package com.mydreamjob.auth.company;

import com.mydreamjob.audit.AuditContext;
import com.mydreamjob.audit.AuditService;
import com.mydreamjob.auth.AuthSessionService;
import com.mydreamjob.auth.SmsVerificationService;
import com.mydreamjob.auth.User;
import com.mydreamjob.auth.UserRepository;
import com.mydreamjob.auth.password.PasswordPolicy;
import com.mydreamjob.company.Company;
import com.mydreamjob.company.CompanyRepository;
import com.mydreamjob.deletion.AccountDeletionPhoneHasher;
import com.mydreamjob.deletion.AccountDeletionRepository;
import org.junit.jupiter.api.Test;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import java.time.Clock;
import java.time.Instant;
import java.time.ZoneOffset;
import java.util.Optional;

import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.ArgumentMatchers.*;
import static org.mockito.Mockito.*;

class CompanyRegistrationSensitiveDataTest {
    @Test
    void responseAndAuditContainNoPasswordCodePhoneHashOrToken() {
        String phone = "19900000301";
        String password = "Company-strong-password-2026";
        CompanyRegistrationProperties properties = new CompanyRegistrationProperties();
        properties.setEnabled("true");
        SmsVerificationService sms = mock(SmsVerificationService.class);
        UserRepository users = mock(UserRepository.class);
        CompanyRepository companies = mock(CompanyRepository.class);
        AccountDeletionRepository deletions = mock(AccountDeletionRepository.class);
        AccountDeletionPhoneHasher hasher = mock(AccountDeletionPhoneHasher.class);
        AuthSessionService sessions = mock(AuthSessionService.class);
        AuditService audit = mock(AuditService.class);
        when(hasher.hash(phone)).thenReturn("h");
        when(deletions.findByDeletedPhoneHash("h")).thenReturn(Optional.empty());
        when(users.findByPhoneForUpdate(phone)).thenReturn(Optional.empty());
        when(users.saveAndFlush(any(User.class))).thenAnswer(invocation -> {
            User user = invocation.getArgument(0);
            user.setId(301L);
            return user;
        });
        when(companies.saveAndFlush(any(Company.class))).thenAnswer(invocation -> {
            Company company = invocation.getArgument(0);
            company.setId(401L);
            return company;
        });
        when(sessions.createSession(any(), any(), any()))
                .thenReturn(new AuthSessionService.SessionTokens("access-secret", "refresh-secret", "sid"));

        CompanyRegistrationService service = new CompanyRegistrationService(properties, sms, users, companies,
                new PasswordPolicy(), new BCryptPasswordEncoder(), deletions, hasher, sessions, audit,
                Clock.fixed(Instant.parse("2026-09-22T00:00:00Z"), ZoneOffset.UTC));
        CompanyRegistrationRequest request = new CompanyRegistrationRequest();
        request.setPhone(phone);
        request.setCode("123456");
        request.setPassword(password);
        CompanyRegistrationRequest.CompanyDetails details = new CompanyRegistrationRequest.CompanyDetails();
        details.setName("安全测试企业");
        details.setIndustry("互联网");
        details.setDescription("简介");
        details.setAddress("地址");
        request.setCompany(details);

        CompanyRegistrationResponse response = service.register(request, AuditContext.builder().build());
        assertThat(response.toString()).doesNotContain(phone, password);
        verify(audit).logRequired(anyLong(), eq("COMPANY_REGISTERED"), anyString(), anyLong(),
                argThat(detailsText -> !detailsText.contains(phone) && !detailsText.contains(password)),
                any(), any());
    }
}