import { describe, expect, it } from 'vitest'
import {
  assertUsablePin, hashPin, verifyPin,
  FRESH_LOCKOUT, isLocked, recordFailure, recordSuccess, DEFAULT_LOCKOUT,
  can, gateFor,
  openSession,
} from '@sims/auth'
import type { BusinessDay, User } from '@sims/domain'

describe('PIN policy & hashing', () => {
  it('accepts sane PINs, rejects weak ones', () => {
    expect(() => assertUsablePin('4728')).not.toThrow()
    expect(() => assertUsablePin('12')).toThrow(/4–6 digits/)
    expect(() => assertUsablePin('0000')).toThrow(/repeated/)
    expect(() => assertUsablePin('1234')).toThrow(/sequence/)
    expect(() => assertUsablePin('8765')).toThrow(/sequence/)
  })
  it('hashes with per-credential salt and verifies', () => {
    const stored = hashPin('4728')
    expect(verifyPin('4728', stored)).toBe(true)
    expect(verifyPin('4729', stored)).toBe(false)
    expect(hashPin('4728').hash).not.toBe(stored.hash) // fresh salt every time
  })
})

describe('lockout reducer', () => {
  it('locks after max failures and unlocks after the window', () => {
    let s = FRESH_LOCKOUT
    for (let i = 0; i < DEFAULT_LOCKOUT.maxFailures; i++) {
      expect(isLocked(s, 1000)).toBe(false)
      s = recordFailure(s, 1000)
    }
    expect(isLocked(s, 1000)).toBe(true)
    expect(isLocked(s, 1000 + DEFAULT_LOCKOUT.lockMs)).toBe(false)
    expect(isLocked(recordSuccess(), 1000)).toBe(false)
  })
})

const user = (roles: User['roles'], active = true): Pick<User, 'roles' | 'active'> => ({ roles, active })

describe('permissions & gates', () => {
  it('grants by role', () => {
    expect(can(user(['cashier']), 'BILL_CREATE')).toBe(true)
    expect(can(user(['cashier']), 'PRICE_OVERRIDE')).toBe(false)
    expect(can(user(['cashier'], false), 'BILL_CREATE')).toBe(false)
  })
  it('in-flow gate escalates to supervisor PIN instead of hiding (09-UX §5.5)', () => {
    expect(gateFor(user(['cashier']), 'PRICE_OVERRIDE')).toBe('supervisor-pin')
    expect(gateFor(user(['cashier']), 'DAY_BEGIN')).toBe('supervisor-pin')
    expect(gateFor(user(['supervisor']), 'PRICE_OVERRIDE')).toBe('allow')
  })
})

describe('POS session — Day Begin binding', () => {
  const day: BusinessDay = {
    tenantId: 't1', storeId: 's1', date: '2026-07-09',
    openedAt: '2026-07-09T09:01:00+05:30', openedBy: 'mgr',
  }
  const base = {
    tenantId: 't1', storeId: 's1', counterId: 'c1', userId: 'u1', shiftId: 'sh1',
    nowWallClock: '2026-07-09T09:05:00+05:30',
  }
  it('binds the session to the working date, not the wall clock', () => {
    expect(openSession({ ...base, day }).businessDate).toBe('2026-07-09')
  })
  it('refuses a closed day or another store’s day', () => {
    expect(() => openSession({ ...base, day: { ...day, closedAt: 'x', closedBy: 'mgr' } })).toThrow(/Day Begin/)
    expect(() => openSession({ ...base, day: { ...day, storeId: 's2' } })).toThrow(/another store/)
  })
})