import assert from "node:assert/strict";
import { readFileSync } from "node:fs";
import test from "node:test";

const root = new URL("../", import.meta.url);
const route = readFileSync(new URL("src/app/api/admin/customers/reset/route.ts", root), "utf8");
const users = readFileSync(new URL("src/components/admin/users-resource.tsx", root), "utf8");
const migration = readFileSync(new URL("supabase/migrations/20260811020000_admin_customer_account_reset.sql", root), "utf8");
const administratorsRoute = readFileSync(new URL("src/app/api/admin/administrators/route.ts", root), "utf8");

test("admin account reset stays owner-only and explicit without email reauth", () => {
  assert.match(route, /requireAdminMutation\(\s*request,\s*"admin\.users\.manage_roles",?\s*\)/);
  assert.doesNotMatch(route, /requireHighRiskAdminMutation/);
  assert.match(route, /confirmation:\s*z\.literal\("RESET"\)/);
  assert.match(route, /admin_reset_customer_account\(\$1, \$2, \$3, \$4\)/);
  assert.match(users, /permissions\.includes\("admin\.users\.manage_roles"\)/);
  assert.doesNotMatch(users, /reauthPermission=/);
  assert.match(users, /登录身份、管理员角色、积分及账务审计记录会保留/);
  assert.match(administratorsRoute, /requireAdminMutation\(\s*request,\s*"admin\.users\.manage_roles",?\s*\)/);
  assert.doesNotMatch(administratorsRoute, /requireHighRiskAdminMutation/);
});

test("database reset mirrors the existing staging reset boundary and audits it", () => {
  assert.match(migration, /update public\.profiles[\s\S]*name = null[\s\S]*timezone_source = null/);
  assert.match(migration, /delete from public\.chat_sessions/);
  assert.match(migration, /delete from public\.chart_profiles/);
  assert.match(migration, /delete from public\.synastry_reports/);
  assert.match(migration, /profile\.credits is distinct from v_credits/);
  assert.match(migration, /identity\.accounts/);
  assert.match(migration, /identity\.sessions/);
  assert.match(migration, /public\.admin_user_roles/);
  assert.match(migration, /public\.credit_transactions/);
  assert.match(migration, /public\.consultation_requests/);
  assert.match(migration, /audit\.admin_audit_logs/);
  assert.match(migration, /'admin\.customer\.account\.reset'/);
  assert.doesNotMatch(migration, /delete from (identity|auth)\.users/);
});