'use strict';

const assert = require('node:assert/strict');
const fs = require('node:fs');
const path = require('node:path');
const test = require('node:test');

const root = path.resolve(__dirname, '..', '..');
const read = (file) => fs.readFileSync(path.join(root, file), 'utf8');

test('comment REST admission is request-local and preprocess keeps native captcha enforcement', () => {
  const controller = read('src/Core/CommentActions.php');
  const moderation = read('src/Auth/Moderation.php');

  assert.match(controller, /aksrt_require_captcha\('comment', \$params\)/);
  assert.match(controller, /begin_captcha_verified_comment_request\(\)[\s\S]*?try \{[\s\S]*?wp_new_comment[\s\S]*?finally \{[\s\S]*?end_captcha_verified_comment_request\(\)/);
  assert.match(moderation, /private \$captcha_verified_comment_request_depth = 0/);
  assert.match(moderation, /if \(\$this->captcha_verified_comment_request_depth === 0\) \{/);
  assert.doesNotMatch(controller + moderation, /function_exists\('aksrt_require_captcha'\)/);
  assert.doesNotMatch(controller + moderation, /\$_(?:POST|REQUEST)\[[^\]]*captcha[^\]]*verified|set_transient\([^\n]*comment/i);
});

test('captcha business failures preserve WP_Error codes and never stringify opaque results', () => {
  const sources = [
    read('src/Core/CommentActions.php'),
    read('src/Auth/Moderation.php'),
    read('src/Admin/UserControllerAuthPhoneOperations.php'),
    read('inc/modules/user-parts/account-ajax.php'),
    read('src/Core/FrontSubmit.php'),
  ].join('\n');

  assert.match(sources, /get_error_code\(\)/);
  assert.match(sources, /get_error_message\(\)/);
  assert.doesNotMatch(sources, /\(string\)\s*\$(?:captcha|verify|result)/);
});

test('password and email account flows verify captcha once per distinct HTTP request', () => {
  const account = read('inc/modules/user-parts/account-ajax.php');
  const methodBody = (action, nextAction = '') => {
    const start = account.indexOf(`add_action('${action}'`);
    const end = nextAction ? account.indexOf(`add_action('${nextAction}'`, start + 1) : account.length;
    return account.slice(start, end === -1 ? account.length : end);
  };

  const send = methodBody('wp_ajax_aksrt_send_account_email_code', 'wp_ajax_aksrt_verify_account_email');
  const password = methodBody('wp_ajax_aksrt_change_password', 'wp_ajax_aksrt_change_email');
  const email = methodBody('wp_ajax_aksrt_change_email');

  assert.equal((send.match(/aksrt_require_captcha\(/g) || []).length, 1);
  assert.match(send, /aksrt_require_captcha\(\s*'change_email'/);
  assert.equal((password.match(/aksrt_require_captcha\(/g) || []).length, 1);
  assert.match(password, /aksrt_require_captcha\(\s*'change_password'/);
  assert.equal((email.match(/aksrt_require_captcha\(/g) || []).length, 1);
  assert.match(email, /aksrt_require_captcha\(\s*'change_email'/);
});

test('legacy public SMS-code AJAX surface is removed while SMS service remains', () => {
  const sms = read('src/Sms/SMS.php');

  assert.doesNotMatch(sms, /aksrt_send_sms_code/);
  assert.doesNotMatch(sms, /function ajax_send_code\s*\(/);
  assert.match(sms, /public function send_code\(string \$phone, string \$code\): array/);
});

test('after-sale submit and withdraw endpoints verify captcha once per request', () => {
  const service = read('src/Payment/AfterSaleService.php');

  // 两个新场景已在场景白名单与后台「启用场景」勾选列表同步注册
  const scenes = read('inc/modules/captcha.php');
  assert.match(scenes, /'after_sale_apply'\s*=> __\('申请售后', 'aksrt'\)/);
  assert.match(scenes, /'after_sale_cancel'\s*=> __\('撤销售后', 'aksrt'\)/);
  const permissions = read('src/Admin/Schema/SchemaPermissions.php');
  assert.match(permissions, /'label' => '申请售后', 'value' => 'after_sale_apply'/);
  assert.match(permissions, /'label' => '撤销售后', 'value' => 'after_sale_cancel'/);
  const adminSchema = read('assets/admin/src/schema/sections/permissions/index.js');
  assert.match(adminSchema, /label: '申请售后', value: 'after_sale_apply'/);
  assert.match(adminSchema, /label: '撤销售后', value: 'after_sale_cancel'/);

  // REST 提交 / 撤销各过一次场景校验（统一入口 helper 内恰一次 aksrt_require_captcha）；
  // 场景未启用时 aksrt_require_captcha 直接放行
  const submit = service.slice(service.indexOf('public function rest_submit'), service.indexOf('public function rest_list'));
  const cancel = service.slice(service.indexOf('public function rest_cancel'), service.indexOf('public function create'));
  assert.match(submit, /require_captcha\(\$request, 'after_sale_apply'\)/);
  assert.match(cancel, /require_captcha\(\$request, 'after_sale_cancel'\)/);
  assert.equal((service.match(/require_captcha\(\$request, '/g) || []).length, 2);
  assert.equal((service.match(/aksrt_require_captcha\(/g) || []).length, 1);
  assert.match(service, /function_exists\('aksrt_require_captcha'\)/);
});