/**
 * Live end-to-end check of the D20 master OTP against a running API.
 * All Persian text is a literal in this file, never a shell argument (D15).
 */
const { PrismaClient } = require('@prisma/client');
const prisma = new PrismaClient();
const API = 'http://localhost:3000/api';
let pass = 0, fail = 0;
const chk = (c, m) => { c ? pass++ : fail++; console.log((c ? '  PASS  ' : '  FAIL  ') + m); };

const MASTER = '778899';

(async () => {
  const c = await prisma.customer.findFirst({
    where: { isActive: true, isArchived: false }, select: { id: true, mobile: true, fullName: true },
  });
  if (!c) { console.log('no active customer to test with'); process.exit(1); }
  console.log(`Testing against customer ${c.fullName} (${c.mobile})\n`);

  const verify = async (mobile, code) => {
    const r = await fetch(API + '/customer/auth/verify-otp', {
      method: 'POST', headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ username: mobile, password: code }),
    });
    return { status: r.status, body: await r.json().catch(() => ({})) };
  };

  console.log('CASE 1 — the master code signs an active customer in');
  const a = await verify(c.mobile, MASTER);
  chk(a.status === 200 || a.status === 201, `HTTP ${a.status}`);
  chk(typeof a.body.token === 'string' && a.body.token.length > 20, 'a JWT came back');
  chk(a.body.customer?.mobile === c.mobile, 'it is THIS customer, not another');

  console.log('\n  the token actually works on a protected customer route');
  const me = await fetch(API + '/customer/me', { headers: { Authorization: 'Bearer ' + a.body.token } });
  chk(me.status === 200, `GET customer/me -> ${me.status}`);

  console.log('\nCASE 1b — Persian digits for the same master code');
  const p = await verify(c.mobile, '۷۷۸۸۹۹');
  chk(p.status === 200 || p.status === 201, `HTTP ${p.status} — faToEn applied to the code`);

  console.log('\nCASE 2 — NEGATIVE: a near-miss code is still rejected');
  const bad = await verify(c.mobile, '778898');
  chk(bad.status === 401, `HTTP ${bad.status} (expected 401)`);
  chk(!bad.body.token, 'no token issued');

  console.log('\nCASE 2b — NEGATIVE: an unknown mobile is rejected even with the master code');
  const unknown = await verify('09999999999', MASTER);
  chk(unknown.status === 401, `HTTP ${unknown.status} (expected 401)`);

  console.log('\nCASE 2c — NEGATIVE: an INACTIVE customer is rejected even with the master code');
  const inactive = await prisma.customer.findFirst({ where: { isActive: false }, select: { mobile: true } });
  if (inactive) {
    const r = await verify(inactive.mobile, MASTER);
    chk(r.status === 401, `HTTP ${r.status} (expected 401)`);
  } else {
    console.log('  (skipped — no inactive customer in the DB)');
  }

  console.log(`\npassed: ${pass}   failed: ${fail}`);
  await prisma.$disconnect();
  process.exit(fail ? 1 : 0);
})().catch(async (e) => { console.error(e); await prisma.$disconnect(); process.exit(1); });