import assert from 'node:assert/strict';
import {
  diagnoseAliyunPnvsProvider,
  parseSecretRef,
  summarizeSecret,
} from './diagnose-aliyun-pnvs-provider.js';

const tenantId = '00000000-0000-0000-0000-000000000001';

function queryFixture({ providerRows = [], secretRows = [] }) {
  return async (sql, params) => {
    if (sql.includes('from public.tenant_auth_providers')) {
      assert.equal(params[0], tenantId);
      return { rows: providerRows };
    }
    if (sql.includes('from app_private.tenant_secrets')) {
      assert.equal(params[0], tenantId);
      return {
        rows: secretRows.filter(row => row.scope === params[1] && row.key === params[2]),
      };
    }
    throw new Error(`Unexpected SQL: ${sql}`);
  };
}

const goodProviderRows = [
  {
    tenantId,
    provider: 'aliyun-pnvs',
    status: 'active',
    displayName: '阿里云短信认证',
    updatedAt: '2026-07-03T00:00:00.000Z',
    configPublic: {
      signName: '升本刷题通',
      templateCode: 'SMS_123456789',
      endpoint: 'https://dypnsapi.aliyuncs.com',
      regionId: 'cn-hangzhou',
      countryCode: '86',
      codeType: '1',
      codeLength: '6',
      validTime: '300',
      interval: '60',
      templateParam: { code: '##code##', min: '5' },
      secretRef: 'app_private.tenant_secrets:sms:aliyun-pnvs',
    },
  },
];
const goodSecretRows = [
  {
    scope: 'sms',
    key: 'aliyun-pnvs',
    provider: 'aliyun-pnvs',
    accessKeyId: 'LTAI5tExampleId',
    accessKeySecret: 'very-long-secret-value-that-must-not-leak',
    lastRotatedAt: '2026-07-03T00:00:00.000Z',
  },
];

const ok = await diagnoseAliyunPnvsProvider(
  { databaseUrl: 'postgresql://example', tenantId, authSmsProvider: 'aliyun-pnvs' },
  { query: queryFixture({ providerRows: goodProviderRows, secretRows: goodSecretRows }) },
);

assert.equal(ok.ok, true);
assert.equal(ok.provider.found, true);
assert.equal(ok.provider.publicConfig.templateParamHasCodePlaceholder, true);
assert.equal(ok.secret.found, true);
assert.equal(ok.secret.accessKeySecretLength, goodSecretRows[0].accessKeySecret.length);
assert.ok(!JSON.stringify(ok).includes(goodSecretRows[0].accessKeySecret), 'diagnostic output must not include AccessKeySecret plaintext');
assert.ok(!JSON.stringify(ok).includes(goodSecretRows[0].accessKeyId), 'diagnostic output should mask AccessKeyId plaintext');
assert.match(ok.secret.accessKeyIdMasked, /^LTAI\.\.\./);

const missingSecret = await diagnoseAliyunPnvsProvider(
  { databaseUrl: 'postgresql://example', tenantId, authSmsProvider: 'aliyun-pnvs' },
  { query: queryFixture({ providerRows: goodProviderRows, secretRows: [] }) },
);
assert.equal(missingSecret.ok, false);
assert.ok(missingSecret.checks.some(item => item.id === 'db.tenant_secret' && item.status === 'blocker'));

const wrongEnvProvider = await diagnoseAliyunPnvsProvider(
  { databaseUrl: 'postgresql://example', tenantId, authSmsProvider: 'aliyun' },
  { query: queryFixture({ providerRows: goodProviderRows, secretRows: goodSecretRows }) },
);
assert.equal(wrongEnvProvider.ok, false);
assert.ok(wrongEnvProvider.checks.some(item => item.id === 'env.auth_sms_provider' && item.status === 'blocker'));

const invalidSecretRef = parseSecretRef('plain-secret');
assert.equal(invalidSecretRef.valid, false);
assert.equal(invalidSecretRef.scope, 'sms');
assert.equal(invalidSecretRef.key, 'aliyun-pnvs');

const secretSummary = summarizeSecret({
  provider: 'aliyun-pnvs',
  accessKeyId: '  LTAI5tExampleId',
  accessKeySecret: 'secret-value  ',
});
assert.equal(secretSummary.accessKeyIdHasEdgeWhitespace, true);
assert.equal(secretSummary.accessKeySecretHasEdgeWhitespace, true);
assert.ok(!JSON.stringify(secretSummary).includes('secret-value  '));

console.log('[PASS] diagnose Aliyun PNVS provider script');