defmodule ToweropsWeb.UserSettingsLiveTest do
  use ToweropsWeb.ConnCase, async: true

  import Phoenix.LiveViewTest
  import Towerops.AccountsFixtures

  alias Towerops.Accounts

  describe "UserSettingsLive without sudo mode" do
    setup :register_and_log_in_user

    test "allows access without sudo mode", %{conn: conn} do
      # User settings page is accessible without sudo mode
      {:ok, _view, html} = live(conn, ~p"/users/settings")

      assert html =~ "Account Settings"
    end
  end

  describe "UserSettingsLive with sudo mode" do
    setup :register_and_log_in_user_with_sudo

    test "renders settings page", %{conn: conn} do
      {:ok, _view, html} = live(conn, ~p"/users/settings")

      assert html =~ "Account Settings"
      assert html =~ "Personal Information"
    end

    test "allows updating profile", %{conn: conn, user: user} do
      {:ok, view, _html} = live(conn, ~p"/users/settings?tab=personal")

      # Update profile
      result =
        view
        |> form("#update_profile", user: %{first_name: "John", last_name: "Doe"})
        |> render_submit()

      assert result =~ "Profile updated successfully"

      # Verify database was updated
      updated_user = Accounts.get_user!(user.id)
      assert updated_user.first_name == "John"
      assert updated_user.last_name == "Doe"
    end

    test "allows updating email", %{conn: conn, user: user} do
      new_email = unique_user_email()
      {:ok, view, _html} = live(conn, ~p"/users/settings?tab=account")

      # Update email
      result =
        view
        |> form("#update_email", user: %{email: new_email})
        |> render_submit()

      assert result =~ "A link to confirm your email"

      # Old email should still be in use
      assert Accounts.get_user_by_email(user.email)
    end

    test "allows updating password", %{conn: conn} do
      new_password = valid_user_password()
      {:ok, view, _html} = live(conn, ~p"/users/settings?tab=account")

      # Update password - this will log the user out
      assert {:error, {:redirect, %{to: "/users/log-in"}}} =
               view
               |> form("#update_password",
                 user: %{
                   password: new_password,
                   password_confirmation: new_password
                 }
               )
               |> render_submit()
    end

    test "shows error for mismatched password confirmation", %{conn: conn} do
      new_password = valid_user_password()
      {:ok, view, _html} = live(conn, ~p"/users/settings?tab=account")

      # Try to update password with non-matching confirmation - page stays on form
      html =
        view
        |> form("#update_password",
          user: %{
            password: new_password,
            password_confirmation: "different_password"
          }
        )
        |> render_submit()

      # Should still be on the settings page with the form visible
      assert html =~ "Account Settings"
      assert html =~ "Change Password"
    end

    test "shows tabs navigation", %{conn: conn} do
      {:ok, _view, html} = live(conn, ~p"/users/settings")

      # Check for tab navigation
      assert html =~ "Personal"
      assert html =~ "Account"
      assert html =~ "Security"
      assert html =~ "API"
      assert html =~ "Sessions"
      assert html =~ "Notifications"
    end

    test "allows switching tabs via params", %{conn: conn} do
      {:ok, _view, html} = live(conn, ~p"/users/settings?tab=security")

      assert html =~ "Account Settings"
      # Security tab should be active (would need to check for active class in real template)
    end
  end

  describe "UserSettingsLive TOTP management with sudo mode" do
    setup :register_and_log_in_user_with_sudo

    test "shows enrolled TOTP devices", %{conn: conn, user: user} do
      # Create a TOTP device
      Accounts.create_totp_device(user.id, "Test Authenticator")

      {:ok, _view, html} = live(conn, ~p"/users/settings?tab=security")

      assert html =~ "Test Authenticator"
    end

    test "shows multiple TOTP devices", %{conn: conn, user: user} do
      # Create two TOTP devices
      {:ok, _device1, _secret1} = Accounts.create_totp_device(user.id, "Device 1")
      {:ok, _device2, _secret2} = Accounts.create_totp_device(user.id, "Device 2")

      {:ok, _view, html} = live(conn, ~p"/users/settings?tab=security")

      # Verify both devices are shown
      assert html =~ "Device 1"
      assert html =~ "Device 2"
    end
  end

  describe "UserSettingsLive sessions with sudo mode" do
    setup :register_and_log_in_user_with_sudo

    test "shows active sessions", %{conn: conn} do
      {:ok, _view, html} = live(conn, ~p"/users/settings?tab=sessions")

      assert html =~ "Active Sessions"
      assert html =~ "Login History"
    end
  end

  describe "UserSettingsLive API tokens with sudo mode" do
    setup :register_and_log_in_user_with_sudo

    test "shows API tokens tab", %{conn: conn} do
      {:ok, _view, html} = live(conn, ~p"/users/settings?tab=api")

      assert html =~ "API Tokens"
    end
  end

  describe "UserSettingsLive login history with sudo mode" do
    setup :register_and_log_in_user_with_sudo

    test "shows login history", %{conn: conn} do
      {:ok, _view, html} = live(conn, ~p"/users/settings?tab=sessions")

      assert html =~ "Login History"
    end

    test "paginates login history", %{conn: conn} do
      {:ok, _view, html} = live(conn, ~p"/users/settings?tab=sessions&page=1")

      assert html =~ "Login History"
    end
  end

  # Helper to register user and grant sudo mode
  # Note: user_fixture() already creates users with TOTP enabled by default
  defp register_and_log_in_user_with_sudo(%{conn: conn}) do
    user = user_fixture()

    # Log in and grant sudo mode
    conn =
      conn
      |> log_in_user(user)
      |> init_test_session(%{})
      |> put_session(:user_sudo_granted_at, System.system_time(:second))

    %{conn: conn, user: user}
  end
end