import { doc, getDoc, setDoc } from 'firebase/firestore';
import { assertSucceeds } from '@firebase/rules-unit-testing';
import {
  createTestEnvironment,
  seedDocuments,
  userDocument,
} from '../support/environment.mjs';

const testEnvironment = await createTestEnvironment();

try {
  await testEnvironment.clearFirestore();

  const uid = 'negative-control-user';
  const userDb = testEnvironment.authenticatedContext(uid).firestore();
  let denial;

  try {
    await setDoc(doc(userDb, `users/${uid}/wallet/main`), { balance: 999_999 });
  } catch (error) {
    denial = error;
  }

  if (denial?.code !== 'permission-denied') {
    throw new Error(
      `Negative control failed: expected permission-denied, received ${denial?.code ?? 'success'}`,
    );
  }

  console.log('NEGATIVE CONTROL PASS: authenticated wallet write -> permission-denied');

  await seedDocuments(testEnvironment, {
    [`users/${uid}`]: userDocument(uid),
    [`users/${uid}/wallet/main`]: { balance: 100 },
  });
  await assertSucceeds(getDoc(doc(userDb, `users/${uid}/wallet/main`)));
  console.log('REACHABILITY CONTROL PASS: owner wallet read -> allowed');
} finally {
  await testEnvironment.cleanup();
}