// tests/users.test.ts
import request from 'supertest';
import { app } from '../src/app';
import { db } from '../src/db';

beforeEach(async () => {
  await db.migrate.latest();
  await db.seed.run();
});

afterEach(async () => {
  await db.migrate.rollback();
});

describe('GET /users/:id', () => {
  it('returns 200 with user data for a valid id', async () => {
    const res = await request(app)
      .get('/users/1')
      .set('Authorization', 'Bearer test-token')
      .expect(200);

    expect(res.body).toMatchObject({
      id: 1,
      email: expect.stringContaining('@'),
      createdAt: expect.any(String),
    });
  });

  it('returns 404 when user does not exist', async () => {
    const res = await request(app)
      .get('/users/99999')
      .set('Authorization', 'Bearer test-token')
      .expect(404);

    expect(res.body).toMatchObject({
      type: expect.stringContaining('not-found'),
      status: 404,
    });
  });

  it('returns 401 when no auth token is provided', async () => {
    await request(app).get('/users/1').expect(401);
  });
});

// tests/graphql/users.test.ts
import { ApolloServer } from '@apollo/server';
import { typeDefs } from '../src/schema';
import { resolvers } from '../src/resolvers';
import { createTestContext } from './helpers/context';

let server: ApolloServer;

beforeAll(async () => {
  server = new ApolloServer({ typeDefs, resolvers });
  await server.start();
});

afterAll(async () => {
  await server.stop();
});

describe('Query.user', () => {
  it('returns user fields when authenticated', async () => {
    const { body } = await server.executeOperation(
      {
        query: `query GetUser($id: ID!) {
          user(id: $id) { id email createdAt }
        }`,
        variables: { id: '1' },
      },
      { contextValue: createTestContext({ userId: 'viewer-1' }) }
    );

    expect(body.kind).toBe('single');
    if (body.kind === 'single') {
      expect(body.singleResult.errors).toBeUndefined();
      expect(body.singleResult.data?.user).toMatchObject({
        id: '1',
        email: expect.any(String),
      });
    }
  });

  it('returns null for a user that does not exist', async () => {
    const { body } = await server.executeOperation(
      { query: `query { user(id: "nonexistent") { id } }` },
      { contextValue: createTestContext({ userId: 'viewer-1' }) }
    );

    if (body.kind === 'single') {
      expect(body.singleResult.data?.user).toBeNull();
    }
  });
});

// consumer/tests/order-service.pact.test.ts
import { PactV3, MatchersV3 } from '@pact-foundation/pact';
import { fetchOrder } from '../src/order-client';

const { like, iso8601DateTimeWithMillis } = MatchersV3;

const provider = new PactV3({
  consumer: 'checkout-service',
  provider: 'order-service',
  dir: './pacts',
});

describe('Order Service contract', () => {
  it('returns order details for a valid order id', async () => {
    await provider
      .given('order 42 exists')
      .uponReceiving('a request for order 42')
      .withRequest({ method: 'GET', path: '/orders/42' })
      .willRespondWith({
        status: 200,
        body: {
          id: like('42'),
          status: like('confirmed'),
          total: like(99.99),
          createdAt: iso8601DateTimeWithMillis(),
        },
      })
      .executeTest(async (mockServer) => {
        const order = await fetchOrder('42', mockServer.url);
        expect(order.id).toBe('42');
        expect(order.status).toBeDefined();
      });
  });
});

// provider/tests/order-service.pact.verify.test.ts
import { Verifier } from '@pact-foundation/pact';

describe('Provider verification', () => {
  it('satisfies all consumer pacts', () => {
    return new Verifier({
      provider: 'order-service',
      providerBaseUrl: 'http://localhost:3001',
      pactUrls: ['./pacts/checkout-service-order-service.json'],
      stateHandlers: {
        'order 42 exists': async () => {
          await seedOrder({ id: '42', status: 'confirmed', total: 99.99 });
        },
      },
    }).verifyProvider();
  });
});

// tests/msw/handlers.ts
import { http, HttpResponse } from 'msw';

export const handlers = [
  http.get('https://api.example.com/users/:id', ({ params }) => {
    if (params.id === '404') {
      return HttpResponse.json({ type: 'not-found', status: 404 }, { status: 404 });
    }
    return HttpResponse.json({ id: params.id, email: 'test@example.com' });
  }),

  http.post('https://api.example.com/orders', async ({ request }) => {
    const body = await request.json();
    return HttpResponse.json({ id: 'order-1', ...body }, { status: 201 });
  }),
];

// tests/setup.ts
import { setupServer } from 'msw/node';
import { handlers } from './msw/handlers';

export const server = setupServer(...handlers);

beforeAll(() => server.listen({ onUnhandledRequest: 'error' }));
afterEach(() => server.resetHandlers());
afterAll(() => server.close());

// Override handlers for a single test
it('handles API errors gracefully', async () => {
  server.use(
    http.get('https://api.example.com/users/1', () =>
      HttpResponse.json({ message: 'Internal Server Error' }, { status: 500 })
    )
  );
  // test code...
});

// src/schemas/user.ts
import { z } from 'zod';

export const UserSchema = z.object({
  id: z.string().uuid(),
  email: z.string().email(),
  role: z.enum(['admin', 'user', 'viewer']),
  createdAt: z.string().datetime(),
  profile: z.object({
    displayName: z.string().min(1),
    avatarUrl: z.string().url().nullable(),
  }),
});

export type User = z.infer<typeof UserSchema>;

// tests/users.schema.test.ts
import request from 'supertest';
import { app } from '../src/app';
import { UserSchema } from '../src/schemas/user';

it('GET /users/:id response conforms to UserSchema', async () => {
  const res = await request(app)
    .get('/users/1')
    .set('Authorization', 'Bearer test-token')
    .expect(200);

  const result = UserSchema.safeParse(res.body);
  if (!result.success) {
    throw new Error(`Schema validation failed: ${result.error.message}`);
  }
});

// Validate a list response
it('GET /users response items conform to UserSchema', async () => {
  const res = await request(app).get('/users').expect(200);

  const listSchema = z.object({
    data: z.array(UserSchema),
    pagination: z.object({ nextCursor: z.string().nullable(), hasNextPage: z.boolean() }),
  });

  expect(() => listSchema.parse(res.body)).not.toThrow();
});

// tests/auth.test.ts
import request from 'supertest';
import { app } from '../src/app';
import { signToken } from './helpers/auth';

const PROTECTED = '/api/v1/profile';

describe('Authentication middleware', () => {
  it('returns 401 when Authorization header is missing', async () => {
    await request(app).get(PROTECTED).expect(401);
  });

  it('returns 401 when token is malformed', async () => {
    await request(app)
      .get(PROTECTED)
      .set('Authorization', 'Bearer not.a.valid.jwt')
      .expect(401);
  });

  it('returns 401 when token is expired', async () => {
    const expired = signToken({ userId: '1' }, { expiresIn: '-1s' });
    await request(app)
      .get(PROTECTED)
      .set('Authorization', `Bearer ${expired}`)
      .expect(401);
  });

  it('returns 403 when token lacks required scope', async () => {
    const token = signToken({ userId: '1', scopes: ['read:orders'] });
    await request(app)
      .get('/api/v1/admin/users')
      .set('Authorization', `Bearer ${token}`)
      .expect(403);
  });

  it('returns 200 when token is valid and has correct scope', async () => {
    const token = signToken({ userId: '1', scopes: ['read:profile'] });
    await request(app)
      .get(PROTECTED)
      .set('Authorization', `Bearer ${token}`)
      .expect(200);
  });
});

// tests/error-handling.test.ts
import request from 'supertest';
import { app } from '../src/app';
import { db } from '../src/db';

describe('Error handling', () => {
  it('returns RFC 7807 error format for 422 validation failures', async () => {
    const res = await request(app)
      .post('/users')
      .set('Authorization', 'Bearer test-token')
      .send({ email: 'not-an-email' })
      .expect(422);

    expect(res.body).toMatchObject({
      type: expect.stringContaining('validation'),
      title: expect.any(String),
      status: 422,
      errors: expect.arrayContaining([
        expect.objectContaining({ field: 'email' }),
      ]),
    });
  });

  it('returns 409 when creating a user with a duplicate email', async () => {
    await request(app)
      .post('/users')
      .set('Authorization', 'Bearer test-token')
      .send({ email: 'duplicate@example.com', password: 'secret123' })
      .expect(201);

    await request(app)
      .post('/users')
      .set('Authorization', 'Bearer test-token')
      .send({ email: 'duplicate@example.com', password: 'secret123' })
      .expect(409);
  });

  it('does not leak stack traces in 500 responses', async () => {
    jest.spyOn(db, 'query').mockRejectedValueOnce(new Error('DB connection lost'));

    const res = await request(app)
      .get('/users/1')
      .set('Authorization', 'Bearer test-token')
      .expect(500);

    expect(JSON.stringify(res.body)).not.toContain('Error:');
    expect(JSON.stringify(res.body)).not.toContain('at ');
    expect(res.body.status).toBe(500);
  });

  it('returns 400 for malformed JSON body', async () => {
    await request(app)
      .post('/users')
      .set('Authorization', 'Bearer test-token')
      .set('Content-Type', 'application/json')
      .send('{ invalid json }')
      .expect(400);
  });
});