import assert from 'node:assert/strict';
import fs from 'node:fs';
import path from 'node:path';
import test from 'node:test';

const root = process.cwd();
const read = (relative: string) => fs.readFileSync(path.join(root, relative), 'utf8');

test('D5.6.1 exposes controlled administrative password reset with the existing user-update permission', () => {
  const controller = read('src/administration/users/users.controller.ts');
  const dto = read('src/administration/users/dto/reset-user-password.dto.ts');
  assert.match(controller, /@Post\(':id\/reset-password'\)/);
  assert.match(controller, /@RequirePermissions\('users.update'\)/);
  assert.match(dto, /@MinLength\(12\)/);
  assert.match(dto, /mustChangePassword = true/);
});

test('D5.6.1 resets lockout revokes sessions and audits without persisting the password value', () => {
  const service = read('src/administration/users/users.service.ts');
  const audit = read('src/database/entities/audit-event.entity.ts');
  assert.match(service, /user\.failedLoginAttempts = 0/);
  assert.match(service, /user\.lockedUntil = null/);
  assert.match(service, /revokeUserSessions\(id, undefined, manager\)/);
  assert.match(service, /AuditAction\.USER_PASSWORD_RESET/);
  assert.match(service, /passwordValueRecorded: false/);
  assert.match(audit, /USER_PASSWORD_RESET = 'USER_PASSWORD_RESET'/);
});