import { expect, request, test } from '@playwright/test';

import { contextForUser, FIXTURE_PASSWORD } from './helpers';

const BASE_URL = process.env.E2E_BASE_URL ?? 'http://localhost:5173';

/**
 * Site-Admin user management UI (issue #59): disabling a user through the admin
 * list logs them out and blocks login with a distinct message; enabling
 * restores access. (Delete + pseudonymization is covered thoroughly by the api
 * db test; the browser pack stays non-destructive so fixtures survive.)
 */
test('disabling a user in the admin UI blocks their login, enabling restores it', async ({
  browser,
}) => {
  const admin = await contextForUser(browser, BASE_URL, 'fixture-admin');

  const login = async (): Promise<number> => {
    const ctx = await request.newContext({ baseURL: BASE_URL });
    const res = await ctx.post('/api/v1/auth/login', {
      data: { usernameOrEmail: 'fixture-viewer', password: FIXTURE_PASSWORD },
    });
    const status = res.status();
    await ctx.dispose();
    return status;
  };

  expect(await login()).toBe(200); // active to begin with

  const page = await admin.newPage();
  await page.goto('/admin');
  await page.locator('.user-manager__search').fill('fixture-viewer');
  const row = page.locator('.user-row[data-username="fixture-viewer"]');
  await expect(row).toBeVisible();

  try {
    await row.locator('.user-row__disable').click();
    await expect(row.locator('.user-row__status')).toHaveText(/disabled|deaktiviert/i);
    expect(await login()).toBe(403); // account_disabled
  } finally {
    // Re-enable so the fixture is left intact for other packs / reruns.
    await row.locator('.user-row__disable').click();
    await expect(row.locator('.user-row__status')).toHaveText(/active|aktiv/i);
    await admin.close();
  }
});