package auth

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
)

// TestUsersSQLWriteAnnotationsAreExecRows pins the annotation half of the
// write-result audit for the three writes moved onto the generated layer in this
// pass: A16 SetUserActive, A17 DeleteToken, and the application_access
// promotion.
//
// :execrows is the only reason those defects were fixable in the first place —
// with :exec sqlc emits a method that returns just the error, so the row count
// does not exist in Go to observe. Reverting an annotation to :exec would strip
// the count from the generated signature and the Go call sites would stop
// compiling, so the interesting regression is the coordinated one: an
// "simplification" that drops the annotation *and* the Go check together, which
// is exactly the defect these tests were written to end. This net catches that,
// and the doubled-backslash net below is its sibling for the other bug class in
// the same directory.
func TestUsersSQLWriteAnnotationsAreExecRows(t *testing.T) {
	src, err := os.ReadFile(filepath.Join("..", "..", "db", "query", "users.sql"))
	if err != nil {
		t.Fatal(err)
	}
	sql := string(src)
	if strings.TrimSpace(sql) == "" {
		t.Fatal("db/query/users.sql is empty; the assertions below would pass vacuously")
	}

	// Exact directive match, so a sibling name cannot satisfy the check by
	// prefix: "DeleteTokensByUser :execrows" must not pass "DeleteToken".
	for _, name := range []string{"SetUserActive", "DeleteToken", "SetUserApplicationAccess"} {
		if !strings.Contains(sql, "-- name: "+name+" :execrows\n") {
			t.Errorf("-- name: %s :execrows not found in db/query/users.sql; a write whose row count is discarded cannot be observed in Go", name)
		}
	}
}