//! Production first-owner bootstrap: a fresh local-auth deployment has no
//! users and no signup route, so the very first owner is provisioned once
//! from configuration. Idempotent — never clobbers an existing install.

use cm_auth::{bootstrap_owner, AuthService, AuthedUser};
use cm_domain::Role;

#[tokio::test]
async fn bootstrap_creates_the_first_owner_and_workspace_once() {
    let pool = cm_testkit::test_pool().await;

    // First boot: provisions the workspace + owner with a usable password.
    let created = bootstrap_owner(&pool, "Acme", "admin@acme.test", "s3cret-pw", 1250)
        .await
        .unwrap();
    assert!(created, "first call provisions");

    let auth = AuthService::new(pool.clone());
    let token = auth
        .login_local("admin@acme.test", "s3cret-pw")
        .await
        .expect("the bootstrapped owner can sign in");
    let AuthedUser { role, .. } = auth.authenticate(token.secret()).await.unwrap();
    assert_eq!(role, Role::Owner);

    // The starter credit grant landed.
    let user = cm_db::repo::users::find_by_email(&pool, "admin@acme.test")
        .await
        .unwrap();
    assert_eq!(
        cm_db::repo::credits::balance(&pool, user.workspace_id)
            .await
            .unwrap(),
        1250
    );
}

#[tokio::test]
async fn bootstrap_is_idempotent_and_never_clobbers_an_existing_install() {
    let pool = cm_testkit::test_pool().await;
    assert!(
        bootstrap_owner(&pool, "Acme", "first@acme.test", "pw-one", 100)
            .await
            .unwrap()
    );

    // Re-running (e.g. every container restart) is a no-op: no second
    // workspace, no password reset, no duplicate owner.
    let created = bootstrap_owner(&pool, "Acme", "second@acme.test", "pw-two", 100)
        .await
        .unwrap();
    assert!(!created, "second call is a no-op");

    let auth = AuthService::new(pool.clone());
    assert!(
        auth.login_local("second@acme.test", "pw-two")
            .await
            .is_err(),
        "a second owner is never created"
    );
    assert!(
        auth.login_local("first@acme.test", "pw-one").await.is_ok(),
        "the original owner is untouched"
    );
    let workspaces: i64 = sqlx::query_scalar("SELECT count(*) FROM workspaces")
        .fetch_one(&pool)
        .await
        .unwrap();
    assert_eq!(workspaces, 1);
}