package middleware

import (
	"crypto/sha256"
	"encoding/hex"
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	"github.com/gochat/gochat/internal/auth"
	"github.com/gochat/gochat/internal/config"
	"github.com/gochat/gochat/internal/model"
	"github.com/gochat/gochat/pkg/testutil"
	"gorm.io/gorm"
)

// newPlatformTestDB creates a test DB with PlatformApp, AccessToken, and Permissible tables.
func newPlatformTestDB(t *testing.T) *gorm.DB {
	t.Helper()
	return testutil.NewTestDBWithModels(t,
		&model.User{},
		&model.PlatformApp{},
		&model.AccessToken{},
		&model.Permissible{},
	)
}

func TestPlatformAppAuth_ValidToken(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	// Create a PlatformApp
	pa := model.PlatformApp{Name: "TestApp", Active: ptrBool(true)}
	require.NoError(t, db.Create(&pa).Error)

	// Create AccessToken for the PlatformApp
	rawToken := "test-platform-token-12345"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		appID, exists := c.Get("platform_app_id")
		assert.True(t, exists)
		assert.Equal(t, pa.ID, appID)
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 200, w.Code)
}

func TestPlatformAppAuth_MissingToken(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	router.ServeHTTP(w, req)

	assert.Equal(t, 401, w.Code)
}

func TestPlatformAppAuth_InvalidToken(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", "invalid-token")
	router.ServeHTTP(w, req)

	assert.Equal(t, 401, w.Code)
}

func TestPlatformAppAuth_InactiveOrDisabledAppRejected(t *testing.T) {
	for _, tc := range []struct {
		name   string
		active *bool
		status string
	}{
		{name: "inactive", active: ptrBool(false), status: "active"},
		{name: "disabled", active: ptrBool(true), status: "disabled"},
	} {
		t.Run(tc.name, func(t *testing.T) {
			db := newPlatformTestDB(t)
			pa := model.PlatformApp{Name: tc.name, Active: tc.active, Status: tc.status}
			require.NoError(t, db.Create(&pa).Error)

			rawToken := "inactive-platform-token"
			hash := sha256.Sum256([]byte(rawToken))
			require.NoError(t, db.Create(&model.AccessToken{
				OwnerType:   model.AccessTokenOwnerTypePlatformApp,
				OwnerID:     pa.ID,
				Token:       hex.EncodeToString(hash[:]),
				TokenPrefix: rawToken[:8],
			}).Error)

			router := gin.New()
			router.Use(PlatformAppAuth(db))
			router.GET("/test", func(c *gin.Context) { c.Status(http.StatusOK) })

			w := httptest.NewRecorder()
			req := httptest.NewRequest(http.MethodGet, "/test", nil)
			req.Header.Set("api_access_token", rawToken)
			router.ServeHTTP(w, req)

			assert.Equal(t, http.StatusUnauthorized, w.Code)
		})
	}
}

func TestPlatformAppAuth_ExpiredTokenRejected(t *testing.T) {
	db := newPlatformTestDB(t)
	pa := model.PlatformApp{Name: "ExpiredTokenApp", Active: ptrBool(true), Status: "active"}
	require.NoError(t, db.Create(&pa).Error)

	rawToken := "expired-platform-token"
	hash := sha256.Sum256([]byte(rawToken))
	expiresAt := time.Now().Add(-time.Minute)
	require.NoError(t, db.Create(&model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       hex.EncodeToString(hash[:]),
		TokenPrefix: rawToken[:8],
		ExpiresAt:   &expiresAt,
	}).Error)

	router := gin.New()
	router.Use(PlatformAppAuth(db))
	router.GET("/test", func(c *gin.Context) { c.Status(http.StatusOK) })

	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, http.StatusUnauthorized, w.Code)
}

func TestPlatformAppAuth_UserTokenRejected(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	// Create a User-type AccessToken (should be rejected by PlatformAuth)
	rawToken := "user-personal-token"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypeUser,
		OwnerID:     999,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 401, w.Code)
}

func TestPlatformAppAuth_HTTP_API_ACCESS_TOKEN_Header(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	pa := model.PlatformApp{Name: "TestApp2", Active: ptrBool(true)}
	require.NoError(t, db.Create(&pa).Error)

	rawToken := "test-http-header-token"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("HTTP_API_ACCESS_TOKEN", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 200, w.Code)
}

func TestPlatformAppAuth_ContextValues(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	pa := model.PlatformApp{Name: "ContextTestApp", Active: ptrBool(true)}
	require.NoError(t, db.Create(&pa).Error)

	rawToken := "context-test-token"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		// Verify all context values are set correctly
		platformApp, exists := c.Get("platform_app")
		assert.True(t, exists)
		app := platformApp.(model.PlatformApp)
		assert.Equal(t, pa.ID, app.ID)
		assert.Equal(t, pa.Name, app.Name)

		appID, exists := c.Get("platform_app_id")
		assert.True(t, exists)
		assert.Equal(t, pa.ID, appID)

		tokenID, exists := c.Get("access_token_id")
		assert.True(t, exists)
		assert.Equal(t, at.ID, tokenID)

		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 200, w.Code)
}

func TestPlatformAPIAuthSupportsSuperAdminAndPlatformApp(t *testing.T) {
	db := newPlatformTestDB(t)
	pa := model.PlatformApp{Name: "TestApp", Active: ptrBool(true)}
	require.NoError(t, db.Create(&pa).Error)

	rawToken := "platform-api-token"
	hash := sha256.Sum256([]byte(rawToken))
	require.NoError(t, db.Create(&model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       hex.EncodeToString(hash[:]),
		TokenPrefix: rawToken[:8],
	}).Error)

	jwtSvc := auth.NewJWTService(&config.JWTConfig{Secret: "platform-api-auth-test", ExpiryHours: 1})
	superAdmin := model.User{Provider: "email", Email: "admin@example.com", Role: "super_admin", Active: true}
	require.NoError(t, db.Create(&superAdmin).Error)
	agent := model.User{Provider: "email", Email: "agent@example.com", Active: true}
	require.NoError(t, db.Create(&agent).Error)
	superAdminToken, err := jwtSvc.GenerateTokenPair(&superAdmin, 1, "administrator")
	require.NoError(t, err)
	agentToken, err := jwtSvc.GenerateTokenPair(&agent, 1, "agent")
	require.NoError(t, err)

	router := gin.New()
	router.Use(PlatformAPIIdentityAuth(jwtSvc, db), PlatformAPIAuthorize())
	router.GET("/test", func(c *gin.Context) { c.Status(http.StatusOK) })

	for _, tc := range []struct {
		name, header, token string
		want                int
	}{
		{name: "platform app", header: "api_access_token", token: rawToken, want: http.StatusOK},
		{name: "super admin session", header: "access-token", token: superAdminToken.AccessToken, want: http.StatusOK},
		{name: "regular session", header: "access-token", token: agentToken.AccessToken, want: http.StatusForbidden},
		{name: "missing credentials", want: http.StatusUnauthorized},
	} {
		t.Run(tc.name, func(t *testing.T) {
			w := httptest.NewRecorder()
			req := httptest.NewRequest(http.MethodGet, "/test", nil)
			if tc.header != "" {
				req.Header.Set(tc.header, tc.token)
			}
			router.ServeHTTP(w, req)
			assert.Equal(t, tc.want, w.Code)
		})
	}
}

func ptrBool(b bool) *bool { return &b }