package auth

import (
	"context"
	"errors"
	"strings"
	"testing"
)

func TestRecoveryGenerateAndRedeem(t *testing.T) {
	db := openAuthDB(t)
	s := NewRecoveryStore(db)
	ctx := context.Background()

	codes, err := s.GenerateBatch(ctx)
	if err != nil {
		t.Fatalf("GenerateBatch: %v", err)
	}
	if len(codes) != RecoveryCodeCount {
		t.Fatalf("got %d codes, want %d", len(codes), RecoveryCodeCount)
	}
	for _, c := range codes {
		if !strings.Contains(c, "-") {
			t.Errorf("code %q not formatted with dashes", c)
		}
	}

	// Codes are unique.
	seen := map[string]bool{}
	for _, c := range codes {
		if seen[c] {
			t.Errorf("duplicate code: %s", c)
		}
		seen[c] = true
	}

	// Redeem one.
	if err := s.Redeem(ctx, codes[0]); err != nil {
		t.Fatalf("Redeem: %v", err)
	}
	// Same code twice fails.
	if err := s.Redeem(ctx, codes[0]); !errors.Is(err, ErrInvalidRecoveryCode) {
		t.Errorf("second redeem: %v, want ErrInvalidRecoveryCode", err)
	}

	// Count unused is now 9.
	left, err := s.CountUnused(ctx)
	if err != nil {
		t.Fatalf("CountUnused: %v", err)
	}
	if left != RecoveryCodeCount-1 {
		t.Errorf("CountUnused: %d, want %d", left, RecoveryCodeCount-1)
	}
}

func TestRecoveryRedeemNormalizes(t *testing.T) {
	db := openAuthDB(t)
	s := NewRecoveryStore(db)
	ctx := context.Background()
	codes, _ := s.GenerateBatch(ctx)

	// Whitespace, mixed case, missing dashes.
	munged := "  " + strings.ToUpper(strings.ReplaceAll(codes[3], "-", "")) + "  "
	if err := s.Redeem(ctx, munged); err != nil {
		t.Fatalf("Redeem(munged): %v", err)
	}
}

func TestRecoveryRedeemUnknown(t *testing.T) {
	db := openAuthDB(t)
	s := NewRecoveryStore(db)
	if err := s.Redeem(context.Background(), "zzzz-zzzz-zzzz-zzzz"); !errors.Is(err, ErrInvalidRecoveryCode) {
		t.Errorf("got %v, want ErrInvalidRecoveryCode", err)
	}
}

func TestRecoveryRedeemEmpty(t *testing.T) {
	db := openAuthDB(t)
	s := NewRecoveryStore(db)
	if err := s.Redeem(context.Background(), ""); !errors.Is(err, ErrInvalidRecoveryCode) {
		t.Errorf("got %v, want ErrInvalidRecoveryCode", err)
	}
}

func TestRecoveryGenerateBatchInvalidatesPriorUnused(t *testing.T) {
	db := openAuthDB(t)
	s := NewRecoveryStore(db)
	ctx := context.Background()

	first, _ := s.GenerateBatch(ctx)
	_, _ = s.GenerateBatch(ctx)

	// A code from the first batch should no longer redeem.
	if err := s.Redeem(ctx, first[0]); !errors.Is(err, ErrInvalidRecoveryCode) {
		t.Errorf("first-batch code still valid after regeneration: %v", err)
	}
}