import { revalidatePath } from "next/cache";
import { redirect } from "next/navigation";
import { beforeEach, expect, it, vi } from "vitest";
import { requirePermission } from "@/lib/admin/guard";
import { saveVpn } from "./admin-vpn";

const { execute } = vi.hoisted(() => ({ execute: vi.fn() }));
vi.mock("@/features/housekeeping/domains/people/services/mutations", () => ({
	createPeopleMutationInvocation: vi.fn((staff, correlationId) => ({
		expectedActorId: staff.id,
		correlationId,
		legacy: true,
	})),
	peopleMutationService: { execute },
}));
vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
vi.mock("@/lib/permissions", () => ({
	PERMS: { SETTINGS_EDIT: "admin.settings.edit" },
}));
vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
vi.mock("next/navigation", () => ({ redirect: vi.fn() }));

const form = (data: Record<string, string>) =>
	({ get: (key: string) => data[key] ?? null }) as FormData;

beforeEach(() => {
	vi.clearAllMocks();
	vi.mocked(requirePermission).mockResolvedValue({
		id: 1,
		rank: 7,
		username: "admin",
	});
	execute.mockResolvedValue({
		ok: true,
		data: { before: {}, after: {} },
		correlationId: "vpn",
	});
});

it("preserves VPN payload, /admin revalidation, and redirect", async () => {
	await saveVpn(
		form({
			vpn_block_enabled: "1",
			vpn_provider: "proxycheck",
			vpn_api_key: "abc123",
		}),
	);
	expect(execute).toHaveBeenCalledWith(expect.anything(), "vpn.configure", {
		enabled: true,
		provider: "proxycheck",
		apiKey: "abc123",
		blockMessage: "",
	});
	expect(revalidatePath).toHaveBeenCalledWith("/admin/vpn");
	expect(redirect).toHaveBeenCalledWith("/admin/vpn?saved=1");
});

it("preserves fail-soft redirect without claiming a saved revalidation", async () => {
	execute.mockResolvedValue({
		ok: false,
		error: {
			code: "DEPENDENCY_UNAVAILABLE",
			messageKey: "errors.housekeeping.dependencyUnavailable",
		},
		correlationId: "vpn-fail",
	});
	await saveVpn(form({ vpn_provider: "none" }));
	expect(revalidatePath).not.toHaveBeenCalled();
	expect(redirect).toHaveBeenCalledWith("/admin/vpn?saved=1");
});