package inventory

// Outlet guards on the opname write paths.
//
// OpnameByID already rejected store-bound callers outside the opname's
// warehouse, but OpnameSetPhysical, OpnameFinalize and OpnameItems did not —
// so the detail view hid another outlet's opname while its items stayed
// readable and its stock stayed adjustable through finalize. All three now go
// through the same outlet check.

import (
	"context"
	"errors"
	"testing"
	"time"

	"github.com/shopspring/decimal"

	"github.com/TaruLab/keluargamart-backend/internal/auth"
)

func scopedOpname(t *testing.T) (*Service, int64) {
	t.Helper()
	s := NewService(newFakeStore(), &fakeSeq{}, time.UTC)
	st := s.store.(*fakeStore)
	st.whsForStores = map[int64][]int64{1: {1}}
	st.stocks["1:1"] = &Stock{ID: 1, ProductID: 1, WarehouseID: 1, Quantity: decimal.NewFromInt(3), ReservedQuantity: decimal.Zero}
	o, err := s.OpnameCreate(context.Background(), OpnameInput{WarehouseID: 1})
	if err != nil {
		t.Fatal(err)
	}
	return s, o.ID
}

func outOfScope() context.Context {
	return auth.WithStoreScope(context.Background(), auth.NewStoreScope([]int64{99}))
}

func TestOpnameSetPhysical_RejectsOutOfScopeCaller(t *testing.T) {
	s, id := scopedOpname(t)
	if err := s.OpnameSetPhysical(outOfScope(), id, []OpnameItemInput{{ProductID: 1, PhysicalQty: decimalPtr(decimal.NewFromInt(3))}}); !errors.Is(err, ErrForbiddenWarehouse) {
		t.Fatalf("got %v, want ErrForbiddenWarehouse", err)
	}
	// In-scope and platform-wide callers still work.
	inScope := auth.WithStoreScope(context.Background(), auth.NewStoreScope([]int64{1}))
	if err := s.OpnameSetPhysical(inScope, id, []OpnameItemInput{{ProductID: 1, PhysicalQty: decimalPtr(decimal.NewFromInt(3))}}); err != nil {
		t.Fatalf("in-scope caller got %v, want nil", err)
	}
	if err := s.OpnameSetPhysical(context.Background(), id, []OpnameItemInput{{ProductID: 1, PhysicalQty: decimalPtr(decimal.NewFromInt(3))}}); err != nil {
		t.Fatalf("platform-wide caller got %v, want nil", err)
	}
}

func TestOpnameFinalize_RejectsOutOfScopeCaller(t *testing.T) {
	s, id := scopedOpname(t)
	if _, err := s.OpnameFinalize(outOfScope(), id); !errors.Is(err, ErrForbiddenWarehouse) {
		t.Fatalf("got %v, want ErrForbiddenWarehouse", err)
	}
	// Nothing was adjusted by the rejected call.
	st := s.store.(*fakeStore)
	if got := st.stocks["1:1"].Quantity; !got.Equal(decimal.NewFromInt(3)) {
		t.Fatalf("stock = %s, want 3 (rejected finalize must not move stock)", got)
	}
	// The opname itself is untouched and still finalizable by the right caller.
	if _, err := s.OpnameFinalize(context.Background(), id); err != nil {
		t.Fatalf("platform-wide finalize got %v, want nil", err)
	}
}

func TestOpnameItems_RejectsOutOfScopeCaller(t *testing.T) {
	s, id := scopedOpname(t)
	if _, err := s.OpnameItems(outOfScope(), id); !errors.Is(err, ErrForbiddenWarehouse) {
		t.Fatalf("got %v, want ErrForbiddenWarehouse", err)
	}
	if _, err := s.OpnameItems(context.Background(), id); err != nil {
		t.Fatalf("platform-wide caller got %v, want nil", err)
	}
}

func decimalPtr(d decimal.Decimal) *decimal.Decimal { return &d }