/**
 * Regression for the review's C1: `reset_user_pin` wrote to a non-existent
 * column (`pin_failed_attempts` vs the real `failed_pin_attempts`), so the
 * endpoint 500'd every time and never returned a PIN — the feature had never
 * worked against a real DB and no test caught it. These specs pin the contract:
 * a successful reset returns a fresh 4-digit PIN, and the target can recover
 * with it.
 */
import { test, expect } from '../../fixtures/test';

test.describe('Host — reset guest PIN (C1)', () => {
  test('resetting a guest PIN returns a fresh 4-digit PIN', async ({ api, host, guest }) => {
    const target = await guest('ResetMe');

    const { status, body } = await api.resetUserPin(host.jwt, target.userId);

    expect(status).toBe(200);
    expect(body.pin).toMatch(/^\d{4}$/);
  });

  test('the target can recover with the newly reset PIN (and not the old one)', async ({
    api,
    host,
    guest,
  }) => {
    const target = await guest('RecoverWithNewPin');

    const { body } = await api.resetUserPin(host.jwt, target.userId);
    const newPin = body.pin!;

    // New PIN works.
    await api.recover(target.displayName, newPin, { expectedStatus: [200] });

    // Old PIN no longer works (overwritten). 401 = wrong PIN.
    if (target.pin !== newPin) {
      await api.recover(target.displayName, target.pin, { expectedStatus: [401] });
    }
  });

  test('a host cannot reset their own PIN via this endpoint', async ({ api, host }) => {
    await api.resetUserPin(host.jwt, host.userId, { expectedStatus: [400] });
  });
});