package middleware

import (
	"crypto/sha256"
	"encoding/hex"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	"github.com/gochat/gochat/internal/model"
	"github.com/gochat/gochat/pkg/testutil"
	"gorm.io/gorm"
)

// newPlatformTestDB creates a test DB with PlatformApp, AccessToken, and Permissible tables.
func newPlatformTestDB(t *testing.T) *gorm.DB {
	t.Helper()
	return testutil.NewTestDBWithModels(t,
		&model.PlatformApp{},
		&model.AccessToken{},
		&model.Permissible{},
	)
}

func TestPlatformAppAuth_ValidToken(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	// Create a PlatformApp
	pa := model.PlatformApp{Name: "TestApp", Active: ptrBool(true)}
	require.NoError(t, db.Create(&pa).Error)

	// Create AccessToken for the PlatformApp
	rawToken := "test-platform-token-12345"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		appID, exists := c.Get("platform_app_id")
		assert.True(t, exists)
		assert.Equal(t, pa.ID, appID)
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 200, w.Code)
}

func TestPlatformAppAuth_MissingToken(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	router.ServeHTTP(w, req)

	assert.Equal(t, 401, w.Code)
}

func TestPlatformAppAuth_InvalidToken(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", "invalid-token")
	router.ServeHTTP(w, req)

	assert.Equal(t, 401, w.Code)
}

func TestPlatformAppAuth_UserTokenRejected(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	// Create a User-type AccessToken (should be rejected by PlatformAuth)
	rawToken := "user-personal-token"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypeUser,
		OwnerID:     999,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 401, w.Code)
}

func TestPlatformAppAuth_HTTP_API_ACCESS_TOKEN_Header(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	pa := model.PlatformApp{Name: "TestApp2", Active: ptrBool(true)}
	require.NoError(t, db.Create(&pa).Error)

	rawToken := "test-http-header-token"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("HTTP_API_ACCESS_TOKEN", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 200, w.Code)
}

func TestPlatformAppAuth_ContextValues(t *testing.T) {
	db := newPlatformTestDB(t)
	router := gin.New()
	router.Use(PlatformAppAuth(db))

	pa := model.PlatformApp{Name: "ContextTestApp", Active: ptrBool(true)}
	require.NoError(t, db.Create(&pa).Error)

	rawToken := "context-test-token"
	hash := sha256.Sum256([]byte(rawToken))
	tokenHash := hex.EncodeToString(hash[:])

	at := model.AccessToken{
		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
		OwnerID:     pa.ID,
		Token:       tokenHash,
		TokenPrefix: rawToken[:8],
	}
	require.NoError(t, db.Create(&at).Error)

	router.GET("/test", func(c *gin.Context) {
		// Verify all context values are set correctly
		platformApp, exists := c.Get("platform_app")
		assert.True(t, exists)
		app := platformApp.(model.PlatformApp)
		assert.Equal(t, pa.ID, app.ID)
		assert.Equal(t, pa.Name, app.Name)

		appID, exists := c.Get("platform_app_id")
		assert.True(t, exists)
		assert.Equal(t, pa.ID, appID)

		tokenID, exists := c.Get("access_token_id")
		assert.True(t, exists)
		assert.Equal(t, at.ID, tokenID)

		c.JSON(200, gin.H{"ok": true})
	})

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/test", nil)
	req.Header.Set("api_access_token", rawToken)
	router.ServeHTTP(w, req)

	assert.Equal(t, 200, w.Code)
}

func ptrBool(b bool) *bool { return &b }