import { describe, expect, it, vi } from 'vitest';
import fs from 'node:fs/promises';
import os from 'node:os';
import path from 'node:path';
import sharp from 'sharp';
import { constants, publicEncrypt } from 'node:crypto';

import { InMemoryGatewaySessionService } from '../src/auth/inMemorySessionService.js';
import { createInMemoryUserRepository } from '../src/auth/inMemoryUserRepository.js';
import { InMemoryOAuthSessionStore } from '../src/auth/oauthSessionStore.js';
import type { KakaoOAuthClient } from '../src/auth/kakaoClient.js';
import { createGatewayApiContext } from '../src/context.js';
import { InMemoryProfileStatusService } from '../src/lobby/profileStatusService.js';
import { appRouter } from '../src/router.js';
import type { GatewayPrismaClient } from '@sammo-ts/infra';
import { decryptGameSessionToken, type UserSanctions } from '@sammo-ts/common/auth/gameToken';
import { createPasswordEnvelopeService } from '../src/auth/passwordEnvelope.js';

const buildCaller = (
    options: {
        userIconDir?: string;
        localAccountGraceDays?: number;
        flushError?: Error;
        profileListError?: Error;
        kakaoId?: string;
        kakaoEmail?: string;
        kakaoSignupAlreadyRegistered?: boolean;
        allowKakaoRefresh?: boolean;
    } = {}
) => {
    const users = createInMemoryUserRepository();
    const sessions = new InMemoryGatewaySessionService({
        sessionTtlSeconds: 3600,
        gameSessionTtlSeconds: 600,
    });
    const flushPublisher = {
        publishUserFlush: vi.fn(async () => {
            if (options.flushError) {
                throw options.flushError;
            }
        }),
    };
    const oauthSessions = new InMemoryOAuthSessionStore();
    const kakaoProfile = {
        id: options.kakaoId ?? '1',
        email: options.kakaoEmail ?? 'tester@example.com',
    };
    const sentTalkMessages: string[] = [];
    const refreshTokenCalls: string[] = [];
    const kakaoClient = {
        restKey: '',
        redirectUri: '',
        oauthHost: '',
        apiHost: '',
        buildAuthUrl: (state: string, scopes: string[]) =>
            `https://kauth.example.test/authorize?state=${state}&scope=${scopes.join(',')}`,
        exchangeCode: async () => ({
            accessToken: 'access-token',
            accessTokenExpiresIn: 3600,
            refreshToken: 'refresh-token',
            refreshTokenExpiresIn: 86400,
        }),
        refreshToken: async (refreshToken: string) => {
            refreshTokenCalls.push(refreshToken);
            if (!options.allowKakaoRefresh) {
                throw new Error('not used');
            }
            return {
                accessToken: 'refreshed-access-token',
                accessTokenExpiresIn: 3600,
            };
        },
        signup: async () =>
            options.kakaoSignupAlreadyRegistered
                ? { alreadyRegistered: true }
                : { id: kakaoProfile.id, alreadyRegistered: false },
        getMe: async () => ({
            id: kakaoProfile.id,
            kakaoAccount: {
                hasEmail: true,
                email: kakaoProfile.email,
                isEmailValid: true,
                isEmailVerified: true,
            },
        }),
        sendTalkMessage: async (_accessToken: string, message: string) => {
            sentTalkMessages.push(message);
        },
    };
    const profileRows = [
        {
            profileName: 'che:default',
            profile: 'che',
            scenario: 'default',
            apiPort: 15003,
            status: 'RUNNING' as const,
            buildStatus: 'SUCCEEDED' as const,
            meta: {},
            createdAt: new Date().toISOString(),
            updatedAt: new Date().toISOString(),
        },
        {
            profileName: 'hwe:default',
            profile: 'hwe',
            scenario: 'default',
            apiPort: 15015,
            status: 'RUNNING' as const,
            buildStatus: 'SUCCEEDED' as const,
            meta: {},
            createdAt: new Date().toISOString(),
            updatedAt: new Date().toISOString(),
        },
    ];
    const profiles = {
        listProfiles: async () => profileRows,
        getProfile: async (profileName: string) =>
            profileRows.find((profile) => profile.profileName === profileName) ?? null,
        upsertProfile: async () => {
            throw new Error('not used');
        },
        updateScenario: async () => null,
        updateStatus: async () => null,
        updateBuildStatus: async () => null,
        updateMeta: async () => null,
        listReservedToStart: async () => [],
        findQueuedBuild: async () => null,
        updateLastError: async () => {},
        updateWorkspaceUsage: async () => {},
        clearWorkspaceUsage: async () => {},
        listOperations: async () => [],
        getOperation: async () => null,
        createOperation: async () => {
            throw new Error('not implemented');
        },
        claimNextOperation: async () => null,
        completeOperation: async () => {
            throw new Error('not implemented');
        },
        requeueOperation: async () => {
            throw new Error('not implemented');
        },
        cancelOperation: async () => false,
        retryOperation: async () => null,
    };
    const orchestrator = {
        start: () => {},
        stop: async () => {},
        reconcileNow: async () => {},
        runScheduleNow: async () => {},
        runBuildQueueNow: async () => {},
        runOperationsNow: async () => {},
        cleanupStaleWorkspaces: async () => ({
            removed: [],
            skipped: [],
        }),
        listRuntimeStates: async () => [],
    };
    const profileStatus = new InMemoryProfileStatusService(
        profileRows.map((profile) => ({
            profileName: profile.profileName,
            profile: profile.profile,
            scenario: profile.scenario,
            status: profile.status,
            apiPort: profile.apiPort,
            runtime: {
                apiRunning: true,
                daemonRunning: true,
                auctionRunning: false,
                battleSimRunning: false,
                tournamentRunning: false,
            },
            korName: profile.profile,
            color: '#fff',
        }))
    );
    if (options.profileListError) {
        profileStatus.listLobbyProfiles = async () => {
            throw options.profileListError;
        };
    }
    const passwordEnvelope = createPasswordEnvelopeService();
    const requestHeaders: Record<string, string> = {};
    const userIconUpload = {
        upload: vi.fn(async ({ filename }: { filename: string }) => ({
            picture: `users/core2026/${filename}`,
            publicUrl: `https://sam-image.hided.net/icons/users/core2026/${filename}`,
        })),
    };
    const sealPassword = (password: string) => {
        const key = passwordEnvelope.getPublicKey();
        return {
            keyId: key.keyId,
            ciphertext: publicEncrypt(
                {
                    key: key.publicKeyPem,
                    padding: constants.RSA_PKCS1_OAEP_PADDING,
                    oaepHash: 'sha256',
                },
                Buffer.from(password, 'utf8')
            ).toString('base64'),
        };
    };
    const caller = appRouter.createCaller(
        createGatewayApiContext({
            users,
            sessions,
            flushPublisher,
            gameTokenSecret: 'test-secret',
            gameSessionTtlSeconds: 600,
            kakaoClient: kakaoClient as unknown as KakaoOAuthClient,
            oauthSessions,
            publicBaseUrl: 'http://localhost',
            userIconDir: options.userIconDir,
            userIconPublicUrl: 'http://localhost/user-icons',
            sharedIconPublicUrl: 'https://sam-image.hided.net/icons',
            userIconUpload,
            adminLocalAccountEnabled: false,
            localRegistrationEnabled: true,
            localAccountGraceDays: options.localAccountGraceDays ?? 7,
            passwordEnvelope,
            profiles,
            orchestrator,
            profileStatus,
            requestHeaders,
            prisma: {
                appUser: {
                    findFirst: async () => null,
                },
            } as unknown as GatewayPrismaClient,
        })
    );
    return {
        caller,
        oauthSessions,
        users,
        sessions,
        flushPublisher,
        userIconUpload,
        kakaoProfile,
        sentTalkMessages,
        refreshTokenCalls,
        sealPassword,
        setSessionHeader: (sessionToken: string) => {
            requestHeaders['x-session-token'] = sessionToken;
        },
    };
};

describe('gateway auth flow', () => {
    it('registers a local account first and accepts an encrypted password login', async () => {
        const { caller, users, sealPassword } = buildCaller();
        const register = await caller.auth.registerLocal({
            username: 'LOCAL-User',
            credential: sealPassword('비밀번호-password'),
            displayName: '로컬유저',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });

        expect(register.user).toMatchObject({
            username: 'local-user',
            displayName: '로컬유저',
            kakaoVerified: false,
        });
        const stored = await users.findByUsername('local-user');
        expect(stored?.passwordHash.startsWith('$argon2id$')).toBe(true);
        expect(stored?.thirdPartyUse).toBe(false);
        expect(stored?.termsAcceptedAt).toBeTruthy();
        expect(stored?.privacyAcceptedAt).toBeTruthy();

        const login = await caller.auth.login({
            username: 'LOCAL-USER',
            credential: sealPassword('비밀번호-password'),
        });
        expect(login.status).toBe('login');
        if (login.status !== 'login') {
            throw new Error('Expected completed login.');
        }
        expect(login.user.username).toBe('local-user');
    });

    it('blocks password login while a ban is active and allows it after expiry', async () => {
        const { caller, users, sealPassword } = buildCaller();
        await caller.auth.registerLocal({
            username: 'banned-user',
            credential: sealPassword('banned-password'),
            displayName: '차단유저',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });
        const user = await users.findByUsername('banned-user');
        expect(user).not.toBeNull();
        await users.updateSanctions(user!.id, {
            bannedUntil: '2099-01-01T00:00:00.000Z',
        });

        await expect(
            caller.auth.login({
                username: 'banned-user',
                credential: sealPassword('banned-password'),
            })
        ).rejects.toMatchObject({ code: 'FORBIDDEN' });

        await users.updateSanctions(user!.id, {
            bannedUntil: '2000-01-01T00:00:00.000Z',
        });
        await expect(
            caller.auth.login({
                username: 'banned-user',
                credential: sealPassword('banned-password'),
            })
        ).resolves.toMatchObject({ user: { username: 'banned-user' } });
    });

    const gameSessionRestrictionCases: Array<{ label: string; sanctions: UserSanctions }> = [
        {
            label: 'global suspension',
            sanctions: { suspendedUntil: '2099-01-01T00:00:00.000Z' },
        },
        {
            label: 'profile login restriction',
            sanctions: {
                serverRestrictions: {
                    'che:default': {
                        blockedFeatures: ['login'],
                    },
                },
            },
        },
        {
            label: 'base profile gameplay restriction',
            sanctions: {
                serverRestrictions: {
                    che: {
                        blockedFeatures: ['gameplay'],
                        until: '2099-01-01T00:00:00.000Z',
                    },
                },
            },
        },
    ];

    it.each(gameSessionRestrictionCases)('blocks game-session issuance for $label', async ({ sanctions }) => {
        const { caller, users, sealPassword } = buildCaller();
        const register = await caller.auth.registerLocal({
            username: `restricted-${Object.keys(sanctions)[0]}`,
            credential: sealPassword('restricted-password'),
            displayName: '제한유저',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });
        const user = await users.findByUsername(register.user.username);
        expect(user).not.toBeNull();
        await users.updateSanctions(user!.id, sanctions);

        await expect(
            caller.auth.issueGameSession({
                sessionToken: register.sessionToken,
                profile: 'che:default',
            })
        ).rejects.toMatchObject({ code: 'FORBIDDEN' });
    });

    it('blocks pre-verification general creation on che but grants the hwe grace period', async () => {
        const { caller, sealPassword, setSessionHeader } = buildCaller();
        const register = await caller.auth.registerLocal({
            username: 'policy-user',
            credential: sealPassword('policy-password'),
            displayName: '정책유저',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });

        const che = await caller.auth.issueGameSession({
            sessionToken: register.sessionToken,
            profile: 'che:default',
        });
        const hwe = await caller.auth.issueGameSession({
            sessionToken: register.sessionToken,
            profile: 'hwe:default',
        });
        const chePayload = decryptGameSessionToken(che.gameToken, 'test-secret');
        const hwePayload = decryptGameSessionToken(hwe.gameToken, 'test-secret');

        expect(chePayload?.identity).toMatchObject({
            kakaoVerified: false,
            canCreateGeneral: false,
            requiresKakaoVerification: true,
        });
        expect(hwePayload?.identity).toMatchObject({
            kakaoVerified: false,
            canCreateGeneral: true,
            requiresKakaoVerification: true,
        });

        setSessionHeader(register.sessionToken);
        const profileList = await caller.lobby.profiles();
        expect(profileList.find((profile) => profile.profile === 'che')?.localAccountPolicy?.canCreateGeneral).toBe(
            false
        );
        expect(profileList.find((profile) => profile.profile === 'hwe')?.localAccountPolicy?.canCreateGeneral).toBe(
            true
        );
    });

    it('rejects continued game access after the local account grace period', async () => {
        const { caller, users, sealPassword } = buildCaller({ localAccountGraceDays: 7 });
        const register = await caller.auth.registerLocal({
            username: 'expired-user',
            credential: sealPassword('expired-password'),
            displayName: '만료유저',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });
        const user = await users.findByUsername('expired-user');
        expect(user).not.toBeNull();
        if (user) {
            user.kakaoGraceStartedAt = new Date(Date.now() - 8 * 24 * 60 * 60 * 1000).toISOString();
        }

        await expect(
            caller.auth.issueGameSession({
                sessionToken: register.sessionToken,
                profile: 'hwe:default',
            })
        ).rejects.toMatchObject({
            code: 'FORBIDDEN',
            message: expect.stringContaining('유예기간'),
        });
    });

    it('issues a CHE game token to an expired tester with an active special access grant', async () => {
        const { caller, users, sealPassword } = buildCaller({ localAccountGraceDays: 0 });
        const register = await caller.auth.registerLocal({
            username: 'special-tester',
            credential: sealPassword('tester-password'),
            displayName: '특수테스터',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });
        const user = await users.findByUsername('special-tester');
        expect(user).not.toBeNull();
        if (!user) throw new Error('Expected local tester.');
        await users.createSpecialAccessGrant(user.id, {
            kind: 'TESTER',
            profiles: ['che'],
            allowsGeneralCreation: true,
            expiresAt: null,
            reason: 'CHE 회귀 검증',
            grantedByUserId: 'admin-id',
        });

        const issued = await caller.auth.issueGameSession({
            sessionToken: register.sessionToken,
            profile: 'che:default',
        });
        const payload = decryptGameSessionToken(issued.gameToken, 'test-secret');

        expect(payload?.identity).toMatchObject({
            kakaoVerified: false,
            canCreateGeneral: true,
            requiresKakaoVerification: false,
            specialAccess: { kind: 'TESTER', expiresAt: null },
        });
    });

    it('lets a Kakao-linked recovery account log in with its password while the grant is active', async () => {
        const { caller, users, sealPassword } = buildCaller();
        await caller.auth.registerLocal({
            username: 'lost-phone-user',
            credential: sealPassword('recovery-password'),
            displayName: '분실복구유저',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });
        const user = await users.findByUsername('lost-phone-user');
        expect(user).not.toBeNull();
        if (!user) throw new Error('Expected recovery user.');
        user.oauthType = 'KAKAO';
        user.oauthId = 'lost-phone-kakao-id';
        user.kakaoVerifiedAt = '2026-08-01T00:00:00.000Z';
        await users.createSpecialAccessGrant(user.id, {
            kind: 'RECOVERY',
            profiles: ['che'],
            allowsGeneralCreation: true,
            expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
            reason: '휴대폰 분실 본인 확인 완료',
            grantedByUserId: 'admin-id',
        });

        await expect(
            caller.auth.login({
                username: 'lost-phone-user',
                credential: sealPassword('recovery-password'),
            })
        ).resolves.toMatchObject({ status: 'login', user: { username: 'lost-phone-user' } });
    });

    it('lets a Kakao-linked operator log in with its password without a grant', async () => {
        const { caller, users, sealPassword } = buildCaller();
        await caller.auth.registerLocal({
            username: 'oauth-free-operator',
            credential: sealPassword('operator-password'),
            displayName: '복구운영자',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });
        const user = await users.findByUsername('oauth-free-operator');
        expect(user).not.toBeNull();
        if (!user) throw new Error('Expected operator user.');
        user.oauthType = 'KAKAO';
        user.oauthId = 'operator-kakao-id';
        user.kakaoVerifiedAt = '2026-08-01T00:00:00.000Z';
        await users.updateRoles(user.id, ['user', 'admin.users.manage']);

        await expect(
            caller.auth.login({
                username: 'oauth-free-operator',
                credential: sealPassword('operator-password'),
            })
        ).resolves.toMatchObject({ status: 'login', user: { username: 'oauth-free-operator' } });
    });

    it('keeps an active server sanction authoritative over special access', async () => {
        const { caller, users, sealPassword } = buildCaller({ localAccountGraceDays: 0 });
        const register = await caller.auth.registerLocal({
            username: 'sanctioned-special-tester',
            credential: sealPassword('tester-password'),
            displayName: '제재특수테스터',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });
        const user = await users.findByUsername('sanctioned-special-tester');
        expect(user).not.toBeNull();
        if (!user) throw new Error('Expected sanctioned local tester.');
        await users.createSpecialAccessGrant(user.id, {
            kind: 'TESTER',
            profiles: ['che'],
            allowsGeneralCreation: true,
            expiresAt: null,
            reason: 'CHE 회귀 검증',
            grantedByUserId: 'admin-id',
        });
        await users.updateSanctions(user.id, {
            serverRestrictions: {
                che: {
                    blockedFeatures: ['login'],
                    until: '2099-01-01T00:00:00.000Z',
                },
            },
        });

        await expect(
            caller.auth.issueGameSession({
                sessionToken: register.sessionToken,
                profile: 'che:default',
            })
        ).rejects.toMatchObject({ code: 'FORBIDDEN' });
    });

    it('links Kakao to the logged-in local account instead of creating a second user', async () => {
        const { caller, users, sealPassword, setSessionHeader, sentTalkMessages } = buildCaller();
        const register = await caller.auth.registerLocal({
            username: 'verify-user',
            credential: sealPassword('verify-password'),
            displayName: '인증유저',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });
        setSessionHeader(register.sessionToken);
        const start = await caller.auth.kakaoStart({ mode: 'verify' });
        const verified = await caller.auth.kakaoExchange({
            code: 'oauth-code',
            state: start.state,
        });

        expect(verified.status).toBe('otp');
        if (verified.status !== 'otp') {
            throw new Error('Expected Kakao OTP challenge.');
        }
        const code = sentTalkMessages.at(-1)?.match(/인증 코드는 (\d{4})/)?.[1];
        expect(code).toBeTruthy();
        const completed = await caller.auth.kakaoOtp({ challengeId: verified.challengeId, code: code! });
        expect(completed.user.kakaoVerified).toBe(true);
        const stored = await users.findByUsername('verify-user');
        expect(stored).toMatchObject({
            oauthType: 'KAKAO',
            oauthId: '1',
            email: 'tester@example.com',
        });
        expect(stored?.kakaoVerifiedAt).toBeTruthy();
    });

    it('always requests both email and KakaoTalk message consent', async () => {
        const { caller } = buildCaller();

        const start = await caller.auth.kakaoStart({ mode: 'login', scopes: [] });

        expect(decodeURIComponent(start.authUrl)).toContain('scope=account_email,talk_message');
    });

    it('asks before relinking a new Kakao identity to the permanently retained email owner', async () => {
        const { caller, users, kakaoProfile, sentTalkMessages, flushPublisher } = buildCaller();
        const emailOwner = await users.createUser({
            username: 'email-owner',
            password: 'owner-password',
            oauth: {
                type: 'KAKAO',
                id: 'original-kakao-id',
                email: 'tester@example.com',
                info: {},
            },
        });
        await users.markKakaoTalkVerified(emailOwner.id, new Date(Date.now() + 60_000));
        kakaoProfile.id = 'different-kakao-id';

        const start = await caller.auth.kakaoStart({ mode: 'login' });
        const recovery = await caller.auth.kakaoExchange({ code: 'oauth-code', state: start.state });

        expect(recovery).toMatchObject({
            status: 'account_recovery',
            action: 'link_existing',
            email: 'tester@example.com',
        });
        if (recovery.status !== 'account_recovery') throw new Error('Expected account recovery choice.');

        const linked = await caller.auth.kakaoResolveAccount({
            oauthSessionId: recovery.oauthSessionId,
            action: 'link_existing',
        });
        expect(linked.status).toBe('otp');
        expect(sentTalkMessages).toHaveLength(1);
        expect(await users.findByOauthId('KAKAO', 'original-kakao-id')).toBeNull();
        expect(await users.findByOauthId('KAKAO', 'different-kakao-id')).toMatchObject({
            id: emailOwner.id,
            username: 'email-owner',
            email: 'tester@example.com',
        });
        expect(flushPublisher.publishUserFlush).toHaveBeenCalledWith(emailOwner.id, 'kakao-account-relinked');
    });

    it('asks for rejoin confirmation when Kakao is already registered but no retained email owner exists', async () => {
        const { caller, users, sealPassword } = buildCaller({ kakaoSignupAlreadyRegistered: true });

        const start = await caller.auth.kakaoStart({ mode: 'login' });
        const recovery = await caller.auth.kakaoExchange({ code: 'oauth-code', state: start.state });
        expect(recovery).toMatchObject({
            status: 'account_recovery',
            action: 'rejoin',
            email: 'tester@example.com',
        });
        if (recovery.status !== 'account_recovery') throw new Error('Expected rejoin choice.');

        const confirmed = await caller.auth.kakaoResolveAccount({
            oauthSessionId: recovery.oauthSessionId,
            action: 'rejoin',
        });
        expect(confirmed).toMatchObject({ status: 'join', email: 'tester@example.com' });
        if (confirmed.status !== 'join') throw new Error('Expected registration session.');

        const registered = await caller.auth.register({
            oauthSessionId: confirmed.oauthSessionId,
            username: 'rejoined-user',
            credential: sealPassword('rejoined-password'),
            displayName: '재가입사용자',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });
        expect(registered.status).toBe('otp');
        expect(await users.findByUsername('rejoined-user')).toMatchObject({
            oauthType: 'KAKAO',
            oauthId: '1',
            email: 'tester@example.com',
        });
    });

    it('does not let the registration mutation bypass the recovery confirmation', async () => {
        const { caller, users, sealPassword } = buildCaller();
        await users.createUser({
            username: 'retained-owner',
            password: 'owner-password',
            oauth: {
                type: 'KAKAO',
                id: 'former-kakao-id',
                email: 'tester@example.com',
                info: {},
            },
        });

        const start = await caller.auth.kakaoStart({ mode: 'login' });
        const recovery = await caller.auth.kakaoExchange({ code: 'oauth-code', state: start.state });
        if (recovery.status !== 'account_recovery') throw new Error('Expected account recovery choice.');

        await expect(
            caller.auth.register({
                oauthSessionId: recovery.oauthSessionId,
                username: 'bypass-user',
                credential: sealPassword('bypass-password'),
                displayName: '우회사용자',
                termsAgreed: true,
                privacyAgreed: true,
                thirdPartyUse: false,
            })
        ).rejects.toMatchObject({
            code: 'PRECONDITION_FAILED',
            message: expect.stringContaining('복구 여부를 먼저 선택'),
        });
    });

    it('synchronizes a changed email by stable Kakao ID during Kakao login', async () => {
        const { caller, users, kakaoProfile } = buildCaller({
            kakaoId: 'stable-kakao-id',
            kakaoEmail: 'changed@example.com',
        });
        const user = await users.createUser({
            username: 'kakao-email-change',
            password: 'email-change-password',
            oauth: {
                type: 'KAKAO',
                id: 'stable-kakao-id',
                email: 'before@example.com',
                info: {},
            },
        });
        await users.markKakaoTalkVerified(user.id, new Date(Date.now() + 60_000));

        const start = await caller.auth.kakaoStart({ mode: 'login' });
        const login = await caller.auth.kakaoExchange({ code: 'oauth-code', state: start.state });

        expect(login.status).toBe('login');
        expect((await users.findById(user.id))?.email).toBe(kakaoProfile.email);
        expect(await users.findByEmail('before@example.com')).toBeNull();
    });

    it('checks Kakao identity and changed email on password login, then verifies the talk OTP', async () => {
        const { caller, users, sealPassword, kakaoProfile, sentTalkMessages } = buildCaller({
            kakaoId: 'password-login-kakao-id',
            kakaoEmail: 'after-password-login@example.com',
        });
        const user = await users.createUser({
            username: 'kakao-password-login',
            password: 'kakao-password',
            oauth: {
                type: 'KAKAO',
                id: kakaoProfile.id,
                email: 'before-password-login@example.com',
                info: {
                    accessToken: 'stored-access-token',
                    refreshToken: 'stored-refresh-token',
                    accessTokenValidUntil: new Date(Date.now() + 60_000).toISOString(),
                    refreshTokenValidUntil: new Date(Date.now() + 86_400_000).toISOString(),
                },
            },
        });

        const login = await caller.auth.login({
            username: user.username,
            credential: sealPassword('kakao-password'),
        });
        expect(login.status).toBe('otp');
        if (login.status !== 'otp') {
            throw new Error('Expected Kakao OTP challenge.');
        }
        expect((await users.findById(user.id))?.email).toBe(kakaoProfile.email);
        expect(sentTalkMessages).toHaveLength(1);

        await expect(caller.auth.kakaoOtp({ challengeId: login.challengeId, code: '0000' })).rejects.toMatchObject({
            code: 'UNAUTHORIZED',
            message: expect.stringContaining('2회 더 시도'),
        });
        const code = sentTalkMessages[0]?.match(/인증 코드는 (\d{4})/)?.[1];
        expect(code).toBeTruthy();
        const completed = await caller.auth.kakaoOtp({ challengeId: login.challengeId, code: code! });
        expect(completed.validUntil).toBeTruthy();
        expect((await users.findById(user.id))?.kakaoTalkVerifiedUntil).toBe(completed.validUntil);

        const nextLogin = await caller.auth.login({
            username: user.username,
            credential: sealPassword('kakao-password'),
        });
        expect(nextLogin.status).toBe('login');
        expect(sentTalkMessages).toHaveLength(1);
    });

    it('refreshes an expired access token before the password-login identity check', async () => {
        const { caller, users, sealPassword, kakaoProfile, refreshTokenCalls } = buildCaller({
            kakaoId: 'refresh-kakao-id',
            kakaoEmail: 'refreshed-email@example.com',
            allowKakaoRefresh: true,
        });
        const user = await users.createUser({
            username: 'refresh-kakao-user',
            password: 'refresh-kakao-password',
            oauth: {
                type: 'KAKAO',
                id: kakaoProfile.id,
                email: 'old-refresh-email@example.com',
                info: {
                    accessToken: 'expired-access-token',
                    refreshToken: 'usable-refresh-token',
                    accessTokenValidUntil: new Date(Date.now() - 60_000).toISOString(),
                    refreshTokenValidUntil: new Date(Date.now() + 86_400_000).toISOString(),
                },
            },
        });

        const login = await caller.auth.login({
            username: user.username,
            credential: sealPassword('refresh-kakao-password'),
        });

        expect(login.status).toBe('otp');
        expect(refreshTokenCalls).toEqual(['usable-refresh-token']);
        expect(await users.findById(user.id)).toMatchObject({
            email: 'refreshed-email@example.com',
            oauthInfo: {
                accessToken: 'refreshed-access-token',
                refreshToken: 'usable-refresh-token',
            },
        });
    });

    it('rejects password-login email synchronization when the changed email belongs to another user', async () => {
        const { caller, users, sealPassword, kakaoProfile } = buildCaller({
            kakaoId: 'conflicting-email-kakao-id',
            kakaoEmail: 'occupied@example.com',
        });
        const user = await users.createUser({
            username: 'conflicting-email-user',
            password: 'conflicting-email-password',
            oauth: {
                type: 'KAKAO',
                id: kakaoProfile.id,
                email: 'previous@example.com',
                info: {
                    accessToken: 'stored-access-token',
                    accessTokenValidUntil: new Date(Date.now() + 60_000).toISOString(),
                },
            },
        });
        await users.createUser({
            username: 'occupied-email-owner',
            password: 'occupied-email-password',
            oauth: {
                type: 'KAKAO',
                id: 'other-kakao-id',
                email: kakaoProfile.email,
                info: {},
            },
        });

        await expect(
            caller.auth.login({
                username: user.username,
                credential: sealPassword('conflicting-email-password'),
            })
        ).rejects.toMatchObject({
            code: 'CONFLICT',
            message: expect.stringContaining('이미 다른 계정에서 사용 중'),
        });
        expect((await users.findById(user.id))?.email).toBe('previous@example.com');
    });

    it('reuses the active challenge and blocks retries after three wrong OTP values', async () => {
        const { caller, users, sealPassword, kakaoProfile, sentTalkMessages } = buildCaller({
            kakaoId: 'attempt-limit-kakao-id',
        });
        const user = await users.createUser({
            username: 'attempt-limit-user',
            password: 'attempt-limit-password',
            oauth: {
                type: 'KAKAO',
                id: kakaoProfile.id,
                email: kakaoProfile.email,
                info: {
                    accessToken: 'stored-access-token',
                    accessTokenValidUntil: new Date(Date.now() + 60_000).toISOString(),
                },
            },
        });
        const login = await caller.auth.login({
            username: user.username,
            credential: sealPassword('attempt-limit-password'),
        });
        expect(login.status).toBe('otp');
        if (login.status !== 'otp') {
            throw new Error('Expected Kakao OTP challenge.');
        }

        for (const remaining of [2, 1, 0]) {
            await expect(caller.auth.kakaoOtp({ challengeId: login.challengeId, code: '0000' })).rejects.toMatchObject({
                code: 'UNAUTHORIZED',
                message:
                    remaining > 0 ? expect.stringContaining(`${remaining}회 더 시도`) : expect.stringContaining('초과'),
            });
        }
        const retried = await caller.auth.login({
            username: user.username,
            credential: sealPassword('attempt-limit-password'),
        });
        expect(retried).toMatchObject({ status: 'otp', challengeId: login.challengeId, attemptsRemaining: 0 });
        expect(sentTalkMessages).toHaveLength(1);
    });

    it('blocks Kakao login while a ban is active', async () => {
        const { caller, users, sealPassword, setSessionHeader } = buildCaller();
        const register = await caller.auth.registerLocal({
            username: 'kakao-banned-user',
            credential: sealPassword('kakao-banned-password'),
            displayName: '카카오제재유저',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });
        setSessionHeader(register.sessionToken);
        const verifyStart = await caller.auth.kakaoStart({ mode: 'verify' });
        await caller.auth.kakaoExchange({
            code: 'oauth-code',
            state: verifyStart.state,
        });

        const stored = await users.findByUsername('kakao-banned-user');
        expect(stored).not.toBeNull();
        if (stored) {
            await users.updateSanctions(stored.id, {
                bannedUntil: new Date(Date.now() + 60_000).toISOString(),
            });
        }

        const loginStart = await caller.auth.kakaoStart({ mode: 'login' });
        await expect(
            caller.auth.kakaoExchange({
                code: 'oauth-code',
                state: loginStart.state,
            })
        ).rejects.toMatchObject({
            code: 'FORBIDDEN',
            message: 'Account login is blocked.',
        });
    });

    it('carries the bootstrap superuser role into game sessions', async () => {
        const previousToken = process.env.GATEWAY_BOOTSTRAP_TOKEN;
        process.env.GATEWAY_BOOTSTRAP_TOKEN = 'bootstrap-test-token';
        try {
            const { caller } = buildCaller();
            const bootstrap = await caller.auth.bootstrapLocal({
                token: 'bootstrap-test-token',
                username: 'admin',
                password: 'secretpass',
                displayName: 'Admin',
            });

            expect(bootstrap.user.roles).toEqual(['superuser']);

            const issued = await caller.auth.issueGameSession({
                sessionToken: bootstrap.sessionToken,
                profile: 'che:default',
            });
            const payload = decryptGameSessionToken(issued.gameToken, 'test-secret');

            expect(payload?.user.roles).toEqual(['superuser']);
        } finally {
            if (previousToken === undefined) {
                delete process.env.GATEWAY_BOOTSTRAP_TOKEN;
            } else {
                process.env.GATEWAY_BOOTSTRAP_TOKEN = previousToken;
            }
        }
    });

    it('registers and issues a game session', async () => {
        const { caller, oauthSessions, sealPassword, sentTalkMessages } = buildCaller();
        const oauthSession = await oauthSessions.createSession({
            mode: 'login',
            kakaoId: '1',
            email: 'tester@example.com',
            accessToken: 'token',
            refreshToken: 'refresh',
            accessTokenValidUntil: new Date().toISOString(),
            refreshTokenValidUntil: new Date().toISOString(),
            createdAt: new Date().toISOString(),
        });
        const register = await caller.auth.register({
            oauthSessionId: oauthSession.id,
            username: 'tester',
            credential: sealPassword('secretpass'),
            displayName: 'Tester',
            termsAgreed: true,
            privacyAgreed: true,
            thirdPartyUse: false,
        });

        expect(register.status).toBe('otp');
        if (register.status !== 'otp') {
            throw new Error('Expected Kakao OTP challenge.');
        }
        const code = sentTalkMessages.at(-1)?.match(/인증 코드는 (\d{4})/)?.[1];
        expect(code).toBeTruthy();
        const completed = await caller.auth.kakaoOtp({ challengeId: register.challengeId, code: code! });
        expect(completed.user.username).toBe('tester');
        expect(completed.sessionToken).toBeTruthy();

        const issued = await caller.auth.issueGameSession({
            sessionToken: completed.sessionToken,
            profile: 'che:default',
        });

        expect(issued.profile).toBe('che:default');
        expect(issued.gameToken).toBeTruthy();

        const validated = await caller.auth.validateGameSession({
            profile: 'che:default',
            gameToken: issued.gameToken,
        });

        expect(validated?.user.username).toBe('tester');
    });

    it('keeps the migrated member number inside the encrypted game identity', async () => {
        const { caller, users, sessions } = buildCaller();
        const user = await users.createUser({
            username: 'legacy-seed-user',
            password: 'secretpass',
        });
        user.legacyMemberNo = 42;
        const session = await sessions.createSession(user);

        const issued = await caller.auth.issueGameSession({
            sessionToken: session.sessionToken,
            profile: 'che:default',
        });
        const payload = decryptGameSessionToken(issued.gameToken, 'test-secret');

        expect(payload?.user.legacyMemberNo).toBe(42);
        const validated = await caller.auth.validateGameSession({
            profile: 'che:default',
            gameToken: issued.gameToken,
        });
        expect(validated).toMatchObject({
            user: {
                id: user.id,
            },
        });
        expect(validated?.user).not.toHaveProperty('legacyMemberNo');
    });

    it('issues each game token from the latest user roles, sanctions, and icon', async () => {
        const { caller, users, sessions } = buildCaller();
        const user = await users.createUser({
            username: 'fresh-game-identity',
            password: 'secretpass',
        });
        user.legacyGrade = 0;
        const session = await sessions.createSession(user);

        await users.updateRoles(user.id, ['user', 'latest-role']);
        await users.updateSanctions(user.id, {
            warningCount: 2,
            legacyPenalty: {
                any: {
                    chat: { expire: 4_102_444_800, value: 1 },
                },
            },
        });
        await users.updateIcon(user.id, 'latest-owner.webp', 3, new Date('2026-07-30T12:00:00.000Z'));

        const issued = await caller.auth.issueGameSession({
            sessionToken: session.sessionToken,
            profile: 'che:default',
        });
        const payload = decryptGameSessionToken(issued.gameToken, 'test-secret');

        expect(payload?.user).toMatchObject({
            id: user.id,
            roles: ['user', 'latest-role'],
            picture: 'latest-owner.webp',
            imageServer: 3,
            iconUpdatedAt: '2026-07-30T12:00:00.000Z',
            canUseGeneralPicture: false,
        });
        expect(payload?.sanctions).toMatchObject({
            warningCount: 2,
            legacyPenalty: {
                any: {
                    chat: { expire: 4_102_444_800, value: 1 },
                },
            },
        });
    });

    it('revokes the gateway session and every linked game session on logout', async () => {
        const { caller, users, sessions } = buildCaller();
        const user = await users.createUser({
            username: 'logout-user',
            password: 'secretpass',
        });
        const session = await sessions.createSession(user);
        const gameSession = await sessions.createGameSession(session.sessionToken, 'che:default');
        expect(gameSession).not.toBeNull();

        await caller.auth.logout({ sessionToken: session.sessionToken });

        expect(await sessions.getSession(session.sessionToken)).toBeNull();
        expect(
            gameSession ? await sessions.getGameSession(gameSession.profile, gameSession.gameToken) : undefined
        ).toBeNull();
    });
});

describe('account self service', () => {
    it('changes only the authenticated user password after verifying the current password', async () => {
        const { caller, users, sessions, sealPassword } = buildCaller();
        const user = await users.createUser({
            username: 'self-service',
            password: 'current-password',
        });
        const session = await sessions.createSession(user);

        await expect(
            caller.account.changePassword({
                sessionToken: session.sessionToken,
                currentCredential: sealPassword('wrong-password'),
                newCredential: sealPassword('next-password'),
            })
        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });

        await caller.account.changePassword({
            sessionToken: session.sessionToken,
            currentCredential: sealPassword('current-password'),
            newCredential: sealPassword('next-password'),
        });

        const refreshed = await users.findById(user.id);
        expect(refreshed && (await users.verifyPassword(refreshed, 'next-password'))).toBe(true);
    });

    it('revokes the session and schedules deletion after 30 days', async () => {
        const { caller, users, sessions, sealPassword } = buildCaller();
        const user = await users.createUser({
            username: 'delete-self',
            password: 'current-password',
        });
        const session = await sessions.createSession(user);

        const result = await caller.account.scheduleDeletion({
            sessionToken: session.sessionToken,
            currentCredential: sealPassword('current-password'),
        });

        expect(new Date(result.deleteAfter).getTime()).toBeGreaterThan(Date.now() + 29 * 24 * 60 * 60 * 1000);
        expect((await users.findById(user.id))?.deleteAfter).toBe(result.deleteAfter);
        expect(await sessions.getSession(session.sessionToken)).toBeNull();
    });

    it('revokes third-party use consent without allowing it to be re-enabled', async () => {
        const { caller, users, sessions } = buildCaller();
        const user = await users.createUser({
            username: 'privacy-self',
            password: 'current-password',
        });
        const session = await sessions.createSession(user);

        await caller.account.disallowThirdPartyUse({ sessionToken: session.sessionToken });

        expect((await users.findById(user.id))?.thirdPartyUse).toBe(false);
    });

    it('validates and stores a legacy-sized account icon with a daily change limit', async () => {
        const iconDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-account-icon-'));
        try {
            const { caller, users, sessions, flushPublisher, userIconUpload } = buildCaller({
                userIconDir: iconDir,
            });
            const user = await users.createUser({
                username: 'icon-self',
                password: 'current-password',
            });
            const session = await sessions.createSession(user);
            const png = await sharp({
                create: {
                    width: 64,
                    height: 64,
                    channels: 4,
                    background: '#334455',
                },
            })
                .png()
                .toBuffer();

            const result = await caller.account.changeIcon({
                sessionToken: session.sessionToken,
                imageData: `data:image/png;base64,${png.toString('base64')}`,
            });
            const updated = await users.findById(user.id);
            const account = await caller.account.get({ sessionToken: session.sessionToken });

            expect(result.iconUrl).toMatch(
                /^https:\/\/sam-image\.hided\.net\/icons\/users\/core2026\/[a-f0-9]{32}\.png$/
            );
            expect(result.profiles.map((profile) => profile.profileName)).toEqual(['che:default', 'hwe:default']);
            expect(account?.icons[0]?.url).toMatch(
                /^https:\/\/sam-image\.hided\.net\/icons\/users\/core2026\/[a-f0-9]{32}\.png$/
            );
            expect(updated?.imageServer).toBe(0);
            expect(flushPublisher.publishUserFlush).toHaveBeenCalledWith(user.id, 'account-icon-changed');
            expect(userIconUpload.upload).toHaveBeenCalledWith(
                expect.objectContaining({ contentType: 'image/png', body: png })
            );
            await expect(caller.account.deleteIcon({ sessionToken: session.sessionToken })).rejects.toMatchObject({
                code: 'TOO_MANY_REQUESTS',
            });
        } finally {
            await fs.rm(iconDir, { recursive: true, force: true });
        }
    });

    it('atomically allows only one icon change per KST day and removes the losing file', async () => {
        const iconDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-account-icon-race-'));
        try {
            const { caller, users, sessions } = buildCaller({ userIconDir: iconDir });
            const user = await users.createUser({
                username: 'icon-race',
                password: 'current-password',
            });
            const session = await sessions.createSession(user);
            const png = await sharp({
                create: {
                    width: 64,
                    height: 64,
                    channels: 4,
                    background: '#556677',
                },
            })
                .png()
                .toBuffer();
            const attempts = await Promise.allSettled(
                [1, 2].map(() =>
                    caller.account.changeIcon({
                        sessionToken: session.sessionToken,
                        imageData: `data:image/png;base64,${png.toString('base64')}`,
                    })
                )
            );

            expect(attempts.filter(({ status }) => status === 'fulfilled')).toHaveLength(1);
            expect(attempts.filter(({ status }) => status === 'rejected')).toHaveLength(1);
            expect(await users.listIcons(user.id)).toHaveLength(1);
        } finally {
            await fs.rm(iconDir, { recursive: true, force: true });
        }
    });

    it('flushes an account icon deletion with selectable running profiles', async () => {
        const { caller, users, sessions, flushPublisher } = buildCaller();
        const user = await users.createUser({
            username: 'icon-delete',
            password: 'current-password',
        });
        await users.updateIcon(user.id, 'old.png', 1, new Date('2026-07-30T12:00:00.000Z'));
        const session = await sessions.createSession(user);

        const result = await caller.account.deleteIcon({ sessionToken: session.sessionToken });
        const updated = await users.findById(user.id);

        expect(result).toMatchObject({
            ok: true,
            iconUrl: null,
            profiles: [{ profileName: 'che:default' }, { profileName: 'hwe:default' }],
        });
        expect(updated).toMatchObject({ picture: 'default.jpg', imageServer: 0 });
        expect(flushPublisher.publishUserFlush).toHaveBeenCalledWith(user.id, 'account-icon-deleted');
    });

    it('uses a rolling 24-hour upload window and preserves delete-to-upload behavior', async () => {
        const iconDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-account-icon-kst-'));
        const png = await sharp({
            create: {
                width: 64,
                height: 64,
                channels: 4,
                background: '#667788',
            },
        })
            .png()
            .toBuffer();
        try {
            vi.useFakeTimers();
            vi.setSystemTime(new Date('2026-07-31T14:59:59.000Z'));
            const { caller, users, sessions } = buildCaller({ userIconDir: iconDir });
            const user = await users.createUser({
                username: 'icon-kst',
                password: 'current-password',
            });
            await users.updateIcon(user.id, 'old.png', 1, new Date('2026-07-31T00:00:00.000Z'));
            const session = await sessions.createSession(user);

            await expect(caller.account.deleteIcon({ sessionToken: session.sessionToken })).rejects.toMatchObject({
                code: 'TOO_MANY_REQUESTS',
            });

            vi.setSystemTime(new Date('2026-07-31T15:00:00.000Z'));
            await expect(caller.account.deleteIcon({ sessionToken: session.sessionToken })).rejects.toMatchObject({
                code: 'TOO_MANY_REQUESTS',
            });

            vi.setSystemTime(new Date('2026-08-01T00:00:00.000Z'));
            const nextSession = await sessions.createSession(user);
            const deleted = await caller.account.deleteIcon({ sessionToken: nextSession.sessionToken });
            expect(deleted.revision).toBe('2026-08-01T00:00:00.000Z');

            const changed = await caller.account.changeIcon({
                sessionToken: nextSession.sessionToken,
                imageData: `data:image/png;base64,${png.toString('base64')}`,
            });
            expect(new Date(changed.revision).getTime()).toBeGreaterThan(new Date(deleted.revision).getTime());
            expect((await users.findById(user.id))?.picture).not.toBe('default.jpg');
        } finally {
            vi.useRealTimers();
            await fs.rm(iconDir, { recursive: true, force: true });
        }
    });

    it('does not commit an icon when profile discovery fails before mutation', async () => {
        const iconDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-account-icon-profile-failure-'));
        try {
            const { caller, users, sessions } = buildCaller({
                userIconDir: iconDir,
                profileListError: new Error('profile unavailable'),
            });
            const user = await users.createUser({
                username: 'icon-profile-failure',
                password: 'current-password',
            });
            const session = await sessions.createSession(user);
            const png = await sharp({
                create: { width: 64, height: 64, channels: 4, background: '#778899' },
            })
                .png()
                .toBuffer();

            await expect(
                caller.account.changeIcon({
                    sessionToken: session.sessionToken,
                    imageData: `data:image/png;base64,${png.toString('base64')}`,
                })
            ).rejects.toThrow('profile unavailable');
            expect(await fs.readdir(iconDir)).toEqual([]);
            expect(await users.findById(user.id)).toMatchObject({
                picture: 'default.jpg',
                imageServer: 0,
            });
        } finally {
            await fs.rm(iconDir, { recursive: true, force: true });
        }
    });

    it('returns a recoverable success when flush publication fails after commit', async () => {
        const iconDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-account-icon-flush-failure-'));
        try {
            const { caller, users, sessions } = buildCaller({
                userIconDir: iconDir,
                flushError: new Error('redis unavailable'),
            });
            const user = await users.createUser({
                username: 'icon-flush-failure',
                password: 'current-password',
            });
            const session = await sessions.createSession(user);
            const png = await sharp({
                create: { width: 64, height: 64, channels: 4, background: '#8899aa' },
            })
                .png()
                .toBuffer();

            const changed = await caller.account.changeIcon({
                sessionToken: session.sessionToken,
                imageData: `data:image/png;base64,${png.toString('base64')}`,
            });
            expect(changed.flushPublished).toBe(false);
            expect((await users.findById(user.id))?.picture).not.toBe('default.jpg');

            await expect(caller.account.prepareIconSync({ sessionToken: session.sessionToken })).resolves.toMatchObject(
                {
                    projection: {
                        revision: changed.revision,
                        imageServer: 0,
                    },
                    profiles: [{ profileName: 'che:default' }, { profileName: 'hwe:default' }],
                }
            );
        } finally {
            await fs.rm(iconDir, { recursive: true, force: true });
        }
    });
});