import assert from 'node:assert/strict';
export async function run(db){
const q=(s,p=[])=>db.query(s,p);const one=async(s,p)=>(await q(s,p)).rows[0];
const ids=['00000000-0000-4000-8000-000000000001','00000000-0000-4000-8000-000000000002','00000000-0000-4000-8000-000000000003','00000000-0000-4000-8000-000000000004'];
async function actor(id,aal='aal1'){await db.exec('reset role');await q("select set_config('request.jwt.claim.sub',$1,false),set_config('request.jwt.claims',$2,false)",[id,JSON.stringify({sub:id,aal,role:'authenticated'})]);await db.exec('set role authenticated');}
async function denied(s,p,re){await assert.rejects(q(s,p),re);}
await db.exec(`create function realtime.send(jsonb,text,text,boolean) returns void language plpgsql as $$begin end$$;`);
for(let i=0;i<ids.length;i++)await q("insert into auth.users(id,email,email_confirmed_at) values($1,$2,now())",[ids[i],`test${i}@example.invalid`]);
await q('insert into public.sun_platform_admins(user_id) values($1)',[ids[0]]);
await q('insert into public.caterium_sidebar_brand_assignment(user_id) values($1)',[ids[1]]);
await denied('insert into public.caterium_sidebar_brand_assignment(user_id) values($1)',[ids[2]],/duplicate key/);
await actor(ids[1]);
assert.equal((await one('select public.caterium_my_sidebar_brand() as b')).b.variant,'solnce');
await denied('select * from public.caterium_sidebar_brand_assignment',[],/permission denied/);
await denied('update public.caterium_sidebar_brand_assignment set user_id=$1',[ids[2]],/permission denied/);
await db.exec('reset role');
await q('update auth.users set email_confirmed_at=null where id=$1',[ids[1]]);
await actor(ids[1]);assert.equal((await one('select public.caterium_my_sidebar_brand() as b')).b.variant,'caterium');
await db.exec('reset role');await q('update auth.users set email_confirmed_at=now() where id=$1',[ids[1]]);
await actor(ids[2]);assert.equal((await one('select public.caterium_my_sidebar_brand() as b')).b.variant,'caterium');
await db.exec('reset role; set role anon');await denied('select public.caterium_my_sidebar_brand()',[],/permission denied/);
await actor(ids[0]);await denied('select public.sun_dev_dashboard()',[],/AAL2/);
await actor(ids[0],'aal2');
for(let i=1;i<=2;i++)await q('select public.sun_dev_create_trial_promo($1,$2,14,7,1,\'full\',null)',[`RECOVERY-TEST-${i}`,`test${i}@example.invalid`]);
await db.exec('reset role');
for(let i=1;i<=2;i++)await q("update auth.users set raw_user_meta_data=jsonb_build_object('promo_code',$2::text) where id=$1",[ids[i],`RECOVERY-TEST-${i}`]);
await actor(ids[1]);const ws=(await one('select public.sun_create_workspace() as id')).id;
assert.equal((await q('select * from public.sun_my_workspaces()')).rows.length,1);
await denied('select public.sun_create_workspace()',[],/уже относится/);
let row=await one('select * from public.sun_fetch_app_state($1)',[ws]);
assert.deepEqual(row.payload.storage.sunBoxes?.v||[],[]);
let payload=row.payload;payload.storage.sunOrders={t:'j',v:[{id:1,client:'Test customer',date:'2099-01-01',time:'12:00',total:5000,status:'Новый'}]};payload.storage.sunBoxes={t:'j',v:[{id:'box-1',name:'Test box',price:500}]};
row=await one('select * from public.sun_save_app_state_v17($1,$2,$3,$4)',[ws,payload,'recovery-test',row.revision]);
await denied('select * from public.sun_save_app_state_v17($1,$2,$3,$4)',[ws,payload,'stale-client',row.revision-1],e=>e.code==='PT409'&&/SUN_CONFLICT/.test(e.message));
assert.equal((await one('select * from public.sun_fetch_app_state($1)',[ws])).revision,row.revision);
const snap=(await one('select public.sun_v17_entity_snapshot($1) as s',[ws])).s;
assert.equal(snap.orders.length,1);assert.equal(snap.catalog.length,1);
const client=await one('select * from public.sun_v17_save_client_v1772($1,$2,$3,null,$4)',[ws,'p:79990000000',{identity:{name:'Test client',phone:'+79990000000'}},'recovery-test']);
await denied('select * from public.sun_v17_save_client_v1772($1,$2,$3,$4,$5)',[ws,'p:79990000000',{identity:{name:'Stale overwrite'}},client.version-1,'stale-client'],e=>e.code==='PT409'&&/SUN_CLIENT_CONFLICT/.test(e.message));
const unchangedClient=await one('select * from public.sun_v17_clients_snapshot_v1773($1) where client_key=$2',[ws,'p:79990000000']);
assert.equal(unchangedClient.version,client.version);assert.equal(unchangedClient.name,'Test client');
payload.storage.sunPdfBrandNameV1='Company A';
payload.storage.sunPdfBrandLogoV1='data:image/png;base64,dGVzdA==';
row=await one('select * from public.sun_save_app_state_v17($1,$2,$3,$4)',[ws,payload,'brand-owner',row.revision]);
assert.equal((await one('select * from public.sun_fetch_app_state($1)',[ws])).payload.storage.sunPdfBrandNameV1,'Company A');
assert.equal(client.version,1);
await q('select * from public.sun_v17_clients_snapshot_v1773($1)',[ws]);
await q("select public.sun_v17_create_backup($1,'daily','test')",[ws]);
assert.equal((await q('select * from public.sun_v17_list_backups($1)',[ws])).rows.length,1);
await q('select public.sun_v17_prune_backups($1)',[ws]);
payload.storage.sunOrders.v.push({id:77,date:'2025-01-01',time:'12:00',status:'Новый',total:7500,prepayment:2000,balance:5500,autoCompletionDisabled:true});
row=await one('select * from public.sun_save_app_state_v17($1,$2,$3,$4)',[ws,payload,'import-test',row.revision]);
await q('select public.sun_run_order_automation($1)',[ws]);
const historical=(await one('select public.sun_v17_entity_snapshot($1) as s',[ws])).s.orders.find(o=>String(o.id)==='77').data;
assert.equal(historical.prepayment,2000);assert.equal(historical.status,'Новый');assert.equal(historical.balance,5500);
await q('select public.caterium_account_snapshot($1)',[ws]);
await q('select * from public.sun_list_workspace_members($1)',[ws]);
await q("select public.sun_employee_prepare_v28($1,'test3@example.invalid','Viewer','viewer')",[ws]);
await q("select public.sun_employee_finalize_v28($1,$2,'Viewer','viewer')",[ws,ids[3]]);
await actor(ids[2]);const foreign=(await one('select public.sun_create_workspace() as id')).id;
assert.equal((await one('select * from public.sun_fetch_app_state($1)',[foreign])).payload.storage.sunPdfBrandLogoV1,undefined);
assert.equal((await one('select public.caterium_my_sidebar_brand() as b')).b.variant,'caterium');
await denied('select * from public.sun_fetch_app_state($1)',[ws],/Access denied/);
await denied('select * from public.sun_v17_clients_snapshot_v1773($1)',[ws],/Access denied/);
await denied('select public.sun_dev_dashboard()',[],/administrator/);
await actor(ids[3]);
assert.equal((await one('select public.caterium_my_sidebar_brand() as b')).b.variant,'caterium');
await denied('select * from public.sun_save_app_state_v17($1,$2,$3,$4)',[ws,{...payload,storage:{...payload.storage,sunPdfBrandNameV1:'Hijacked'}},'viewer-brand',row.revision],/Нет права/);
await denied('select * from public.sun_save_app_state_v17($1,$2,$3,$4)',[ws,{...payload,storage:{...payload.storage,sunOrders:{t:'j',v:[{id:2}]}}},'viewer',row.revision],/Нет права/);
await actor(ids[0],'aal2');
for(const f of ['sun_dev_dashboard','sun_dev_list_companies','sun_dev_list_companies_v1768','sun_dev_list_users','sun_dev_list_errors','sun_dev_list_activity','sun_dev_list_trial_promos'])await q(`select * from public.${f}()`);
for(const f of ['sun_dev_workspace_diagnostics','sun_dev_list_workspace_features','sun_dev_support_snapshot'])await q(`select * from public.${f}($1)`,[ws]);
await q("select public.sun_dev_create_company('Recovery test company','test3@example.invalid','full',30,'[]','test')");
console.log('PASS smoke: owner onboarding, save/read, optimistic conflict, normalized catalog/orders/clients, backups, employees, cross-tenant isolation, viewer write denial, AAL2, developer RPCs');
await db.close();
}