//! An already-open SSH session must stop working when the account is switched

//! off. The daemon's channel-open check (`refuse_if_withheld`) runs once, and

//! most nomiscript natives never touch the tenant pool — so the tenant-pool

//! recheck alone leaves a global command surface reachable for as long as the

//! user keeps the session open.

//!

//! Gated on the `db` feature. Run via:

//!   DATABASE_URL=postgres://… cargo test -p tests-integration --features db

#![cfg(feature = "db")]

use rpc::{ScriptCtx, Session};

use server::db::DB_POOL;

use sqlx::PgPool;

use supp_macro::local_db_sqlx_test;

use uuid::Uuid;

/// Required by `local_db_sqlx_test`, which calls it before each case.

        "INSERT INTO users (

            id, user_name, email, photo, verified, user_password,

            user_role, database_name, created_at

        ) VALUES (

            $1, 'disabled-test', $2, 'default.png',

            $3, 'irrelevant', 'user', 'disabled-test', NOW()

        )",

        id,

        format!("disabled-{id}@example.test"),

        verified,

    )

/// `get-version` reads no database at all, which is the point: the refusal has

/// to come from the session gate rather than from a query happening to fail.

const HARMLESS_FORM: &str = "(:id 1 :form (get-version))";

#[local_db_sqlx_test]

async fn a_guarded_session_refuses_a_disabled_account(pool: PgPool) -> anyhow::Result<()> {

    let user_id = Uuid::new_v4();

    insert_user(&pool, user_id, false).await?;

    let mut session = Session::guarded(ScriptCtx::new(user_id)).expect("Session::guarded");

    let response = session.handle_form(HARMLESS_FORM).await;

    assert!(

        response.contains(":error") && response.contains("disabled"),

        "a disabled account must be refused on every form, got: {response}"

    );

}

#[local_db_sqlx_test]

async fn a_guarded_session_serves_an_enabled_account(pool: PgPool) -> anyhow::Result<()> {

    let user_id = Uuid::new_v4();

    insert_user(&pool, user_id, true).await?;

    let mut session = Session::guarded(ScriptCtx::new(user_id)).expect("Session::guarded");

    let response = session.handle_form(HARMLESS_FORM).await;

    assert!(

        response.contains(":value"),

        "an enabled account must be served, got: {response}"

    );

}