package mock

import (
	"context"
	"testing"

	"tera-clone/services/tera-api/internal/domain"
)

func TestReauthenticationUsesSessionAccountAndPreservesSession(t *testing.T) {
	store := NewStore(fixedClock)
	defer store.Close()
	force := false
	_, err := store.CreateAuthUser(context.Background(), domain.AuthUserCreateRequest{Username: "second-admin", Password: "second-admin-secret", Role: "administrator", ForceChange: &force})
	if err != nil {
		t.Fatal(err)
	}
	session, err := store.Login(context.Background(), domain.AuthLoginRequest{Username: "second-admin", Password: "second-admin-secret"})
	if err != nil {
		t.Fatal(err)
	}
	actor, err := store.ActorBySession(context.Background(), session.SessionToken)
	if err != nil {
		t.Fatal(err)
	}
	ctx := domain.WithActor(context.Background(), actor)
	if err := store.VerifyCurrentPassword(ctx, "mock-admin-secret"); err == nil {
		t.Fatal("another administrator's password accepted")
	}
	if err := store.VerifyCurrentPassword(ctx, "second-admin-secret"); err != nil {
		t.Fatal(err)
	}
	if _, err := store.ActorBySession(context.Background(), session.SessionToken); err != nil {
		t.Fatalf("reauthentication replaced active session: %v", err)
	}
}