package integration_test

import (
	"context"
	"encoding/json"
	"fmt"
	"net/http"
	"testing"
	"time"

	"github.com/google/uuid"
	"golang.org/x/crypto/bcrypt"
)

func TestOpsCMSBannerWrite(t *testing.T) {
	r, pool := setupAPIPool(t)
	ctx := context.Background()
	tok := adminLogin(t, r, "admin", "change-me")
	devKey := fmt.Sprintf("banner-write-%d", time.Now().UnixNano())

	code := fmt.Sprintf("home_w_%d", time.Now().UnixNano()%1_000_000)
	body := map[string]any{
		"code": code, "title": "写面横幅", "placement": "home",
		"link_path": "/membership", "sort_order": 3, "active": true,
	}
	env, httpCode := doAdminJSON(t, r, http.MethodPost, "/api/v1/admin/cms/banners", body, tok)
	if httpCode != 200 || env.Code != 0 {
		t.Fatalf("create http=%d code=%d msg=%s", httpCode, env.Code, env.Message)
	}
	var created struct {
		ID   string `json:"id"`
		Code string `json:"code"`
	}
	_ = json.Unmarshal(env.Data, &created)
	if created.ID == "" || created.Code != code {
		t.Fatalf("bad create %#v", created)
	}
	t.Cleanup(func() {
		_, _ = pool.Exec(ctx, `DELETE FROM ops_banners WHERE id=$1`, created.ID)
	})

	_, httpCode = doAdminJSON(t, r, http.MethodPost, "/api/v1/admin/cms/banners", body, tok)
	if httpCode != http.StatusConflict {
		t.Fatalf("dup expected 409 got %d", httpCode)
	}

	_, httpCode = doAdminJSON(t, r, http.MethodPost, "/api/v1/admin/cms/banners", map[string]any{
		"code": code + "_x", "title": "外链", "placement": "home",
		"link_path": "https://evil.example", "active": true,
	}, tok)
	if httpCode != http.StatusBadRequest {
		t.Fatalf("ext link expected 400 got %d", httpCode)
	}

	env, _, httpCode = doJSONExpect(t, r, http.MethodGet, "/api/v1/home/banners?placement=home", nil, devKey, 0)
	if httpCode != 200 {
		t.Fatalf("home banners http=%d", httpCode)
	}
	var pub struct {
		Items []struct {
			Code string `json:"code"`
		} `json:"items"`
	}
	_ = json.Unmarshal(env.Data, &pub)
	found := false
	for _, it := range pub.Items {
		if it.Code == code {
			found = true
			break
		}
	}
	if !found {
		t.Fatalf("active banner missing in C-end: %#v", pub.Items)
	}

	body["active"] = false
	body["title"] = "已下架"
	env, httpCode = doAdminJSON(t, r, http.MethodPut, "/api/v1/admin/cms/banners/"+created.ID, body, tok)
	if httpCode != 200 || env.Code != 0 {
		t.Fatalf("update %d %s", httpCode, env.Message)
	}

	env, _, httpCode = doJSONExpect(t, r, http.MethodGet, "/api/v1/home/banners?placement=home", nil, devKey, 0)
	if httpCode != 200 {
		t.Fatalf("home after deactivate %d", httpCode)
	}
	_ = json.Unmarshal(env.Data, &pub)
	for _, it := range pub.Items {
		if it.Code == code {
			t.Fatalf("inactive still listed")
		}
	}

	var n int
	err := pool.QueryRow(ctx, `
		SELECT COUNT(*) FROM admin_audit_logs
		WHERE action IN ('cms.banner.create','cms.banner.update') AND target_id=$1`,
		created.ID).Scan(&n)
	if err != nil || n < 2 {
		t.Fatalf("expected ≥2 audit rows, got %d err=%v", n, err)
	}

	limitedRoleID := uuid.New()
	_, err = pool.Exec(ctx, `
		INSERT INTO admin_roles(id, name, system) VALUES ($1,$2,false)`,
		limitedRoleID, "cms_ro_"+limitedRoleID.String()[:8])
	if err != nil {
		t.Fatal(err)
	}
	_, err = pool.Exec(ctx, `
		INSERT INTO admin_role_permissions(role_id, code) VALUES ($1,'admin.cms.read')`, limitedRoleID)
	if err != nil {
		t.Fatal(err)
	}
	hash, err := bcrypt.GenerateFromPassword([]byte("ro-pass"), bcrypt.DefaultCost)
	if err != nil {
		t.Fatal(err)
	}
	roUser := fmt.Sprintf("cmsro_%d", time.Now().UnixNano())
	_, err = pool.Exec(ctx, `
		INSERT INTO admin_accounts(username, password_hash, role_id) VALUES ($1,$2,$3)`,
		roUser, string(hash), limitedRoleID)
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() {
		_, _ = pool.Exec(ctx, `DELETE FROM admin_accounts WHERE username=$1`, roUser)
		_, _ = pool.Exec(ctx, `DELETE FROM admin_roles WHERE id=$1`, limitedRoleID)
	})
	roTok := adminLogin(t, r, roUser, "ro-pass")
	_, httpCode = doAdminJSON(t, r, http.MethodPost, "/api/v1/admin/cms/banners", map[string]any{
		"code": "x_ro", "title": "no", "placement": "home", "active": true,
	}, roTok)
	if httpCode != http.StatusForbidden {
		t.Fatalf("read-only write expected 403 got %d", httpCode)
	}
}