package httpapi_test

import (
	"fmt"
	"net/http"
	"strings"
	"testing"

	"git.yeij.top/AskaEth/Scoreboard/server/internal/auth"
)

// 建号与重置密码都必须拒绝超过 bcrypt 上限的密码，避免静默截断（P2-6）。
func TestUserPasswordLengthLimits(t *testing.T) {
	env := newTestEnv(t)
	env.createUser("admin", "admin-pass", "admin")
	client, _ := env.client()
	env.login(client, "admin", "admin-pass")

	tooLong := strings.Repeat("a", auth.MaxPasswordBytes+1)
	status, env2 := env.do(client, http.MethodPost, "/api/users", map[string]any{
		"username": "u1", "password": tooLong, "role": "recorder",
	}, true)
	if status != http.StatusBadRequest {
		t.Fatalf("超长密码建号应 400，得到 %d %+v", status, env2.Error)
	}

	status, env2 = env.do(client, http.MethodPost, "/api/users", map[string]any{
		"username": "u1", "password": "u1-pass-123", "role": "recorder",
	}, true)
	if status != http.StatusOK {
		t.Fatalf("建号应 200，得到 %d %+v", status, env2.Error)
	}
	created := decodeData[map[string]any](t, env2)
	id, _ := created["id"].(float64)
	if id == 0 {
		t.Fatalf("建号响应缺少 id: %+v", created)
	}

	status, env2 = env.do(client, http.MethodPost, fmt.Sprintf("/api/users/%d/password", int64(id)),
		map[string]any{"password": tooLong}, true)
	if status != http.StatusBadRequest {
		t.Fatalf("超长密码重置应 400，得到 %d %+v", status, env2.Error)
	}
}