import assert from "node:assert/strict";
import { readFile } from "node:fs/promises";
import { PGlite } from "../.data/sql-verification/node_modules/@electric-sql/pglite/dist/index.js";
const db = new PGlite();
try {
  await db.exec(`create role anon; create role authenticated; create role service_role bypassrls;
    create schema auth;
    create function auth.uid() returns uuid language sql as $$ select nullif(current_setting('test.uid',true),'')::uuid $$;
    create table auth.users(id uuid primary key,encrypted_password text,email text,email_confirmed_at timestamptz,is_anonymous boolean);
    insert into auth.users values
      ('00000000-0000-4000-8000-000000000001','', 'legacy@example.com',now(),false),
      ('00000000-0000-4000-8000-000000000002','existing-hash','password@example.com',now(),false),
      ('00000000-0000-4000-8000-000000000003',null,'unverified@example.com',null,false),
      ('00000000-0000-4000-8000-000000000004',null,null,null,true);`);
  await db.exec(
    await readFile(
      "supabase/migrations/20261007055439_legacy_password_claims.sql",
      "utf8",
    ),
  );
  for (const role of ["anon", "authenticated"]) {
    await db.exec(`set role ${role}`);
    await assert.rejects(
      db.query(
        "select public.claim_legacy_password('00000000-0000-4000-8000-000000000001')",
      ),
      /permission denied/,
    );
    await assert.rejects(
      db.query(
        "select public.legacy_password_needed('00000000-0000-4000-8000-000000000001')",
      ),
      /permission denied/,
    );
    await db.exec("reset role");
  }
  await db.exec("set role service_role");
  const call = async (fn, ending) =>
    (
      await db.query(
        `select public.${fn}('00000000-0000-4000-8000-00000000000${ending}') as result`,
      )
    ).rows[0].result;
  assert.equal(await call("legacy_password_needed", 1), true);
  for (const ending of [2, 3, 4, 5]) {
    assert.equal(await call("legacy_password_needed", ending), false);
    assert.equal(await call("claim_legacy_password", ending), false);
  }
  await db.exec(
    "select set_config('test.uid','00000000-0000-4000-8000-000000000002',false)",
  );
  assert.equal(await call("claim_legacy_password", 1), false);
  await db.exec("select set_config('test.uid','',false)");
  assert.equal(await call("claim_legacy_password", 1), true);
  assert.equal(await call("claim_legacy_password", 1), false);
  assert.equal(await call("legacy_password_needed", 1), false);
  const columns = (
    await db.query(
      "select column_name from information_schema.columns where table_schema='minegeo_private' and table_name='legacy_password_claims'",
    )
  ).rows.map((r) => r.column_name);
  assert.deepEqual(columns.sort(), ["claimed_at", "user_id"]);
  console.log(
    "Initial password SQL passed: verified legacy owners eligible once; existing passwords protected; anonymous, unverified and cross-account attempts denied; no password stored.",
  );
} catch (error) {
  console.error(error.message);
  process.exitCode = 1;
} finally {
  await db.close();
}