package integration_test

import (
	"context"
	"encoding/json"
	"fmt"
	"net/http"
	"testing"
	"time"

	"github.com/google/uuid"
	"golang.org/x/crypto/bcrypt"
)

func TestAskOperations(t *testing.T) {
	r, pool := setupAPIPool(t)
	ctx := context.Background()
	tok := adminLogin(t, r, "admin", "change-me")

	_, code := doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads", nil, "")
	if code != http.StatusUnauthorized {
		t.Fatalf("expected 401, got %d", code)
	}

	limitedRoleID := uuid.New()
	_, err := pool.Exec(ctx, `
		INSERT INTO admin_roles(id, name, system) VALUES ($1, $2, false)`,
		limitedRoleID, "ask_lim_"+limitedRoleID.String()[:8])
	if err != nil {
		t.Fatalf("insert role: %v", err)
	}
	_, err = pool.Exec(ctx, `
		INSERT INTO admin_role_permissions(role_id, code) VALUES ($1,'admin.users.read')`, limitedRoleID)
	if err != nil {
		t.Fatal(err)
	}
	hash, err := bcrypt.GenerateFromPassword([]byte("limited-pass"), bcrypt.DefaultCost)
	if err != nil {
		t.Fatal(err)
	}
	limitedUser := fmt.Sprintf("asklim_%d", time.Now().UnixNano())
	_, err = pool.Exec(ctx, `
		INSERT INTO admin_accounts(username, password_hash, role_id)
		VALUES ($1,$2,$3)`, limitedUser, string(hash), limitedRoleID)
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() {
		_, _ = pool.Exec(ctx, `DELETE FROM admin_accounts WHERE username=$1`, limitedUser)
		_, _ = pool.Exec(ctx, `DELETE FROM admin_roles WHERE id=$1`, limitedRoleID)
	})

	limTok := adminLogin(t, r, limitedUser, "limited-pass")
	_, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads", nil, limTok)
	if code != http.StatusForbidden {
		t.Fatalf("expected 403 without ask.read, got %d", code)
	}

	key := mustRegister(t, r)
	env, key := doJSON(t, r, http.MethodPost, "/api/v1/profiles", map[string]any{
		"relation": "self", "birth_date": "1992-06-01", "display_name": "问",
	}, key)
	profileID := decodeData[map[string]any](t, env.Data)["id"].(string)

	env, key = doJSON(t, r, http.MethodPost, "/api/v1/ask/threads", map[string]any{
		"profile_id": profileID, "scene": "self",
	}, key)
	threadID := decodeData[map[string]any](t, env.Data)["id"].(string)

	_, key = doJSON(t, r, http.MethodPost, "/api/v1/ask/threads/"+threadID+"/messages", map[string]any{
		"content": "运营可读吗",
	}, key)

	start := time.Now()
	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads", nil, tok)
	if code != 200 || env.Code != 0 {
		t.Fatalf("list http=%d code=%d msg=%s", code, env.Code, env.Message)
	}
	if time.Since(start) > 500*time.Millisecond {
		t.Fatalf("list too slow: %v", time.Since(start))
	}
	var list struct {
		Items []struct {
			ID           string `json:"id"`
			MessageCount int    `json:"message_count"`
		} `json:"items"`
	}
	_ = json.Unmarshal(env.Data, &list)
	found := false
	for _, it := range list.Items {
		if it.ID == threadID && it.MessageCount >= 1 {
			found = true
			break
		}
	}
	if !found {
		t.Fatalf("expected thread %s in list: %#v", threadID, list.Items)
	}

	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads/"+threadID, nil, tok)
	if code != 200 {
		t.Fatalf("meta http=%d msg=%s", code, env.Message)
	}
	var meta map[string]any
	_ = json.Unmarshal(env.Data, &meta)
	if _, has := meta["messages"]; has {
		t.Fatalf("meta must not include messages: %#v", meta)
	}
	if meta["id"] != threadID {
		t.Fatalf("meta id mismatch: %#v", meta)
	}

	metaOnlyRole := uuid.New()
	_, err = pool.Exec(ctx, `INSERT INTO admin_roles(id, name, system) VALUES ($1,$2,false)`,
		metaOnlyRole, "ask_meta_"+metaOnlyRole.String()[:8])
	if err != nil {
		t.Fatal(err)
	}
	_, err = pool.Exec(ctx, `INSERT INTO admin_role_permissions(role_id, code) VALUES ($1,'admin.ask.read')`, metaOnlyRole)
	if err != nil {
		t.Fatal(err)
	}
	metaUser := fmt.Sprintf("askmeta_%d", time.Now().UnixNano())
	hash2, _ := bcrypt.GenerateFromPassword([]byte("meta-pass"), bcrypt.DefaultCost)
	_, err = pool.Exec(ctx, `INSERT INTO admin_accounts(username, password_hash, role_id) VALUES ($1,$2,$3)`,
		metaUser, string(hash2), metaOnlyRole)
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() {
		_, _ = pool.Exec(ctx, `DELETE FROM admin_accounts WHERE username=$1`, metaUser)
		_, _ = pool.Exec(ctx, `DELETE FROM admin_roles WHERE id=$1`, metaOnlyRole)
	})
	metaTok := adminLogin(t, r, metaUser, "meta-pass")
	_, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads/"+threadID+"/messages", nil, metaTok)
	if code != http.StatusForbidden {
		t.Fatalf("expected 403 without transcript.read, got %d", code)
	}

	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads/"+threadID+"/messages", nil, tok)
	if code != 200 {
		t.Fatalf("transcript http=%d msg=%s", code, env.Message)
	}
	var detail struct {
		Messages []struct {
			Role    string `json:"role"`
			Content string `json:"content"`
		} `json:"messages"`
	}
	_ = json.Unmarshal(env.Data, &detail)
	if len(detail.Messages) < 2 {
		t.Fatalf("expected user+assistant, got %#v", detail.Messages)
	}

	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/audit-logs", nil, tok)
	if code != 200 {
		t.Fatalf("audit %d", code)
	}
	var audit struct {
		Items []struct {
			Action string `json:"action"`
		} `json:"items"`
	}
	_ = json.Unmarshal(env.Data, &audit)
	audited := false
	for _, it := range audit.Items {
		if it.Action == "ask.transcript.read" {
			audited = true
			break
		}
	}
	if !audited {
		t.Fatalf("missing ask.transcript.read audit: %#v", audit.Items)
	}
	_ = key
}