import { identityApp, type IdentityApp } from './helpers/identity-app';
import { addressInput, secondActor } from './helpers/commerce';

describe('private address book', () => {
  let ctx: IdentityApp;
  beforeAll(async () => {
    ctx = await identityApp();
  }, 60000);
  afterAll(async () => {
    await ctx?.close();
  });
  const auth = { type: 'bearer' as const };
  it('selects one default and selects a replacement after deletion', async () => {
    const first = await ctx
      .api()
      .post('/api/v1/addresses')
      .auth(ctx.token, auth)
      .send(addressInput)
      .expect(201);
    expect(first.body.isDefault).toBe(true);
    const second = await ctx
      .api()
      .post('/api/v1/addresses')
      .auth(ctx.token, auth)
      .send({ ...addressInput, line1: '13 Test Road', isDefault: true })
      .expect(201);
    const list = await ctx
      .api()
      .get('/api/v1/addresses')
      .auth(ctx.token, auth)
      .expect(200);
    expect(
      list.body.filter((row: { isDefault: boolean }) => row.isDefault),
    ).toHaveLength(1);
    await ctx
      .api()
      .put(`/api/v1/addresses/${second.body.id}`)
      .auth(ctx.token, auth)
      .send({ ...addressInput, recipient: 'Changed', isDefault: true })
      .expect(200);
    await ctx
      .api()
      .delete(`/api/v1/addresses/${second.body.id}`)
      .auth(ctx.token, auth)
      .expect(204);
    expect(
      await ctx.db.address.findUnique({ where: { id: first.body.id } }),
    ).toMatchObject({ isDefault: true });
  });
  it('denies access to another user address, including within the same organization', async () => {
    const owner = await ctx
      .api()
      .post('/api/v1/addresses')
      .auth(ctx.token, auth)
      .send(addressInput)
      .expect(201);
    const actor = await secondActor(ctx);
    const own = await ctx
      .api()
      .get('/api/v1/addresses')
      .auth(actor.token, auth)
      .expect(200);
    expect(own.body).toEqual([]);
    await ctx
      .api()
      .put(`/api/v1/addresses/${owner.body.id}`)
      .auth(actor.token, auth)
      .send(addressInput)
      .expect(404);
    await ctx
      .api()
      .delete(`/api/v1/addresses/${owner.body.id}`)
      .auth(actor.token, auth)
      .expect(404);
  });
  it('rejects invalid contact fields and user-id injection', async () => {
    await ctx
      .api()
      .post('/api/v1/addresses')
      .auth(ctx.token, auth)
      .send({ ...addressInput, phone: '123' })
      .expect(400);
    await ctx
      .api()
      .post('/api/v1/addresses')
      .auth(ctx.token, auth)
      .send({ ...addressInput, userId: ctx.owner.userId })
      .expect(400);
    await ctx.api().get('/api/v1/addresses').expect(401);
  });
});