package store

import (
	"context"
	"net"
	"net/netip"
	"os"
	"runtime"
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	nbdns "github.com/netbirdio/netbird/dns"
	"github.com/netbirdio/netbird/management/server/integration_reference"
	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
	nbpeer "github.com/netbirdio/netbird/management/server/peer"
	"github.com/netbirdio/netbird/management/server/posture"
	"github.com/netbirdio/netbird/management/server/types"
	"github.com/netbirdio/netbird/route"
)

// TestGetAccount_LoadsCustomDomains verifies GetAccount populates account.Domains.
// SynthesizePrivateServiceZones depends on this relation to anchor a custom-domain
// private service's DNS zone; without the preload the relation is empty and the
// service is silently skipped, so a custom domain never resolves on clients.
func TestGetAccount_LoadsCustomDomains(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("The SQLite store is not properly supported by Windows yet")
	}

	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
	require.NoError(t, err)
	defer cleanup()

	assertGetAccountLoadsCustomDomains(t, store)
}

func TestPostgresql_GetAccount_LoadsCustomDomains(t *testing.T) {
	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
		t.Skip("skip CI tests on darwin and windows")
	}

	t.Setenv("NETBIRD_STORE_ENGINE", string(types.PostgresStoreEngine))
	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
	require.NoError(t, err)
	t.Cleanup(cleanup)

	assertGetAccountLoadsCustomDomains(t, store)
}

// assertGetAccountLoadsCustomDomains exercises both the gorm and pgx GetAccount
// paths: it persists two custom domains and asserts the relation comes back
// populated, which SynthesizePrivateServiceZones relies on.
func assertGetAccountLoadsCustomDomains(t *testing.T, store Store) {
	t.Helper()
	ctx := context.Background()

	accountID := "acct-custom-domains"
	require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, accountID, "user-1", "")))

	_, err := store.CreateCustomDomain(ctx, accountID, "example.com", "eu.proxy.netbird.io", true)
	require.NoError(t, err, "creating the first custom domain must succeed")
	_, err = store.CreateCustomDomain(ctx, accountID, "apps.acme.io", "us.proxy.netbird.io", false)
	require.NoError(t, err, "creating the second custom domain must succeed")

	account, err := store.GetAccount(ctx, accountID)
	require.NoError(t, err)
	require.Len(t, account.Domains, 2, "GetAccount must preload the account's custom domains")

	byDomain := map[string]string{}
	for _, d := range account.Domains {
		require.NotNil(t, d)
		byDomain[d.Domain] = d.TargetCluster
	}
	assert.Equal(t, "eu.proxy.netbird.io", byDomain["example.com"], "custom domain must carry its target cluster")
	assert.Equal(t, "us.proxy.netbird.io", byDomain["apps.acme.io"], "custom domain must carry its target cluster")
}

// TestGetAccount_ComprehensiveFieldValidation validates that GetAccount properly loads
// all fields and nested objects from the database, including deeply nested structures.
func TestGetAccount_ComprehensiveFieldValidation(t *testing.T) {
	if testing.Short() {
		t.Skip("skipping comprehensive test in short mode")
	}

	ctx := context.Background()
	store, cleanup, err := NewTestStoreFromSQL(ctx, "", t.TempDir())
	require.NoError(t, err)
	defer cleanup()

	// Create comprehensive test data
	accountID := "test-account-comprehensive"
	userID1 := "user-1"
	userID2 := "user-2"
	peerID1 := "peer-1"
	peerID2 := "peer-2"
	peerID3 := "peer-3"
	groupID1 := "group-1"
	groupID2 := "group-2"
	setupKeyID1 := "setup-key-1"
	setupKeyID2 := "setup-key-2"
	routeID1 := route.ID("route-1")
	routeID2 := route.ID("route-2")
	nsGroupID1 := "ns-group-1"
	nsGroupID2 := "ns-group-2"
	policyID1 := "policy-1"
	policyID2 := "policy-2"
	postureCheckID1 := "posture-check-1"
	postureCheckID2 := "posture-check-2"
	networkID1 := "network-1"
	routerID1 := "router-1"
	resourceID1 := "resource-1"
	patID1 := "pat-1"
	patID2 := "pat-2"
	patID3 := "pat-3"

	now := time.Now().UTC().Truncate(time.Second)
	lastLogin := now.Add(-24 * time.Hour)
	patLastUsed := now.Add(-1 * time.Hour)

	// Build comprehensive account with all fields populated
	account := &types.Account{
		Id:                     accountID,
		CreatedBy:              userID1,
		CreatedAt:              now,
		Domain:                 "example.com",
		DomainCategory:         "business",
		IsDomainPrimaryAccount: true,
		Network: &types.Network{
			Identifier: "test-network",
			Net: net.IPNet{
				IP:   net.ParseIP("100.64.0.0"),
				Mask: net.CIDRMask(10, 32),
			},
			Dns:    "test-dns",
			Serial: 42,
		},
		DNSSettings: types.DNSSettings{
			DisabledManagementGroups: []string{"dns-group-1", "dns-group-2"},
		},
		Settings: &types.Settings{
			PeerLoginExpirationEnabled: true,
			PeerLoginExpiration:        time.Hour * 24 * 30,
			GroupsPropagationEnabled:   true,
			JWTGroupsEnabled:           true,
			JWTGroupsClaimName:         "groups",
			JWTAllowGroups:             []string{"allowed-group-1", "allowed-group-2"},
			RegularUsersViewBlocked:    false,
			Extra: &types.ExtraSettings{
				PeerApprovalEnabled:       true,
				IntegratedValidatorGroups: []string{"validator-1"},
			},
		},
	}

	// Create Setup Keys with all fields
	setupKey1ExpiresAt := now.Add(30 * 24 * time.Hour)
	setupKey1LastUsed := now.Add(-2 * time.Hour)
	setupKey1 := &types.SetupKey{
		Id:         setupKeyID1,
		AccountID:  accountID,
		Key:        "setup-key-secret-1",
		Name:       "Setup Key 1",
		Type:       types.SetupKeyReusable,
		CreatedAt:  now,
		UpdatedAt:  now,
		ExpiresAt:  &setupKey1ExpiresAt,
		Revoked:    false,
		UsedTimes:  5,
		LastUsed:   &setupKey1LastUsed,
		AutoGroups: []string{groupID1, groupID2},
		UsageLimit: 100,
		Ephemeral:  false,
	}

	setupKey2ExpiresAt := now.Add(7 * 24 * time.Hour)
	setupKey2LastUsed := now.Add(-1 * time.Hour)
	setupKey2 := &types.SetupKey{
		Id:         setupKeyID2,
		AccountID:  accountID,
		Key:        "setup-key-secret-2",
		Name:       "Setup Key 2 (One-off)",
		Type:       types.SetupKeyOneOff,
		CreatedAt:  now,
		UpdatedAt:  now,
		ExpiresAt:  &setupKey2ExpiresAt,
		Revoked:    true,
		UsedTimes:  1,
		LastUsed:   &setupKey2LastUsed,
		AutoGroups: []string{},
		UsageLimit: 1,
		Ephemeral:  true,
	}

	account.SetupKeys = map[string]*types.SetupKey{
		setupKey1.Key: setupKey1,
		setupKey2.Key: setupKey2,
	}

	// Create Peers with comprehensive fields
	peer1 := &nbpeer.Peer{
		ID:        peerID1,
		AccountID: accountID,
		Key:       "peer-key-1-AAAA",
		Name:      "Peer 1",
		IP:        netip.MustParseAddr("100.64.0.1"),
		IPv6:      netip.MustParseAddr("fd00::1"),
		Meta: nbpeer.PeerSystemMeta{
			Hostname:      "peer1.example.com",
			GoOS:          "linux",
			Kernel:        "5.15.0",
			Core:          "x86_64",
			Platform:      "ubuntu",
			OS:            "Ubuntu 22.04",
			WtVersion:     "0.24.0",
			UIVersion:     "0.24.0",
			KernelVersion: "5.15.0-78-generic",
			OSVersion:     "22.04",
			NetworkAddresses: []nbpeer.NetworkAddress{
				{NetIP: netip.MustParsePrefix("192.168.1.10/32"), Mac: "00:11:22:33:44:55"},
				{NetIP: netip.MustParsePrefix("10.0.0.5/32"), Mac: "00:11:22:33:44:66"},
			},
			SystemSerialNumber: "ABC123",
			SystemProductName:  "Server Model X",
			SystemManufacturer: "Dell Inc.",
		},
		Status: &nbpeer.PeerStatus{
			LastSeen:         now.Add(-5 * time.Minute),
			Connected:        true,
			LoginExpired:     false,
			RequiresApproval: false,
		},
		Location: nbpeer.Location{
			ConnectionIP: net.ParseIP("203.0.113.10"),
			CountryCode:  "US",
			CityName:     "San Francisco",
			GeoNameID:    5391959,
		},
		SSHEnabled:                  true,
		SSHKey:                      "ssh-rsa AAAAB3NzaC1...",
		UserID:                      userID1,
		LoginExpirationEnabled:      true,
		InactivityExpirationEnabled: false,
		DNSLabel:                    "peer1",
		CreatedAt:                   now.Add(-30 * 24 * time.Hour),
		Ephemeral:                   false,
	}

	peer2 := &nbpeer.Peer{
		ID:        peerID2,
		AccountID: accountID,
		Key:       "peer-key-2-BBBB",
		Name:      "Peer 2",
		IP:        netip.MustParseAddr("100.64.0.2"),
		IPv6:      netip.MustParseAddr("fd00::2"),
		Meta: nbpeer.PeerSystemMeta{
			Hostname:  "peer2.example.com",
			GoOS:      "darwin",
			Kernel:    "22.0.0",
			Core:      "arm64",
			Platform:  "darwin",
			OS:        "macOS Ventura",
			WtVersion: "0.24.0",
			UIVersion: "0.24.0",
		},
		Status: &nbpeer.PeerStatus{
			LastSeen:         now.Add(-1 * time.Hour),
			Connected:        false,
			LoginExpired:     true,
			RequiresApproval: true,
		},
		Location: nbpeer.Location{
			ConnectionIP: net.ParseIP("198.51.100.20"),
			CountryCode:  "GB",
			CityName:     "London",
			GeoNameID:    2643743,
		},
		SSHEnabled:                  false,
		UserID:                      userID2,
		LoginExpirationEnabled:      false,
		InactivityExpirationEnabled: true,
		DNSLabel:                    "peer2",
		CreatedAt:                   now.Add(-15 * 24 * time.Hour),
		Ephemeral:                   false,
	}

	peer3 := &nbpeer.Peer{
		ID:        peerID3,
		AccountID: accountID,
		Key:       "peer-key-3-CCCC",
		Name:      "Peer 3 (Ephemeral)",
		IP:        netip.MustParseAddr("100.64.0.3"),
		IPv6:      netip.MustParseAddr("fd00::3"),
		Meta: nbpeer.PeerSystemMeta{
			Hostname: "peer3.example.com",
			GoOS:     "windows",
			Platform: "windows",
		},
		Status: &nbpeer.PeerStatus{
			LastSeen:  now.Add(-10 * time.Minute),
			Connected: true,
		},
		DNSLabel:  "peer3",
		CreatedAt: now.Add(-1 * time.Hour),
		Ephemeral: true,
	}

	account.Peers = map[string]*nbpeer.Peer{
		peerID1: peer1,
		peerID2: peer2,
		peerID3: peer3,
	}

	// Create Users with PATs
	pat1ExpirationDate := now.Add(90 * 24 * time.Hour)
	pat1 := &types.PersonalAccessToken{
		ID:             patID1,
		Name:           "PAT 1",
		HashedToken:    "hashed-token-1",
		ExpirationDate: &pat1ExpirationDate,
		CreatedAt:      now.Add(-10 * 24 * time.Hour),
		CreatedBy:      userID1,
		LastUsed:       &patLastUsed,
	}

	pat2ExpirationDate := now.Add(30 * 24 * time.Hour)
	pat2 := &types.PersonalAccessToken{
		ID:             patID2,
		Name:           "PAT 2",
		HashedToken:    "hashed-token-2",
		ExpirationDate: &pat2ExpirationDate,
		CreatedAt:      now.Add(-5 * 24 * time.Hour),
		CreatedBy:      userID1,
	}

	pat3ExpirationDate := now.Add(60 * 24 * time.Hour)
	pat3 := &types.PersonalAccessToken{
		ID:             patID3,
		Name:           "PAT 3",
		HashedToken:    "hashed-token-3",
		ExpirationDate: &pat3ExpirationDate,
		CreatedAt:      now.Add(-2 * 24 * time.Hour),
		CreatedBy:      userID2,
	}

	user1 := &types.User{
		Id:            userID1,
		AccountID:     accountID,
		Role:          types.UserRoleOwner,
		IsServiceUser: false,
		NonDeletable:  true,
		AutoGroups:    []string{groupID1},
		Issued:        types.UserIssuedAPI,
		IntegrationReference: integration_reference.IntegrationReference{
			ID:              123,
			IntegrationType: "azure_ad",
		},
		CreatedAt: now.Add(-60 * 24 * time.Hour),
		LastLogin: &lastLogin,
		Blocked:   false,
		PATs: map[string]*types.PersonalAccessToken{
			patID1: pat1,
			patID2: pat2,
		},
	}

	user2 := &types.User{
		Id:            userID2,
		AccountID:     accountID,
		Role:          types.UserRoleAdmin,
		IsServiceUser: true,
		NonDeletable:  false,
		AutoGroups:    []string{groupID2},
		Issued:        types.UserIssuedIntegration,
		IntegrationReference: integration_reference.IntegrationReference{
			ID:              456,
			IntegrationType: "google_workspace",
		},
		CreatedAt: now.Add(-30 * 24 * time.Hour),
		Blocked:   false,
		PATs: map[string]*types.PersonalAccessToken{
			patID3: pat3,
		},
	}

	account.Users = map[string]*types.User{
		userID1: user1,
		userID2: user2,
	}

	// Create Groups with peers and resources
	group1 := &types.Group{
		ID:        groupID1,
		AccountID: accountID,
		Name:      "Group 1",
		Issued:    types.GroupIssuedAPI,
		Peers:     []string{peerID1, peerID2},
		Resources: []types.Resource{
			{
				ID:   "resource-1",
				Type: types.ResourceTypeHost,
			},
		},
	}

	group2 := &types.Group{
		ID:        groupID2,
		AccountID: accountID,
		Name:      "Group 2",
		Issued:    types.GroupIssuedIntegration,
		IntegrationReference: integration_reference.IntegrationReference{
			ID:              789,
			IntegrationType: "okta",
		},
		Peers:     []string{peerID3},
		Resources: []types.Resource{},
	}

	account.Groups = map[string]*types.Group{
		groupID1: group1,
		groupID2: group2,
	}

	// Create Policies with Rules
	policy1 := &types.Policy{
		ID:          policyID1,
		AccountID:   accountID,
		Name:        "Policy 1",
		Description: "Main access policy",
		Enabled:     true,
		Rules: []*types.PolicyRule{
			{
				ID:            "rule-1",
				PolicyID:      policyID1,
				Name:          "Rule 1",
				Description:   "Allow access",
				Enabled:       true,
				Action:        types.PolicyTrafficActionAccept,
				Bidirectional: true,
				Protocol:      types.PolicyRuleProtocolALL,
				Ports:         []string{},
				PortRanges:    []types.RulePortRange{},
				Sources:       []string{groupID1},
				Destinations:  []string{groupID2},
			},
			{
				ID:            "rule-2",
				PolicyID:      policyID1,
				Name:          "Rule 2",
				Description:   "Block traffic on specific ports",
				Enabled:       true,
				Action:        types.PolicyTrafficActionDrop,
				Bidirectional: false,
				Protocol:      types.PolicyRuleProtocolTCP,
				Ports:         []string{"22", "3389"},
				PortRanges: []types.RulePortRange{
					{Start: 8000, End: 8999},
				},
				Sources:      []string{groupID2},
				Destinations: []string{groupID1},
			},
		},
	}

	policy2 := &types.Policy{
		ID:          policyID2,
		AccountID:   accountID,
		Name:        "Policy 2",
		Description: "Secondary policy",
		Enabled:     false,
		Rules: []*types.PolicyRule{
			{
				ID:            "rule-3",
				PolicyID:      policyID2,
				Name:          "Rule 3",
				Description:   "UDP access",
				Enabled:       false,
				Action:        types.PolicyTrafficActionAccept,
				Bidirectional: true,
				Protocol:      types.PolicyRuleProtocolUDP,
				Ports:         []string{"53"},
				Sources:       []string{groupID1},
				Destinations:  []string{groupID1},
			},
		},
	}

	account.Policies = []*types.Policy{policy1, policy2}

	// Create Routes
	route1 := &route.Route{
		ID:                  routeID1,
		AccountID:           accountID,
		Network:             netip.MustParsePrefix("10.0.0.0/24"),
		NetworkType:         route.IPv4Network,
		Peer:                peerID1,
		PeerGroups:          []string{},
		Description:         "Route 1",
		NetID:               "net-id-1",
		Masquerade:          true,
		Metric:              9999,
		Enabled:             true,
		Groups:              []string{groupID1},
		AccessControlGroups: []string{groupID2},
	}

	route2 := &route.Route{
		ID:                  routeID2,
		AccountID:           accountID,
		Network:             netip.MustParsePrefix("192.168.1.0/24"),
		NetworkType:         route.IPv4Network,
		Peer:                "",
		PeerGroups:          []string{groupID2},
		Description:         "Route 2 (High Availability)",
		NetID:               "net-id-2",
		Masquerade:          false,
		Metric:              100,
		Enabled:             true,
		Groups:              []string{groupID1, groupID2},
		AccessControlGroups: []string{groupID1},
	}

	account.Routes = map[route.ID]*route.Route{
		routeID1: route1,
		routeID2: route2,
	}

	// Create NameServer Groups
	nsGroup1 := &nbdns.NameServerGroup{
		ID:          nsGroupID1,
		AccountID:   accountID,
		Name:        "NS Group 1",
		Description: "Primary nameservers",
		NameServers: []nbdns.NameServer{
			{
				IP:     netip.MustParseAddr("8.8.8.8"),
				NSType: nbdns.UDPNameServerType,
				Port:   53,
			},
			{
				IP:     netip.MustParseAddr("8.8.4.4"),
				NSType: nbdns.UDPNameServerType,
				Port:   53,
			},
		},
		Groups:               []string{groupID1, groupID2},
		Domains:              []string{"example.com", "test.com"},
		Enabled:              true,
		Primary:              true,
		SearchDomainsEnabled: true,
	}

	nsGroup2 := &nbdns.NameServerGroup{
		ID:          nsGroupID2,
		AccountID:   accountID,
		Name:        "NS Group 2",
		Description: "Secondary nameservers",
		NameServers: []nbdns.NameServer{
			{
				IP:     netip.MustParseAddr("1.1.1.1"),
				NSType: nbdns.UDPNameServerType,
				Port:   53,
			},
		},
		Groups:               []string{},
		Domains:              []string{},
		Enabled:              false,
		Primary:              false,
		SearchDomainsEnabled: false,
	}

	account.NameServerGroups = map[string]*nbdns.NameServerGroup{
		nsGroupID1: nsGroup1,
		nsGroupID2: nsGroup2,
	}

	// Create Posture Checks
	postureCheck1 := &posture.Checks{
		ID:          postureCheckID1,
		AccountID:   accountID,
		Name:        "Posture Check 1",
		Description: "OS version check",
		Checks: posture.ChecksDefinition{
			NBVersionCheck: &posture.NBVersionCheck{
				MinVersion: "0.24.0",
			},
			OSVersionCheck: &posture.OSVersionCheck{
				Ios: &posture.MinVersionCheck{
					MinVersion: "16.0",
				},
				Darwin: &posture.MinVersionCheck{
					MinVersion: "22.0.0",
				},
			},
		},
	}

	postureCheck2 := &posture.Checks{
		ID:          postureCheckID2,
		AccountID:   accountID,
		Name:        "Posture Check 2",
		Description: "Geo location check",
		Checks: posture.ChecksDefinition{
			GeoLocationCheck: &posture.GeoLocationCheck{
				Locations: []posture.Location{
					{
						CountryCode: "US",
						CityName:    "San Francisco",
					},
					{
						CountryCode: "GB",
						CityName:    "London",
					},
				},
				Action: "allow",
			},
			PeerNetworkRangeCheck: &posture.PeerNetworkRangeCheck{
				Ranges: []netip.Prefix{
					netip.MustParsePrefix("192.168.0.0/16"),
					netip.MustParsePrefix("10.0.0.0/8"),
				},
				Action: "allow",
			},
		},
	}

	account.PostureChecks = []*posture.Checks{postureCheck1, postureCheck2}

	// Create Networks
	network1 := &networkTypes.Network{
		ID:          networkID1,
		AccountID:   accountID,
		Name:        "Network 1",
		Description: "Primary network",
	}

	account.Networks = []*networkTypes.Network{network1}

	// Create Network Routers
	router1 := &routerTypes.NetworkRouter{
		ID:         routerID1,
		AccountID:  accountID,
		NetworkID:  networkID1,
		Peer:       peerID1,
		PeerGroups: []string{},
		Masquerade: true,
		Metric:     100,
	}

	account.NetworkRouters = []*routerTypes.NetworkRouter{router1}

	// Create Network Resources
	resource1 := &resourceTypes.NetworkResource{
		ID:          resourceID1,
		AccountID:   accountID,
		NetworkID:   networkID1,
		Name:        "Resource 1",
		Description: "Web server",
		Prefix:      netip.MustParsePrefix("192.168.1.100/32"),
		Type:        resourceTypes.Host,
	}

	account.NetworkResources = []*resourceTypes.NetworkResource{resource1}

	// Create Onboarding
	account.Onboarding = types.AccountOnboarding{
		AccountID:             accountID,
		OnboardingFlowPending: true,
		SignupFormPending:     false,
		CreatedAt:             now,
		UpdatedAt:             now,
	}

	// Save the account to the database
	err = store.SaveAccount(ctx, account)
	require.NoError(t, err, "Failed to save comprehensive test account")

	// Retrieve the account from the database
	retrievedAccount, err := store.GetAccount(ctx, accountID)
	require.NoError(t, err, "Failed to retrieve account")
	require.NotNil(t, retrievedAccount, "Retrieved account should not be nil")

	// ========== VALIDATE TOP-LEVEL FIELDS ==========
	t.Run("TopLevelFields", func(t *testing.T) {
		assert.Equal(t, accountID, retrievedAccount.Id, "Account ID mismatch")
		assert.Equal(t, userID1, retrievedAccount.CreatedBy, "CreatedBy mismatch")
		assert.WithinDuration(t, now, retrievedAccount.CreatedAt, time.Second, "CreatedAt mismatch")
		assert.Equal(t, "example.com", retrievedAccount.Domain, "Domain mismatch")
		assert.Equal(t, "business", retrievedAccount.DomainCategory, "DomainCategory mismatch")
		assert.True(t, retrievedAccount.IsDomainPrimaryAccount, "IsDomainPrimaryAccount should be true")
	})

	// ========== VALIDATE EMBEDDED NETWORK ==========
	t.Run("EmbeddedNetwork", func(t *testing.T) {
		require.NotNil(t, retrievedAccount.Network, "Network should not be nil")
		assert.Equal(t, "test-network", retrievedAccount.Network.Identifier, "Network Identifier mismatch")
		assert.Equal(t, "test-dns", retrievedAccount.Network.Dns, "Network DNS mismatch")
		assert.Equal(t, uint64(42), retrievedAccount.Network.Serial, "Network Serial mismatch")

		expectedIP := net.ParseIP("100.64.0.0")
		assert.True(t, retrievedAccount.Network.Net.IP.Equal(expectedIP), "Network IP mismatch")
		expectedMask := net.CIDRMask(10, 32)
		assert.Equal(t, expectedMask, retrievedAccount.Network.Net.Mask, "Network Mask mismatch")
	})

	// ========== VALIDATE DNS SETTINGS ==========
	t.Run("DNSSettings", func(t *testing.T) {
		assert.Len(t, retrievedAccount.DNSSettings.DisabledManagementGroups, 2, "DisabledManagementGroups length mismatch")
		assert.Contains(t, retrievedAccount.DNSSettings.DisabledManagementGroups, "dns-group-1", "Missing dns-group-1")
		assert.Contains(t, retrievedAccount.DNSSettings.DisabledManagementGroups, "dns-group-2", "Missing dns-group-2")
	})

	// ========== VALIDATE SETTINGS ==========
	t.Run("Settings", func(t *testing.T) {
		require.NotNil(t, retrievedAccount.Settings, "Settings should not be nil")
		assert.True(t, retrievedAccount.Settings.PeerLoginExpirationEnabled, "PeerLoginExpirationEnabled mismatch")
		assert.Equal(t, time.Hour*24*30, retrievedAccount.Settings.PeerLoginExpiration, "PeerLoginExpiration mismatch")
		assert.True(t, retrievedAccount.Settings.GroupsPropagationEnabled, "GroupsPropagationEnabled mismatch")
		assert.True(t, retrievedAccount.Settings.JWTGroupsEnabled, "JWTGroupsEnabled mismatch")
		assert.Equal(t, "groups", retrievedAccount.Settings.JWTGroupsClaimName, "JWTGroupsClaimName mismatch")
		assert.Len(t, retrievedAccount.Settings.JWTAllowGroups, 2, "JWTAllowGroups length mismatch")
		assert.Contains(t, retrievedAccount.Settings.JWTAllowGroups, "allowed-group-1")
		assert.Contains(t, retrievedAccount.Settings.JWTAllowGroups, "allowed-group-2")
		assert.False(t, retrievedAccount.Settings.RegularUsersViewBlocked, "RegularUsersViewBlocked mismatch")

		// Validate Extra Settings
		require.NotNil(t, retrievedAccount.Settings.Extra, "Extra settings should not be nil")
		assert.True(t, retrievedAccount.Settings.Extra.PeerApprovalEnabled, "PeerApprovalEnabled mismatch")
		assert.Len(t, retrievedAccount.Settings.Extra.IntegratedValidatorGroups, 1, "IntegratedValidatorGroups length mismatch")
		assert.Equal(t, "validator-1", retrievedAccount.Settings.Extra.IntegratedValidatorGroups[0])
	})

	// ========== VALIDATE SETUP KEYS ==========
	t.Run("SetupKeys", func(t *testing.T) {
		require.Len(t, retrievedAccount.SetupKeys, 2, "Should have 2 setup keys")

		// Validate Setup Key 1
		sk1, exists := retrievedAccount.SetupKeys["setup-key-secret-1"]
		require.True(t, exists, "Setup key 1 should exist")
		assert.Equal(t, "Setup Key 1", sk1.Name, "Setup key 1 name mismatch")
		assert.Equal(t, types.SetupKeyReusable, sk1.Type, "Setup key 1 type mismatch")
		assert.False(t, sk1.Revoked, "Setup key 1 should not be revoked")
		assert.Equal(t, 5, sk1.UsedTimes, "Setup key 1 used times mismatch")
		assert.Equal(t, 100, sk1.UsageLimit, "Setup key 1 usage limit mismatch")
		assert.False(t, sk1.Ephemeral, "Setup key 1 should not be ephemeral")
		assert.Len(t, sk1.AutoGroups, 2, "Setup key 1 auto groups length mismatch")
		assert.Contains(t, sk1.AutoGroups, groupID1)
		assert.Contains(t, sk1.AutoGroups, groupID2)

		// Validate Setup Key 2
		sk2, exists := retrievedAccount.SetupKeys["setup-key-secret-2"]
		require.True(t, exists, "Setup key 2 should exist")
		assert.Equal(t, "Setup Key 2 (One-off)", sk2.Name, "Setup key 2 name mismatch")
		assert.Equal(t, types.SetupKeyOneOff, sk2.Type, "Setup key 2 type mismatch")
		assert.True(t, sk2.Revoked, "Setup key 2 should be revoked")
		assert.Equal(t, 1, sk2.UsedTimes, "Setup key 2 used times mismatch")
		assert.Equal(t, 1, sk2.UsageLimit, "Setup key 2 usage limit mismatch")
		assert.True(t, sk2.Ephemeral, "Setup key 2 should be ephemeral")
		assert.Len(t, sk2.AutoGroups, 0, "Setup key 2 should have empty auto groups")
	})

	// ========== VALIDATE PEERS ==========
	t.Run("Peers", func(t *testing.T) {
		require.Len(t, retrievedAccount.Peers, 3, "Should have 3 peers")

		// Validate Peer 1
		p1, exists := retrievedAccount.Peers[peerID1]
		require.True(t, exists, "Peer 1 should exist")
		assert.Equal(t, "Peer 1", p1.Name, "Peer 1 name mismatch")
		assert.Equal(t, "peer-key-1-AAAA", p1.Key, "Peer 1 key mismatch")
		assert.Equal(t, netip.MustParseAddr("100.64.0.1"), p1.IP, "Peer 1 IP mismatch")
		assert.Equal(t, userID1, p1.UserID, "Peer 1 user ID mismatch")
		assert.True(t, p1.SSHEnabled, "Peer 1 SSH should be enabled")
		assert.Equal(t, "ssh-rsa AAAAB3NzaC1...", p1.SSHKey, "Peer 1 SSH key mismatch")
		assert.True(t, p1.LoginExpirationEnabled, "Peer 1 login expiration should be enabled")
		assert.False(t, p1.Ephemeral, "Peer 1 should not be ephemeral")
		assert.Equal(t, "peer1", p1.DNSLabel, "Peer 1 DNS label mismatch")

		// Validate Peer 1 Meta
		assert.Equal(t, "peer1.example.com", p1.Meta.Hostname, "Peer 1 hostname mismatch")
		assert.Equal(t, "linux", p1.Meta.GoOS, "Peer 1 OS mismatch")
		assert.Equal(t, "5.15.0", p1.Meta.Kernel, "Peer 1 kernel mismatch")
		assert.Equal(t, "x86_64", p1.Meta.Core, "Peer 1 core mismatch")
		assert.Equal(t, "ubuntu", p1.Meta.Platform, "Peer 1 platform mismatch")
		assert.Equal(t, "Ubuntu 22.04", p1.Meta.OS, "Peer 1 OS version mismatch")
		assert.Equal(t, "0.24.0", p1.Meta.WtVersion, "Peer 1 wt version mismatch")
		assert.Equal(t, "ABC123", p1.Meta.SystemSerialNumber, "Peer 1 serial number mismatch")
		assert.Equal(t, "Server Model X", p1.Meta.SystemProductName, "Peer 1 product name mismatch")
		assert.Equal(t, "Dell Inc.", p1.Meta.SystemManufacturer, "Peer 1 manufacturer mismatch")

		// Validate Network Addresses
		assert.Len(t, p1.Meta.NetworkAddresses, 2, "Peer 1 should have 2 network addresses")
		assert.Equal(t, netip.MustParsePrefix("192.168.1.10/32"), p1.Meta.NetworkAddresses[0].NetIP, "Network address 1 IP mismatch")
		assert.Equal(t, "00:11:22:33:44:55", p1.Meta.NetworkAddresses[0].Mac, "Network address 1 MAC mismatch")
		assert.Equal(t, netip.MustParsePrefix("10.0.0.5/32"), p1.Meta.NetworkAddresses[1].NetIP, "Network address 2 IP mismatch")
		assert.Equal(t, "00:11:22:33:44:66", p1.Meta.NetworkAddresses[1].Mac, "Network address 2 MAC mismatch")

		// Validate Peer 1 Status
		require.NotNil(t, p1.Status, "Peer 1 status should not be nil")
		assert.True(t, p1.Status.Connected, "Peer 1 should be connected")
		assert.False(t, p1.Status.LoginExpired, "Peer 1 login should not be expired")
		assert.False(t, p1.Status.RequiresApproval, "Peer 1 should not require approval")

		// Validate Peer 1 Location
		assert.True(t, p1.Location.ConnectionIP.Equal(net.ParseIP("203.0.113.10")), "Peer 1 connection IP mismatch")
		assert.Equal(t, "US", p1.Location.CountryCode, "Peer 1 country code mismatch")
		assert.Equal(t, "San Francisco", p1.Location.CityName, "Peer 1 city name mismatch")
		assert.Equal(t, uint(5391959), p1.Location.GeoNameID, "Peer 1 geo name ID mismatch")

		// Validate Peer 2
		p2, exists := retrievedAccount.Peers[peerID2]
		require.True(t, exists, "Peer 2 should exist")
		assert.Equal(t, "Peer 2", p2.Name, "Peer 2 name mismatch")
		assert.Equal(t, "peer-key-2-BBBB", p2.Key, "Peer 2 key mismatch")
		assert.False(t, p2.SSHEnabled, "Peer 2 SSH should be disabled")
		assert.False(t, p2.LoginExpirationEnabled, "Peer 2 login expiration should be disabled")
		assert.True(t, p2.InactivityExpirationEnabled, "Peer 2 inactivity expiration should be enabled")

		// Validate Peer 2 Status
		require.NotNil(t, p2.Status, "Peer 2 status should not be nil")
		assert.False(t, p2.Status.Connected, "Peer 2 should not be connected")
		assert.True(t, p2.Status.LoginExpired, "Peer 2 login should be expired")
		assert.True(t, p2.Status.RequiresApproval, "Peer 2 should require approval")

		// Validate Peer 3 (Ephemeral)
		p3, exists := retrievedAccount.Peers[peerID3]
		require.True(t, exists, "Peer 3 should exist")
		assert.True(t, p3.Ephemeral, "Peer 3 should be ephemeral")
		assert.Equal(t, "Peer 3 (Ephemeral)", p3.Name, "Peer 3 name mismatch")
	})

	// ========== VALIDATE USERS ==========
	t.Run("Users", func(t *testing.T) {
		require.Len(t, retrievedAccount.Users, 2, "Should have 2 users")

		// Validate User 1
		u1, exists := retrievedAccount.Users[userID1]
		require.True(t, exists, "User 1 should exist")
		assert.Equal(t, types.UserRoleOwner, u1.Role, "User 1 role mismatch")
		assert.False(t, u1.IsServiceUser, "User 1 should not be a service user")
		assert.True(t, u1.NonDeletable, "User 1 should be non-deletable")
		assert.Equal(t, types.UserIssuedAPI, u1.Issued, "User 1 issued type mismatch")
		assert.Len(t, u1.AutoGroups, 1, "User 1 auto groups length mismatch")
		assert.Contains(t, u1.AutoGroups, groupID1, "User 1 should have group1")
		assert.False(t, u1.Blocked, "User 1 should not be blocked")
		require.NotNil(t, u1.LastLogin, "User 1 last login should not be nil")
		assert.WithinDuration(t, lastLogin, *u1.LastLogin, time.Second, "User 1 last login mismatch")

		// Validate User 1 Integration Reference
		assert.Equal(t, 123, u1.IntegrationReference.ID, "User 1 integration ID mismatch")
		assert.Equal(t, "azure_ad", u1.IntegrationReference.IntegrationType, "User 1 integration type mismatch")

		// Validate User 1 PATs
		require.Len(t, u1.PATs, 2, "User 1 should have 2 PATs")

		pat1Retrieved, exists := u1.PATs[patID1]
		require.True(t, exists, "PAT 1 should exist")
		assert.Equal(t, "PAT 1", pat1Retrieved.Name, "PAT 1 name mismatch")
		assert.Equal(t, "hashed-token-1", pat1Retrieved.HashedToken, "PAT 1 hashed token mismatch")
		require.NotNil(t, pat1Retrieved.LastUsed, "PAT 1 last used should not be nil")
		assert.WithinDuration(t, patLastUsed, *pat1Retrieved.LastUsed, time.Second, "PAT 1 last used mismatch")
		assert.Equal(t, userID1, pat1Retrieved.CreatedBy, "PAT 1 created by mismatch")
		assert.Empty(t, pat1Retrieved.UserID, "PAT 1 UserID should be cleared")

		pat2Retrieved, exists := u1.PATs[patID2]
		require.True(t, exists, "PAT 2 should exist")
		assert.Equal(t, "PAT 2", pat2Retrieved.Name, "PAT 2 name mismatch")
		assert.Nil(t, pat2Retrieved.LastUsed, "PAT 2 last used should be nil")

		// Validate User 2
		u2, exists := retrievedAccount.Users[userID2]
		require.True(t, exists, "User 2 should exist")
		assert.Equal(t, types.UserRoleAdmin, u2.Role, "User 2 role mismatch")
		assert.True(t, u2.IsServiceUser, "User 2 should be a service user")
		assert.False(t, u2.NonDeletable, "User 2 should be deletable")
		assert.Equal(t, types.UserIssuedIntegration, u2.Issued, "User 2 issued type mismatch")
		assert.Equal(t, "google_workspace", u2.IntegrationReference.IntegrationType, "User 2 integration type mismatch")

		// Validate User 2 PATs
		require.Len(t, u2.PATs, 1, "User 2 should have 1 PAT")
		pat3Retrieved, exists := u2.PATs[patID3]
		require.True(t, exists, "PAT 3 should exist")
		assert.Equal(t, "PAT 3", pat3Retrieved.Name, "PAT 3 name mismatch")
	})

	// ========== VALIDATE GROUPS ==========
	t.Run("Groups", func(t *testing.T) {
		require.Len(t, retrievedAccount.Groups, 2, "Should have 2 groups")

		// Validate Group 1
		g1, exists := retrievedAccount.Groups[groupID1]
		require.True(t, exists, "Group 1 should exist")
		assert.Equal(t, "Group 1", g1.Name, "Group 1 name mismatch")
		assert.Equal(t, types.GroupIssuedAPI, g1.Issued, "Group 1 issued type mismatch")
		assert.Len(t, g1.Peers, 2, "Group 1 should have 2 peers")
		assert.Contains(t, g1.Peers, peerID1, "Group 1 should contain peer 1")
		assert.Contains(t, g1.Peers, peerID2, "Group 1 should contain peer 2")

		// Validate Group 1 Resources
		assert.Len(t, g1.Resources, 1, "Group 1 should have 1 resource")
		assert.Equal(t, "resource-1", g1.Resources[0].ID, "Group 1 resource ID mismatch")
		assert.Equal(t, types.ResourceTypeHost, g1.Resources[0].Type, "Group 1 resource type mismatch")

		// Validate Group 2
		g2, exists := retrievedAccount.Groups[groupID2]
		require.True(t, exists, "Group 2 should exist")
		assert.Equal(t, "Group 2", g2.Name, "Group 2 name mismatch")
		assert.Equal(t, types.GroupIssuedIntegration, g2.Issued, "Group 2 issued type mismatch")
		assert.Len(t, g2.Peers, 1, "Group 2 should have 1 peer")
		assert.Contains(t, g2.Peers, peerID3, "Group 2 should contain peer 3")
		assert.Len(t, g2.Resources, 0, "Group 2 should have 0 resources")

		// Validate Group 2 Integration Reference
		assert.Equal(t, 789, g2.IntegrationReference.ID, "Group 2 integration ID mismatch")
		assert.Equal(t, "okta", g2.IntegrationReference.IntegrationType, "Group 2 integration type mismatch")
	})

	// ========== VALIDATE POLICIES ==========
	t.Run("Policies", func(t *testing.T) {
		require.Len(t, retrievedAccount.Policies, 2, "Should have 2 policies")

		// Validate Policy 1
		pol1 := retrievedAccount.Policies[0]
		if pol1.ID != policyID1 {
			pol1 = retrievedAccount.Policies[1]
		}
		assert.Equal(t, policyID1, pol1.ID, "Policy 1 ID mismatch")
		assert.Equal(t, "Policy 1", pol1.Name, "Policy 1 name mismatch")
		assert.Equal(t, "Main access policy", pol1.Description, "Policy 1 description mismatch")
		assert.True(t, pol1.Enabled, "Policy 1 should be enabled")

		// Validate Policy 1 Rules
		require.Len(t, pol1.Rules, 2, "Policy 1 should have 2 rules")

		rule1 := pol1.Rules[0]
		assert.Equal(t, "Rule 1", rule1.Name, "Rule 1 name mismatch")
		assert.Equal(t, "Allow access", rule1.Description, "Rule 1 description mismatch")
		assert.True(t, rule1.Enabled, "Rule 1 should be enabled")
		assert.Equal(t, types.PolicyTrafficActionAccept, rule1.Action, "Rule 1 action mismatch")
		assert.True(t, rule1.Bidirectional, "Rule 1 should be bidirectional")
		assert.Equal(t, types.PolicyRuleProtocolALL, rule1.Protocol, "Rule 1 protocol mismatch")
		assert.Len(t, rule1.Sources, 1, "Rule 1 sources length mismatch")
		assert.Contains(t, rule1.Sources, groupID1, "Rule 1 should have group1 as source")
		assert.Len(t, rule1.Destinations, 1, "Rule 1 destinations length mismatch")
		assert.Contains(t, rule1.Destinations, groupID2, "Rule 1 should have group2 as destination")

		rule2 := pol1.Rules[1]
		assert.Equal(t, "Rule 2", rule2.Name, "Rule 2 name mismatch")
		assert.Equal(t, types.PolicyTrafficActionDrop, rule2.Action, "Rule 2 action mismatch")
		assert.False(t, rule2.Bidirectional, "Rule 2 should not be bidirectional")
		assert.Equal(t, types.PolicyRuleProtocolTCP, rule2.Protocol, "Rule 2 protocol mismatch")
		assert.Len(t, rule2.Ports, 2, "Rule 2 ports length mismatch")
		assert.Contains(t, rule2.Ports, "22", "Rule 2 should have port 22")
		assert.Contains(t, rule2.Ports, "3389", "Rule 2 should have port 3389")
		assert.Len(t, rule2.PortRanges, 1, "Rule 2 port ranges length mismatch")
		assert.Equal(t, uint16(8000), rule2.PortRanges[0].Start, "Rule 2 port range start mismatch")
		assert.Equal(t, uint16(8999), rule2.PortRanges[0].End, "Rule 2 port range end mismatch")

		// Validate Policy 2
		pol2 := retrievedAccount.Policies[1]
		if pol2.ID != policyID2 {
			pol2 = retrievedAccount.Policies[0]
		}
		assert.Equal(t, policyID2, pol2.ID, "Policy 2 ID mismatch")
		assert.Equal(t, "Policy 2", pol2.Name, "Policy 2 name mismatch")
		assert.False(t, pol2.Enabled, "Policy 2 should be disabled")
		require.Len(t, pol2.Rules, 1, "Policy 2 should have 1 rule")

		rule3 := pol2.Rules[0]
		assert.Equal(t, "Rule 3", rule3.Name, "Rule 3 name mismatch")
		assert.False(t, rule3.Enabled, "Rule 3 should be disabled")
		assert.Equal(t, types.PolicyRuleProtocolUDP, rule3.Protocol, "Rule 3 protocol mismatch")
	})

	// ========== VALIDATE ROUTES ==========
	t.Run("Routes", func(t *testing.T) {
		require.Len(t, retrievedAccount.Routes, 2, "Should have 2 routes")

		// Validate Route 1
		r1, exists := retrievedAccount.Routes[routeID1]
		require.True(t, exists, "Route 1 should exist")
		assert.Equal(t, "Route 1", r1.Description, "Route 1 description mismatch")
		assert.Equal(t, route.IPv4Network, r1.NetworkType, "Route 1 network type mismatch")
		assert.Equal(t, peerID1, r1.Peer, "Route 1 peer mismatch")
		assert.Empty(t, r1.PeerGroups, "Route 1 peer groups should be empty")
		assert.Equal(t, route.NetID("net-id-1"), r1.NetID, "Route 1 net ID mismatch")
		assert.True(t, r1.Masquerade, "Route 1 masquerade should be enabled")
		assert.Equal(t, 9999, r1.Metric, "Route 1 metric mismatch")
		assert.True(t, r1.Enabled, "Route 1 should be enabled")
		assert.Len(t, r1.Groups, 1, "Route 1 groups length mismatch")
		assert.Contains(t, r1.Groups, groupID1, "Route 1 should have group1")
		assert.Len(t, r1.AccessControlGroups, 1, "Route 1 ACL groups length mismatch")
		assert.Contains(t, r1.AccessControlGroups, groupID2, "Route 1 should have group2 in ACL")

		// Validate Route 1 Network CIDR
		assert.Equal(t, "10.0.0.0/24", r1.Network.String(), "Route 1 network CIDR mismatch")

		// Validate Route 2
		r2, exists := retrievedAccount.Routes[routeID2]
		require.True(t, exists, "Route 2 should exist")
		assert.Equal(t, "Route 2 (High Availability)", r2.Description, "Route 2 description mismatch")
		assert.Empty(t, r2.Peer, "Route 2 peer should be empty")
		assert.Len(t, r2.PeerGroups, 1, "Route 2 peer groups length mismatch")
		assert.Contains(t, r2.PeerGroups, groupID2, "Route 2 should have group2 as peer group")
		assert.False(t, r2.Masquerade, "Route 2 masquerade should be disabled")
		assert.Equal(t, 100, r2.Metric, "Route 2 metric mismatch")
		assert.Equal(t, "192.168.1.0/24", r2.Network.String(), "Route 2 network CIDR mismatch")
	})

	// ========== VALIDATE NAME SERVER GROUPS ==========
	t.Run("NameServerGroups", func(t *testing.T) {
		require.Len(t, retrievedAccount.NameServerGroups, 2, "Should have 2 nameserver groups")

		// Validate NS Group 1
		nsg1, exists := retrievedAccount.NameServerGroups[nsGroupID1]
		require.True(t, exists, "NS Group 1 should exist")
		assert.Equal(t, "NS Group 1", nsg1.Name, "NS Group 1 name mismatch")
		assert.Equal(t, "Primary nameservers", nsg1.Description, "NS Group 1 description mismatch")
		assert.True(t, nsg1.Enabled, "NS Group 1 should be enabled")
		assert.True(t, nsg1.Primary, "NS Group 1 should be primary")
		assert.True(t, nsg1.SearchDomainsEnabled, "NS Group 1 search domains should be enabled")
		assert.Empty(t, nsg1.AccountID, "NS Group 1 AccountID should be cleared")

		// Validate NS Group 1 NameServers
		require.Len(t, nsg1.NameServers, 2, "NS Group 1 should have 2 nameservers")
		assert.Equal(t, netip.MustParseAddr("8.8.8.8"), nsg1.NameServers[0].IP, "NS Group 1 nameserver 1 IP mismatch")
		assert.Equal(t, nbdns.UDPNameServerType, nsg1.NameServers[0].NSType, "NS Group 1 nameserver 1 type mismatch")
		assert.Equal(t, 53, nsg1.NameServers[0].Port, "NS Group 1 nameserver 1 port mismatch")
		assert.Equal(t, netip.MustParseAddr("8.8.4.4"), nsg1.NameServers[1].IP, "NS Group 1 nameserver 2 IP mismatch")

		// Validate NS Group 1 Groups and Domains
		assert.Len(t, nsg1.Groups, 2, "NS Group 1 groups length mismatch")
		assert.Contains(t, nsg1.Groups, groupID1, "NS Group 1 should have group1")
		assert.Contains(t, nsg1.Groups, groupID2, "NS Group 1 should have group2")
		assert.Len(t, nsg1.Domains, 2, "NS Group 1 domains length mismatch")
		assert.Contains(t, nsg1.Domains, "example.com", "NS Group 1 should have example.com domain")
		assert.Contains(t, nsg1.Domains, "test.com", "NS Group 1 should have test.com domain")

		// Validate NS Group 2
		nsg2, exists := retrievedAccount.NameServerGroups[nsGroupID2]
		require.True(t, exists, "NS Group 2 should exist")
		assert.Equal(t, "NS Group 2", nsg2.Name, "NS Group 2 name mismatch")
		assert.False(t, nsg2.Enabled, "NS Group 2 should be disabled")
		assert.False(t, nsg2.Primary, "NS Group 2 should not be primary")
		assert.False(t, nsg2.SearchDomainsEnabled, "NS Group 2 search domains should be disabled")
		assert.Len(t, nsg2.NameServers, 1, "NS Group 2 should have 1 nameserver")
		assert.Len(t, nsg2.Groups, 0, "NS Group 2 should have empty groups")
		assert.Len(t, nsg2.Domains, 0, "NS Group 2 should have empty domains")
	})

	// ========== VALIDATE POSTURE CHECKS ==========
	t.Run("PostureChecks", func(t *testing.T) {
		require.Len(t, retrievedAccount.PostureChecks, 2, "Should have 2 posture checks")

		// Find posture checks by ID
		var pc1, pc2 *posture.Checks
		for _, pc := range retrievedAccount.PostureChecks {
			switch pc.ID {
			case postureCheckID1:
				pc1 = pc
			case postureCheckID2:
				pc2 = pc
			}
		}

		// Validate Posture Check 1
		require.NotNil(t, pc1, "Posture check 1 should exist")
		assert.Equal(t, "Posture Check 1", pc1.Name, "Posture check 1 name mismatch")
		assert.Equal(t, "OS version check", pc1.Description, "Posture check 1 description mismatch")

		// Validate NB Version Check
		require.NotNil(t, pc1.Checks.NBVersionCheck, "NB version check should not be nil")
		assert.Equal(t, "0.24.0", pc1.Checks.NBVersionCheck.MinVersion, "NB version check min version mismatch")

		// Validate OS Version Check
		require.NotNil(t, pc1.Checks.OSVersionCheck, "OS version check should not be nil")
		require.NotNil(t, pc1.Checks.OSVersionCheck.Ios, "iOS version check should not be nil")
		assert.Equal(t, "16.0", pc1.Checks.OSVersionCheck.Ios.MinVersion, "iOS min version mismatch")
		require.NotNil(t, pc1.Checks.OSVersionCheck.Darwin, "Darwin version check should not be nil")
		assert.Equal(t, "22.0.0", pc1.Checks.OSVersionCheck.Darwin.MinVersion, "Darwin min version mismatch")

		// Validate Posture Check 2
		require.NotNil(t, pc2, "Posture check 2 should exist")
		assert.Equal(t, "Posture Check 2", pc2.Name, "Posture check 2 name mismatch")

		// Validate Geo Location Check
		require.NotNil(t, pc2.Checks.GeoLocationCheck, "Geo location check should not be nil")
		assert.Equal(t, "allow", pc2.Checks.GeoLocationCheck.Action, "Geo location action mismatch")
		assert.Len(t, pc2.Checks.GeoLocationCheck.Locations, 2, "Geo location check should have 2 locations")
		assert.Equal(t, "US", pc2.Checks.GeoLocationCheck.Locations[0].CountryCode, "Location 1 country code mismatch")
		assert.Equal(t, "San Francisco", pc2.Checks.GeoLocationCheck.Locations[0].CityName, "Location 1 city name mismatch")
		assert.Equal(t, "GB", pc2.Checks.GeoLocationCheck.Locations[1].CountryCode, "Location 2 country code mismatch")
		assert.Equal(t, "London", pc2.Checks.GeoLocationCheck.Locations[1].CityName, "Location 2 city name mismatch")

		// Validate Peer Network Range Check
		require.NotNil(t, pc2.Checks.PeerNetworkRangeCheck, "Peer network range check should not be nil")
		assert.Equal(t, "allow", pc2.Checks.PeerNetworkRangeCheck.Action, "Peer network range action mismatch")
		assert.Len(t, pc2.Checks.PeerNetworkRangeCheck.Ranges, 2, "Peer network range check should have 2 ranges")
		assert.Contains(t, pc2.Checks.PeerNetworkRangeCheck.Ranges, netip.MustParsePrefix("192.168.0.0/16"), "Should have 192.168.0.0/16 range")
		assert.Contains(t, pc2.Checks.PeerNetworkRangeCheck.Ranges, netip.MustParsePrefix("10.0.0.0/8"), "Should have 10.0.0.0/8 range")
	})

	// ========== VALIDATE NETWORKS ==========
	t.Run("Networks", func(t *testing.T) {
		require.Len(t, retrievedAccount.Networks, 1, "Should have 1 network")

		net1 := retrievedAccount.Networks[0]
		assert.Equal(t, networkID1, net1.ID, "Network 1 ID mismatch")
		assert.Equal(t, "Network 1", net1.Name, "Network 1 name mismatch")
		assert.Equal(t, "Primary network", net1.Description, "Network 1 description mismatch")
	})

	// ========== VALIDATE NETWORK ROUTERS ==========
	t.Run("NetworkRouters", func(t *testing.T) {
		require.Len(t, retrievedAccount.NetworkRouters, 1, "Should have 1 network router")

		router := retrievedAccount.NetworkRouters[0]
		assert.Equal(t, routerID1, router.ID, "Router 1 ID mismatch")
		assert.Equal(t, networkID1, router.NetworkID, "Router 1 network ID mismatch")
		assert.Equal(t, peerID1, router.Peer, "Router 1 peer mismatch")
		assert.Empty(t, router.PeerGroups, "Router 1 peer groups should be empty")
		assert.True(t, router.Masquerade, "Router 1 masquerade should be enabled")
		assert.Equal(t, 100, router.Metric, "Router 1 metric mismatch")
	})

	// ========== VALIDATE NETWORK RESOURCES ==========
	t.Run("NetworkResources", func(t *testing.T) {
		require.Len(t, retrievedAccount.NetworkResources, 1, "Should have 1 network resource")

		res := retrievedAccount.NetworkResources[0]
		assert.Equal(t, resourceID1, res.ID, "Resource 1 ID mismatch")
		assert.Equal(t, networkID1, res.NetworkID, "Resource 1 network ID mismatch")
		assert.Equal(t, "Resource 1", res.Name, "Resource 1 name mismatch")
		assert.Equal(t, "Web server", res.Description, "Resource 1 description mismatch")
		assert.Equal(t, netip.MustParsePrefix("192.168.1.100/32"), res.Prefix, "Resource 1 prefix mismatch")
		assert.Equal(t, resourceTypes.Host, res.Type, "Resource 1 type mismatch")
	})

	// ========== VALIDATE ONBOARDING ==========
	t.Run("Onboarding", func(t *testing.T) {
		assert.Equal(t, accountID, retrievedAccount.Onboarding.AccountID, "Onboarding account ID mismatch")
		assert.True(t, retrievedAccount.Onboarding.OnboardingFlowPending, "Onboarding flow should be pending")
		assert.False(t, retrievedAccount.Onboarding.SignupFormPending, "Signup form should not be pending")
		assert.WithinDuration(t, now, retrievedAccount.Onboarding.CreatedAt, time.Second, "Onboarding created at mismatch")
	})

	t.Log("✅ All comprehensive account field validations passed!")
}
