"
username = "admin"
token = "admin_token"
default = true
role = "admin"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Test each admin subcommand - should pass permission check
    // (will fail at API level, but not at permission check)

    // admin users list
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("list")
        .assert()
        .failure()
        .stderr(predicates::str::contains("not yet implemented"));

    // admin users show
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("show")
        .arg("user-id")
        .assert()
        .failure()
        .stderr(predicates::str::contains("not yet implemented"));

    // admin users create
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("create")
        .arg("--username")
        .arg("test")
        .arg("--email")
        .arg("test@example.com")
        .arg("--password")
        .arg("pass")
        .assert()
        .failure()
        .stderr(predicates::str::contains("not yet implemented"));

    // admin users enable
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("enable")
        .arg("user-id")
        .assert()
        .failure()
        .stderr(predicates::str::contains("not yet implemented"));

    // admin users disable
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("disable")
        .arg("user-id")
        .assert()
        .failure()
        .stderr(predicates::str::contains("not yet implemented"));

    // admin users set-role
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("users")
        .arg("set-role")
        .arg("user-id")
        .arg("--role")
        .arg("developer")
        .assert()
        .failure()
        .stderr(predicates::str::contains("not yet implemented"));

    // admin stats
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .failure()
        .stderr(predicates::str::contains("not yet implemented"));

    restore_config(backup);
}

// ============================================================================
// Permission Error Message Tests
// ============================================================================

/// Test error message includes current role
#[tokio::test]
#[serial(config)]
async fn test_error_message_includes_current_role() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try admin command
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .failure()
        .stderr(predicates::str::contains("Your role: developer"));

    restore_config(backup);
}

/// Test error message includes required role
#[tokio::test]
#[serial(config)]
async fn test_error_message_includes_required_role() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try admin command
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .failure()
        .stderr(predicates::str::contains("required"))
        .stderr(predicates::str::contains("admin"))
        .stderr(predicates::str::contains("developer"));

    restore_config(backup);
}

/// Test error message includes helpful action
#[tokio::test]
#[serial(config)]
async fn test_error_message_includes_action_hint() {

    let backup = backup_config();

    // Setup: Create developer account
    let config_dir = get_real_config_dir();
    fs::create_dir_all(&config_dir).unwrap();
    let config = r#"
[server]
url = "http://localhost:28080"

[output]
format = "table"
color = true

[log]
level = "info"

[[accounts]]
name = "developer@localhost"
server = "http://localhost:28080"
username = "developer"
token = "dev_token"
default = true
role = "developer"
"#;
    fs::write(config_dir.join("config.toml"), config).unwrap();

    // Try admin command
    let mut cmd = Command::cargo_bin("oauth-db").unwrap();
    cmd.arg("admin")
        .arg("stats")
        .assert()
        .failure()
        .stderr(
            predicates::str::contains("switch to an account")
                .or(predicates::str::contains("contact administrator"))
        );

    restore_config(backup);
}

// ============================================================================
// Role Missing Scenario Tests
// ============================================================================