package onboarding

import (
	"github.com/google/uuid"
	"testing"
)

func TestAdminPhoneProvisionPreservesIdentityAndRefusesConflicts(t *testing.T) {
	f := newLoginFixture(t)
	const user = "10000000-0000-0000-0000-000000000101"
	const issuer = "http://localhost:58180/realms/voice-local"
	const subject = "00000000-0000-0000-0000-000000000101"
	created, err := f.s.ProvisionCustomerPhone(f.ctx, user, issuer, subject, f.phone, "InitialOnly123!", uuid.NewString())
	must(t, err)
	if !created {
		t.Fatal("not created")
	}
	created, err = f.s.ProvisionCustomerPhone(f.ctx, user, issuer, subject, f.phone, "InitialOnly123!", uuid.NewString())
	must(t, err)
	if created {
		t.Fatal("retry changed credential")
	}
	if _, err = f.s.ProvisionCustomerPhone(f.ctx, user, issuer, subject, f.phone, "DifferentOnly123!", uuid.NewString()); err == nil {
		t.Fatal("password overwritten")
	}
	if _, err = f.s.ProvisionCustomerPhone(f.ctx, user, issuer, "wrong-identity", f.phone, "InitialOnly123!", uuid.NewString()); err == nil {
		t.Fatal("wrong identity accepted")
	}
	// The existing customer identity is used even when login starts with SMS.
	account, csrf := f.smsAccount()
	p, err := f.s.AccountPrincipal(f.ctx, account.Value, csrf, true)
	must(t, err)
	if p.Issuer != issuer || p.Subject != subject {
		t.Fatal("SMS created a second identity")
	}
	var count int
	must(t, f.s.pool.QueryRow(f.ctx, `SELECT count(*) FROM customer_phone_credential WHERE issuer=$1 AND subject=$2`, issuer, subject).Scan(&count))
	if count != 1 {
		t.Fatal("duplicate credential")
	}
}