import { describe, it, before, after } from 'node:test';
import assert from 'node:assert/strict';
import supertest from 'supertest';
import { APP } from '../app.js';
import { DBModel } from '../models/index.js';

describe('用户接口集成测试', () => {
  let app, agent;
  const testMobile = '13900000001';
  const testPasswd = 'test123456';
  let token = '';
  let userId = '';

  before(async () => {
    app = new APP();
    agent = supertest(app.app.callback());
    // 等待数据库连接
    await new Promise(resolve => setTimeout(resolve, 2000));
  });

  after(async () => {
    // 清理测试数据
    if (userId) {
      await DBModel.User.delUser(userId);
    }
    app.stop();
  });

  describe('POST /user/register', () => {
    it('应成功注册新用户', async () => {
      const res = await agent
        .post('/user/register')
        .send({
          userInfo: {
            profile: { mobile: testMobile, name: '测试用户' },
            security: { passwd: testPasswd },
          },
        });

      assert.equal(res.body.code, 0, `注册失败: ${res.body.msg}`);
      assert.ok(res.body.data.user);
      assert.ok(res.body.data.user.security.token);
      assert.equal(res.body.data.user.profile.mobile, testMobile);
      // 密码字段不应返回
      assert.equal(res.body.data.user.security.passwd, undefined);
      assert.equal(res.body.data.user.security.passwdSalt, undefined);

      token = res.body.data.user.security.token;
      userId = res.body.data.user._id;
    });

    it('重复注册应返回 409', async () => {
      const res = await agent
        .post('/user/register')
        .send({
          userInfo: {
            profile: { mobile: testMobile, name: '测试用户' },
            security: { passwd: testPasswd },
          },
        });

      assert.equal(res.body.code, 409);
      assert.equal(res.body.msg, '手机号已注册');
    });

    it('缺少手机号应返回 400', async () => {
      const res = await agent
        .post('/user/register')
        .send({
          userInfo: {
            profile: { name: '测试用户' },
            security: { passwd: testPasswd },
          },
        });

      assert.equal(res.body.code, 400);
    });

    it('缺少密码应返回 400', async () => {
      const res = await agent
        .post('/user/register')
        .send({
          userInfo: {
            profile: { mobile: '13900000099' },
            security: {},
          },
        });

      assert.equal(res.body.code, 400);
    });

    it('密码少于6位应返回 400', async () => {
      const res = await agent
        .post('/user/register')
        .send({
          userInfo: {
            profile: { mobile: '13900000098' },
            security: { passwd: '123' },
          },
        });

      assert.equal(res.body.code, 400);
    });
  });

  describe('POST /user/signin', () => {
    it('用正确密码登录应成功', async () => {
      const res = await agent
        .post('/user/signin')
        .send({ mobile: testMobile, passwd: testPasswd });

      assert.equal(res.body.code, 0, `登录失败: ${res.body.msg}`);
      assert.ok(res.body.data.user.security.token);
      // 更新 token
      token = res.body.data.user.security.token;
      // 应记录最后登录信息
      assert.ok(res.body.data.user.security.lastLoginAt);
    });

    it('错误密码应返回 401', async () => {
      const res = await agent
        .post('/user/signin')
        .send({ mobile: testMobile, passwd: 'wrongpassword' });

      assert.equal(res.body.code, 401);
    });

    it('不存在的用户应返回 401', async () => {
      const res = await agent
        .post('/user/signin')
        .send({ mobile: '13999999999', passwd: 'test123456' });

      assert.equal(res.body.code, 401);
    });

    it('缺少手机号应返回 400', async () => {
      const res = await agent
        .post('/user/signin')
        .send({ passwd: testPasswd });

      assert.equal(res.body.code, 400);
    });
  });

  describe('POST /user/userInfo', () => {
    it('用 Authorization Bearer 获取用户信息', async () => {
      const res = await agent
        .post('/user/userInfo')
        .set('Authorization', `Bearer ${token}`)
        .send({});

      assert.equal(res.body.code, 0, `获取用户信息失败: ${res.body.msg}`);
      assert.equal(res.body.data.user.profile.mobile, testMobile);
      assert.equal(res.body.data.user.security.passwd, undefined);
    });

    it('用 body token 获取用户信息（向后兼容）', async () => {
      const res = await agent
        .post('/user/userInfo')
        .send({ token });

      assert.equal(res.body.code, 0);
      assert.equal(res.body.data.user.profile.mobile, testMobile);
    });

    it('无效 token 应返回 401', async () => {
      const res = await agent
        .post('/user/userInfo')
        .set('Authorization', 'Bearer invalid_token')
        .send({});

      assert.equal(res.body.code, 401);
    });

    it('缺少 token 应返回 400', async () => {
      const res = await agent
        .post('/user/userInfo')
        .send({});

      assert.equal(res.body.code, 400);
    });
  });

  describe('POST /user/update', () => {
    it('更新用户信息应成功', async () => {
      const res = await agent
        .post('/user/update')
        .set('Authorization', `Bearer ${token}`)
        .send({
          profile: { name: '更新后的名字' },
        });

      assert.equal(res.body.code, 0, `更新失败: ${res.body.msg}`);
      assert.equal(res.body.data.user.profile.name, '更新后的名字');
    });

    it('无 token 更新应返回 400', async () => {
      const res = await agent
        .post('/user/update')
        .send({ profile: { name: 'test' } });

      assert.equal(res.body.code, 400);
    });
  });

  describe('POST /user/signout', () => {
    it('退出登录应成功', async () => {
      const res = await agent
        .post('/user/signout')
        .set('Authorization', `Bearer ${token}`)
        .send({});

      assert.equal(res.body.code, 0);
      assert.equal(res.body.msg, '退出登录成功');
    });

    it('退出后用旧 token 获取信息应返回 401', async () => {
      const res = await agent
        .post('/user/userInfo')
        .set('Authorization', `Bearer ${token}`)
        .send({});

      assert.equal(res.body.code, 401);
    });
  });

  describe('密码迁移：MD5 → bcrypt', () => {
    it('旧 MD5 用户登录应自动升级密码', async () => {
      // 先注册一个新用户
      const mobile = '13900000002';
      const passwd = 'md5test123';

      // 直接写入一个 MD5 密码的用户
      const crypto = await import('crypto');
      const salt = crypto.randomBytes(8).toString('hex');
      const md5Hash = crypto.createHash('md5').update(passwd + salt).digest('hex');

      const newUser = {
        profile: { mobile, name: 'MD5测试用户' },
        security: { passwd: md5Hash, passwdSalt: salt },
        status: { account: 'normal' },
        app: {},
        social: { wechat: {} },
      };

      const user = await DBModel.User.setUser(newUser);
      assert.ok(user);

      // 用旧密码登录
      const res = await agent
        .post('/user/signin')
        .send({ mobile, passwd });

      assert.equal(res.body.code, 0, `MD5迁移登录失败: ${res.body.msg}`);

      // 验证密码已升级为 bcrypt
      const updatedUser = await DBModel.User.findOne({ 'profile.mobile': mobile });
      assert.ok(updatedUser.security.passwd.startsWith('$2'), '密码应已升级为 bcrypt');
      assert.equal(updatedUser.security.passwdSalt, undefined, 'salt 应已清除');

      // 清理
      await DBModel.User.delUser(updatedUser._id);
    });
  });
});