// Feature: client-portal, Property 1: Role authentication round-trip
// **Validates: Requirements 1.3, 1.4**

import { describe, it, expect, beforeEach } from 'vitest';
import * as fc from 'fast-check';
import { useAuthStore } from '@/lib/stores/auth-store';
import type { UserRole } from '@/lib/constants/navigation';

/**
 * Property: For any valid role (including "Client_Portal"), calling login(role)
 * on the auth store and then reading the persisted state from sessionStorage
 * should yield the same role value back.
 */

const ALL_ROLES: UserRole[] = ['Super_Admin', 'Publisher_Admin', 'Viewer', 'Client_Portal'];

describe('Property 1: Role authentication round-trip', () => {
  beforeEach(() => {
    sessionStorage.clear();
    useAuthStore.setState({
      user: null,
      role: null,
      isAuthenticated: false,
    });
  });

  it('for any valid role, login persists the role to sessionStorage and it can be read back', () => {
    fc.assert(
      fc.property(
        fc.constantFrom(...ALL_ROLES),
        (role) => {
          // Reset state before each iteration
          sessionStorage.clear();
          useAuthStore.setState({
            user: null,
            role: null,
            isAuthenticated: false,
          });

          // Perform login
          useAuthStore.getState().login(role);

          // Read persisted state from sessionStorage
          const raw = sessionStorage.getItem('divisi-auth');
          expect(raw).not.toBeNull();

          const parsed = JSON.parse(raw!);
          // Zustand persist wraps state in { state: {...}, version: N }
          const persistedRole = parsed.state.role;

          // The persisted role should match the role we logged in with
          expect(persistedRole).toBe(role);

          // Also verify the in-memory state matches
          const currentState = useAuthStore.getState();
          expect(currentState.role).toBe(role);
          expect(currentState.isAuthenticated).toBe(true);
        },
      ),
      { numRuns: 100 },
    );
  });

  it('for any valid role, the round-trip preserves role identity after re-reading from storage', () => {
    fc.assert(
      fc.property(
        fc.constantFrom(...ALL_ROLES),
        (role) => {
          // Reset state
          sessionStorage.clear();
          useAuthStore.setState({
            user: null,
            role: null,
            isAuthenticated: false,
          });

          // Login with the role
          useAuthStore.getState().login(role);

          // Read from sessionStorage and parse
          const raw = sessionStorage.getItem('divisi-auth');
          expect(raw).not.toBeNull();

          const parsed = JSON.parse(raw!);
          const persistedState = parsed.state;

          // Verify round-trip: role in storage equals role passed to login
          expect(persistedState.role).toBe(role);
          expect(persistedState.isAuthenticated).toBe(true);
          expect(persistedState.user).not.toBeNull();
          expect(persistedState.user.role).toBe(role);
        },
      ),
      { numRuns: 100 },
    );
  });
});