package api_test

import (
	"context"
	"net/http"
	"testing"
)

// TestPendingCertDoesNotShortCircuitCurriculumCheck ensures that a pending
// certificate does not satisfy HasCompletedCurriculum. Only an issued
// (non-revoked) certificate should bypass the lesson-completion check.
func TestPendingCertDoesNotShortCircuitCurriculumCheck(t *testing.T) {
	e := setup(t)
	token, uid := register(t, e, "CertPending", "cert-pending@test.dev")
	admin := login(t, e, bootstrapAdminEmail)

	// Forcibly create a pending certificate in the DB (simulating a student
	// who triggered issueCertificateIfEligible via quiz submit).
	_, err := e.pool.Exec(context.Background(),
		`INSERT INTO certificates (user_id, full_name, status)
		 VALUES ($1, 'CertPending', 'pending')
		 ON CONFLICT DO NOTHING`, uid)
	if err != nil {
		t.Fatalf("insert pending cert: %v", err)
	}

	// The student has NOT passed any lessons — eligible must be false.
	code, body := e.do(t, "GET", "/api/me/certificate", token, nil)
	if code != http.StatusOK {
		t.Fatalf("get cert: %d %v", code, body)
	}
	if body["eligible"] != false {
		t.Fatalf("pending cert must not make student eligible; got eligible=%v", body["eligible"])
	}

	// Admin issues the certificate manually.
	code, _ = e.do(t, "POST", "/api/admin/users/"+itoa(uid)+"/certificate/issue", admin, nil)
	if code != http.StatusOK {
		t.Fatalf("admin issue: %d", code)
	}

	// Physical order endpoint must return 410 Gone.
	code, _ = e.do(t, "POST", "/api/me/certificate/physical", token, map[string]any{
		"recipientName": "Test", "phone": "09123456789", "address": "addr",
		"city": "tehran", "postalCode": "1234567890",
	})
	if code != http.StatusGone {
		t.Fatalf("physical endpoint must be disabled (410), got %d", code)
	}
}