/**
 * Regression guard: a Stripe event must only touch the subscription the user
 * actually has on record.
 *
 * `customer.subscription.deleted` updated userQuotas keyed on
 * stripeCustomerId alone, ignoring the deleted subscription's own id. One
 * Stripe customer can hold several subscriptions, and a plan change creates
 * the new one and deletes the old — with no ordering guarantee between the
 * two webhooks. So `created`(sub_NEW) routinely lands first, upgrading the
 * row, and then `deleted`(sub_OLD) matched that same row and reset it to
 * planSlug "free" with a null subscription id.
 *
 * The result is a customer who is being billed while the product treats
 * them as free. It fails silently and in the direction least likely to be
 * reported quickly, since the downgrade looks like an ordinary plan state.
 *
 * The same flaw sat in two more places, both keyed on customer alone:
 * reconcileSubscription's non-active branch (a canceled or past_due event
 * for a superseded subscription stamped its id and status over the live
 * one) and invoice.payment_failed.
 *
 * These assert the shared scope condition rather than round-tripping a
 * webhook, so no database is required and no module needs mocking.
 */

import { describe, it, expect } from "bun:test";
import { readFileSync } from "node:fs";
import { join } from "node:path";
import { recordedSubscriptionScope } from "../routes/stripe-webhook";

/**
 * Flatten a drizzle SQL tree into labelled leaves.
 *
 * The shape was inspected rather than assumed: the condition is a nested
 * SQL whose chunks are StringChunk (carrying `.value`), column references,
 * and Param nodes. Guessing at this shape is what makes these tests wrong.
 */
type Leaf = { kind: "str" | "col" | "param"; value: string };

function leaves(node: unknown, out: Leaf[] = []): Leaf[] {
  if (!node) return out;
  if (Array.isArray(node)) {
    for (const n of node) leaves(n, out);
    return out;
  }
  const anyNode = node as any;
  const kind = anyNode?.constructor?.name;
  if (kind === "SQL") return leaves(anyNode.queryChunks, out);
  if (kind === "StringChunk") {
    out.push({ kind: "str", value: String(anyNode.value ?? "") });
    return out;
  }
  if (kind === "Param") {
    out.push({ kind: "param", value: String(anyNode.value) });
    return out;
  }
  if (anyNode?.name && anyNode?.table) {
    out.push({ kind: "col", value: String(anyNode.name) });
  }
  return out;
}

const text = (ls: Leaf[]) =>
  ls
    .filter((l) => l.kind === "str")
    .map((l) => l.value)
    .join(" ");

describe("recordedSubscriptionScope", () => {
  it("returns no constraint when the event names no subscription", () => {
    // A one-off invoice has no subscription; the customer match is all
    // there is to go on, so the caller must not be over-constrained.
    expect(recordedSubscriptionScope("")).toBeUndefined();
  });

  it("constrains on the subscription id the event carries", () => {
    const ls = leaves(recordedSubscriptionScope("sub_ABC"));
    expect(ls.some((l) => l.kind === "col" && l.value === "stripe_subscription_id")).toBe(true);
    expect(ls.some((l) => l.kind === "param" && l.value === "sub_ABC")).toBe(true);
  });

  it("does not bind some other subscription's id", () => {
    const ls = leaves(recordedSubscriptionScope("sub_NEW"));
    expect(ls.some((l) => l.kind === "param" && l.value === "sub_OLD")).toBe(false);
  });

  it("also matches a row whose subscription id was never recorded", () => {
    // Checkout populates the row; reconcile enriches it. A row caught
    // between the two is NULL, and the event is the only subscription it
    // could be about — so it must still be matched or a real cancellation
    // would be dropped.
    const sql = text(leaves(recordedSubscriptionScope("sub_ABC")));
    expect(sql).toContain(" or ");
    expect(sql.toLowerCase()).toContain("is null");
  });

  it("never references the customer column — that is the caller's job", () => {
    const ls = leaves(recordedSubscriptionScope("sub_ABC"));
    expect(ls.some((l) => l.kind === "col" && l.value === "stripe_customer_id")).toBe(false);
  });
});

// --- every mutating site must apply the scope ------------------------------
//
// The bug was an absent constraint, so asserting the helper alone would not
// have caught it. Strip ONLY line comments.

describe("stripe-webhook applies the scope everywhere it mutates a plan", () => {
  const src = (() => {
    const raw = readFileSync(
      join(import.meta.dir, "..", "routes", "stripe-webhook.ts"),
      "utf8"
    );
    const stripped = raw
      .split("\n")
      .filter((l) => !l.trim().startsWith("//") && !l.trim().startsWith("*"))
      .join("\n");
    expect(stripped.length).toBeGreaterThan(0);
    return stripped;
  })();

  /** Slice by anchor, never by character count — handlers move. */
  function slice(startAnchor: string, endAnchor: string): string {
    const start = src.indexOf(startAnchor);
    expect(start).toBeGreaterThan(-1);
    const end = src.indexOf(endAnchor, start + startAnchor.length);
    expect(end).toBeGreaterThan(start);
    const body = src.slice(start, end);
    expect(body.length).toBeGreaterThan(0);
    return body;
  }

  it("subscription.deleted scopes the downgrade", () => {
    const body = slice(
      `case "customer.subscription.deleted"`,
      `case "invoice.payment_failed"`
    );
    expect(body).toContain('planSlug: "free"');
    expect(body).toContain("recordedSubscriptionScope");
    expect(body.indexOf("recordedSubscriptionScope")).toBeGreaterThan(
      body.indexOf("stripeCustomerId, customerId")
    );
  });

  it("invoice.payment_failed scopes the past_due flag", () => {
    const body = slice(`case "invoice.payment_failed"`, "default:");
    expect(body).toContain('stripeSubscriptionStatus: "past_due"');
    expect(body).toContain("recordedSubscriptionScope");
  });

  it("reconcileSubscription scopes its non-active write", () => {
    const body = slice("async function reconcileSubscription", "if (!slug)");
    expect(body).toContain("stripeSubscriptionId: sub.id");
    expect(body).toContain("recordedSubscriptionScope");
  });

  it("leaves exactly one unscoped update — the active-upgrade path", () => {
    // Scoping guards against a STALE NEGATIVE event clobbering a live plan.
    // The upgrade path must stay unscoped: a newly-created subscription is
    // by definition not yet the one on record, so scoping it would reject
    // the upgrade and strand a paying customer on their old plan. A
    // superseded subscription is never active, so stale events cannot reach
    // it. This pins that exemption to one known site.
    const unscoped =
      src.match(/\.where\(\s*eq\(userQuotas\.stripeCustomerId/g) ?? [];
    expect(unscoped.length).toBe(1);

    const at = src.search(/\.where\(\s*eq\(userQuotas\.stripeCustomerId/);
    const block = src.slice(Math.max(0, at - 400), at);
    expect(block.length).toBeGreaterThan(0);
    // It is the active upgrade — sets a resolved paid slug, not a downgrade.
    expect(block).toContain("planSlug: slug");
    expect(block).not.toContain('planSlug: "free"');
    expect(block).not.toContain('"past_due"');
  });
});