package web

import (
	"net/http"
	"path/filepath"
	"strings"
	"testing"

	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
)

// R-694 (v0.275.0) — an installed app whose admin login was GENERATED by a restore: the page shows no value and no eye
// for it and says the old password is the one that works; an app without that record shows the eye.
//
// v0.322.0 (R-1103): moved from the install form (which no longer renders for an installed app, R-1095) to the settings
// tab, through the production route (s.ServeHTTP) on a real stack manager.
// RED-PROOF (2026-10-16, REPORT): with the `{{- if .Restored}}` branch removed from the login panel, this failed at
// „the restored login is offered for reveal".
func TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin(t *testing.T) {
	s := tuningHarness(t, tuningEnv())
	dir := filepath.Join(s.cfg.Paths.StacksDir, "calibre-web")
	if err := stacks.SaveAppConfig(dir, &stacks.AppConfig{Deployed: true, Env: tuningEnv(), RestoredLogins: []string{"ADMIN_PASSWORD"}}, nil, nil); err != nil {
		t.Fatal(err)
	}
	_ = s.stackMgr.ScanStacks()
	rec := appGet(t, s, "/apps/calibre-web/settings")
	if rec.Code != http.StatusOK {
		t.Fatalf("GET settings = %d", rec.Code)
	}
	body := rec.Body.String()
	if strings.Contains(body, tuningPassword) {
		t.Fatal("the restore-generated password is in the page")
	}
	if strings.Contains(body, `data-login-reveal="ADMIN_PASSWORD"`) {
		t.Fatal("the restored login is offered for reveal")
	}
	if !strings.Contains(body, `data-login-restored="ADMIN_PASSWORD"`) {
		t.Fatal("the page does not say to use the old password")
	}
	// Control: without the record the same app offers the eye.
	plain := tuningHarness(t, tuningEnv())
	if b := appGet(t, plain, "/apps/calibre-web/settings").Body.String(); !strings.Contains(b, `data-login-reveal="ADMIN_PASSWORD"`) || strings.Contains(b, `data-login-restored`) {
		t.Fatal("control: an app without restored_logins does not offer its eye")
	}
}