$ErrorActionPreference = 'Stop'
$PSNativeCommandUseErrorActionPreference = $true

$projectRoot = Split-Path -Parent $PSScriptRoot
Set-Location -LiteralPath $projectRoot
$tokenUrl = 'http://localhost:58180/realms/voice-local/protocol/openid-connect/token'

function Get-LocalAccessToken([string]$Username) {
    $response = Invoke-RestMethod -Method Post -Uri $tokenUrl `
        -ContentType 'application/x-www-form-urlencoded' `
        -Body @{
            grant_type = 'password'
            client_id  = 'voice-platform-web'
            username   = $Username
            password   = 'LocalOnly123!'
            scope      = 'openid'
        }
    return $response.access_token
}

$expectedRoles = @{ owner = 'owner'; editor = 'editor'; outsider = 'viewer' }
foreach ($username in $expectedRoles.Keys) {
    $accessToken = Get-LocalAccessToken -Username $username
    $currentUser = Invoke-RestMethod -Uri 'http://localhost:58080/api/v1/me' `
        -Headers @{ Authorization = "Bearer $accessToken" }
    $role = $currentUser.data.accounts[0].household_memberships[0].role
    if ($role -ne $expectedRoles[$username]) {
        throw "用户 $username 的角色是 $role，预期为 $($expectedRoles[$username])。"
    }
    Write-Host "OIDC映射通过：$username -> $role"
}

try {
    Invoke-WebRequest -Uri 'http://localhost:58080/api/v1/me' -ErrorAction Stop | Out-Null
    throw '未登录请求不应成功。'
} catch {
    if ([int]$_.Exception.Response.StatusCode -ne 401) { throw }
    Write-Host '未登录请求正确返回401。'
}

$env:TEST_DATABASE_URL = 'postgres://voice:voice_dev_only@localhost:55432/voice_platform?sslmode=disable'
go test ./internal/identity ./internal/idempotency ./internal/audit ./internal/outbox -count=1
Write-Host '身份、租户隔离、幂等、审计和outbox集成测试通过。'