import request from 'supertest'
import { prisma } from '../../lib/prisma'
import { createApp } from '../../app'
import {
  authHeader,
  createCompanyWithEmployee,
  signEmployeeToken,
} from '../helpers/fixtures'

const app = createApp()

describe('Companies API — brand credential exposure (VF-01)', () => {
  let companyId: string
  let ownerToken: string
  let agentToken: string

  beforeAll(async () => {
    const { company, employee } = await createCompanyWithEmployee({ role: 'OWNER' })
    companyId = company.id
    ownerToken = signEmployeeToken(employee.id, companyId, 'OWNER')

    const agent = await prisma.employee.create({
      data: {
        companyId,
        clerkUserId: `clerk_brand_${Date.now()}`,
        firstName: 'Agent',
        lastName:  'Brand',
        email:     `agent-brand-${Date.now()}@test.com`,
        role:      'AGENT',
      },
    })
    agentToken = signEmployeeToken(agent.id, companyId, 'AGENT')

    // Seed brand with real-looking payment credentials
    await prisma.brandSettings.create({
      data: {
        companyId,
        displayName:       company.name,
        subdomain:         `brand-test-${Date.now()}`,
        amanpayMerchantId: 'merchant-secret-id',
        amanpaySecretKey:  'aman-super-secret-key',
        paypalEmail:       'payments@example.com',
        paypalMerchantId:  'paypal-merchant-secret',
      } as any,
    })
  })

  describe('GET /api/v1/companies/me/brand', () => {
    it('returns 401 without auth', async () => {
      const res = await request(app).get('/api/v1/companies/me/brand')
      expect(res.status).toBe(401)
    })

    it('does not expose amanpaySecretKey in the response', async () => {
      const res = await request(app)
        .get('/api/v1/companies/me/brand')
        .set(authHeader(ownerToken))

      expect(res.status).toBe(200)
      expect(res.body.data).not.toHaveProperty('amanpaySecretKey')
    })

    it('does not expose amanpayMerchantId in the response', async () => {
      const res = await request(app)
        .get('/api/v1/companies/me/brand')
        .set(authHeader(ownerToken))

      expect(res.status).toBe(200)
      expect(res.body.data).not.toHaveProperty('amanpayMerchantId')
    })

    it('does not expose paypalEmail in the response', async () => {
      const res = await request(app)
        .get('/api/v1/companies/me/brand')
        .set(authHeader(ownerToken))

      expect(res.status).toBe(200)
      expect(res.body.data).not.toHaveProperty('paypalEmail')
    })

    it('does not expose paypalMerchantId in the response', async () => {
      const res = await request(app)
        .get('/api/v1/companies/me/brand')
        .set(authHeader(ownerToken))

      expect(res.status).toBe(200)
      expect(res.body.data).not.toHaveProperty('paypalMerchantId')
    })

    it('returns amanpayConfigured=true when credentials are set', async () => {
      const res = await request(app)
        .get('/api/v1/companies/me/brand')
        .set(authHeader(ownerToken))

      expect(res.status).toBe(200)
      expect(res.body.data.amanpayConfigured).toBe(true)
    })

    it('returns paypalConfigured=true when credentials are set', async () => {
      const res = await request(app)
        .get('/api/v1/companies/me/brand')
        .set(authHeader(ownerToken))

      expect(res.status).toBe(200)
      expect(res.body.data.paypalConfigured).toBe(true)
    })

    it('is accessible to AGENT role (no role gate on this endpoint)', async () => {
      const res = await request(app)
        .get('/api/v1/companies/me/brand')
        .set(authHeader(agentToken))

      expect(res.status).toBe(200)
      expect(res.body.data).not.toHaveProperty('amanpaySecretKey')
      expect(res.body.data).not.toHaveProperty('amanpayMerchantId')
    })

    it('returns amanpayConfigured=false when credentials are absent', async () => {
      const { company: c2, employee: e2 } = await createCompanyWithEmployee({ role: 'OWNER' })
      const t2 = signEmployeeToken(e2.id, c2.id, 'OWNER')

      await prisma.brandSettings.create({
        data: {
          companyId:   c2.id,
          displayName: c2.name,
          subdomain:   `no-creds-${Date.now()}`,
        } as any,
      })

      const res = await request(app)
        .get('/api/v1/companies/me/brand')
        .set(authHeader(t2))

      expect(res.status).toBe(200)
      expect(res.body.data.amanpayConfigured).toBe(false)
      expect(res.body.data.paypalConfigured).toBe(false)
    })
  })
})
