package webhook

import (
	"bytes"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/gochat/gochat/internal/model"
	channelmodel "github.com/gochat/gochat/internal/model/channel"
	"gorm.io/driver/sqlite"
	"gorm.io/gorm"
)

func newWebhookLookupTestDB(t *testing.T) *gorm.DB {
	t.Helper()

	db, err := gorm.Open(sqlite.Open("file::memory:?cache=shared"), &gorm.Config{})
	if err != nil {
		t.Fatalf("open sqlite: %v", err)
	}
	if err := db.AutoMigrate(
		&model.Inbox{},
		&channelmodel.ChannelTelegram{},
		&channelmodel.ChannelLINE{},
		&channelmodel.ChannelTwilioSMS{},
		&channelmodel.ChannelTikTok{},
		&channelmodel.ChannelInstagram{},
		&model.IntegrationHook{},
	); err != nil {
		t.Fatalf("migrate webhook lookup models: %v", err)
	}
	return db
}

func shopifyHMAC(secret string, body []byte) string {
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write(body)
	return base64.StdEncoding.EncodeToString(mac.Sum(nil))
}

func metaSignature(secret string, body []byte) string {
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write(body)
	return "sha256=" + hex.EncodeToString(mac.Sum(nil))
}

func seedWebhookInbox(t *testing.T, db *gorm.DB, channelType string) model.Inbox {
	t.Helper()

	inbox := model.Inbox{
		AccountID:   1,
		Name:        channelType + " inbox",
		ChannelType: channelType,
		ChannelID:   1,
		Enabled:     true,
	}
	if err := db.Create(&inbox).Error; err != nil {
		t.Fatalf("create inbox: %v", err)
	}
	return inbox
}

func TestTelegramWebhookLookupInboxByBotToken(t *testing.T) {
	db := newWebhookLookupTestDB(t)
	inbox := seedWebhookInbox(t, db, "telegram")
	channel := channelmodel.ChannelTelegram{
		AccountID: 1,
		InboxID:   inbox.ID,
		BotToken:  "123:secret-token",
		BotName:   "support_bot",
	}
	if err := db.Create(&channel).Error; err != nil {
		t.Fatalf("create telegram channel: %v", err)
	}

	h := NewTelegramWebhookHandler(nil, nil, db)
	found, err := h.lookupInbox("123:secret-token")
	if err != nil {
		t.Fatalf("lookup inbox: %v", err)
	}
	if found.ID != inbox.ID || found.ChannelType != "telegram" {
		t.Fatalf("unexpected inbox: id=%d type=%s", found.ID, found.ChannelType)
	}
}

func TestLineWebhookLookupInboxByLineChannelID(t *testing.T) {
	db := newWebhookLookupTestDB(t)
	inbox := seedWebhookInbox(t, db, "line")
	channel := channelmodel.ChannelLINE{
		AccountID: 1,
		InboxID:   inbox.ID,
		ChannelID: "line-channel-1",
		Name:      "LINE OA",
	}
	if err := db.Create(&channel).Error; err != nil {
		t.Fatalf("create line channel: %v", err)
	}

	h := NewLineWebhookHandler(nil, nil, nil, db)
	found, err := h.lookupInboxByLineChannelID("line-channel-1")
	if err != nil {
		t.Fatalf("lookup inbox: %v", err)
	}
	if found.ID != inbox.ID || found.ChannelType != "line" {
		t.Fatalf("unexpected inbox: id=%d type=%s", found.ID, found.ChannelType)
	}
}

func TestTwilioWebhookLookupInboxByPhoneNumber(t *testing.T) {
	db := newWebhookLookupTestDB(t)
	inbox := seedWebhookInbox(t, db, "twilio_sms")
	channel := channelmodel.ChannelTwilioSMS{
		AccountID:           1,
		InboxID:             inbox.ID,
		AccountSID:          "AC123",
		PhoneNumber:         "+15551234567",
		MessagingServiceSID: "MG123",
	}
	if err := db.Create(&channel).Error; err != nil {
		t.Fatalf("create twilio channel: %v", err)
	}

	h := NewTwilioWebhookHandler(nil, db)
	found, err := h.lookupInboxByPhoneNumber("+15551234567")
	if err != nil {
		t.Fatalf("lookup inbox: %v", err)
	}
	if found.ID != inbox.ID || found.ChannelType != "twilio_sms" {
		t.Fatalf("unexpected inbox: id=%d type=%s", found.ID, found.ChannelType)
	}
}

func TestTikTokWebhookLookupInboxByBusinessIDAndPayloadExtractor(t *testing.T) {
	db := newWebhookLookupTestDB(t)
	inbox := seedWebhookInbox(t, db, "tiktok")
	channel := channelmodel.ChannelTikTok{
		AccountID:          1,
		InboxID:            inbox.ID,
		TikTokBusinessID:   "biz-123",
		WebhookVerifyToken: "verify-token",
	}
	if err := db.Create(&channel).Error; err != nil {
		t.Fatalf("create tiktok channel: %v", err)
	}

	h := NewTikTokWebhookHandler(nil, nil, db)
	found, err := h.lookupInboxByBusinessID("biz-123")
	if err != nil {
		t.Fatalf("lookup inbox: %v", err)
	}
	if found.ID != inbox.ID || found.ChannelType != "tiktok" {
		t.Fatalf("unexpected inbox: id=%d type=%s", found.ID, found.ChannelType)
	}

	if got := extractTikTokBusinessID([]byte(`{"data":{"business_id":"biz-123"}}`)); got != "biz-123" {
		t.Fatalf("unexpected extracted business id: %s", got)
	}
}

func TestShopifyWebhookShopRedactDeletesMatchingHook(t *testing.T) {
	gin.SetMode(gin.TestMode)
	db := newWebhookLookupTestDB(t)
	settings, _ := json.Marshal(model.ShopifySettings{ShopDomain: "store.myshopify.com"})
	hook := model.IntegrationHook{
		AccountID:   1,
		HookType:    model.HookTypeShopify,
		Status:      model.HookStatusActive,
		AccessToken: "access-token",
		Settings:    settings,
	}
	if err := db.Create(&hook).Error; err != nil {
		t.Fatalf("create shopify hook: %v", err)
	}

	body := []byte(`{"shop_domain":"store.myshopify.com"}`)
	h := NewShopifyWebhookHandler(db, "client-secret")
	r := gin.New()
	r.POST("/webhooks/shopify", h.HandleShopifyWebhook)
	req := httptest.NewRequest(http.MethodPost, "/webhooks/shopify", bytes.NewReader(body))
	req.Header.Set("X-Shopify-Hmac-SHA256", shopifyHMAC("client-secret", body))
	req.Header.Set("X-Shopify-Topic", "shop/redact")
	w := httptest.NewRecorder()

	r.ServeHTTP(w, req)

	if w.Code != http.StatusOK {
		t.Fatalf("expected 200, got %d", w.Code)
	}
	var count int64
	if err := db.Model(&model.IntegrationHook{}).Where("id = ?", hook.ID).Count(&count).Error; err != nil {
		t.Fatalf("count hook: %v", err)
	}
	if count != 0 {
		t.Fatalf("expected shopify hook to be deleted, count=%d", count)
	}
}

func TestShopifyWebhookRejectsInvalidHMAC(t *testing.T) {
	gin.SetMode(gin.TestMode)
	db := newWebhookLookupTestDB(t)
	h := NewShopifyWebhookHandler(db, "client-secret")
	r := gin.New()
	r.POST("/webhooks/shopify", h.HandleShopifyWebhook)
	req := httptest.NewRequest(http.MethodPost, "/webhooks/shopify", bytes.NewReader([]byte(`{}`)))
	req.Header.Set("X-Shopify-Hmac-SHA256", "invalid")
	w := httptest.NewRecorder()

	r.ServeHTTP(w, req)

	if w.Code != http.StatusUnauthorized {
		t.Fatalf("expected 401, got %d", w.Code)
	}
}

func TestInstagramWebhookVerificationUsesChatwootGlobalTokens(t *testing.T) {
	gin.SetMode(gin.TestMode)
	t.Setenv("INSTAGRAM_VERIFY_TOKEN", "verify-me")
	h := NewFacebookWebhookHandler(nil, nil, nil)
	r := gin.New()
	r.GET("/webhooks/instagram", h.HandleInstagramVerification)
	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/webhooks/instagram?hub.verify_token=verify-me&hub.challenge=challenge-1", nil)

	r.ServeHTTP(w, req)

	if w.Code != http.StatusOK {
		t.Fatalf("expected 200, got %d", w.Code)
	}
	if w.Body.String() != "challenge-1" {
		t.Fatalf("unexpected challenge body: %q", w.Body.String())
	}
}

func TestInstagramWebhookEventsVerifySignatureAndResolveInbox(t *testing.T) {
	gin.SetMode(gin.TestMode)
	db := newWebhookLookupTestDB(t)
	inbox := seedWebhookInbox(t, db, "instagram")
	channel := channelmodel.ChannelInstagram{
		AccountID:                  1,
		InboxID:                    inbox.ID,
		InstagramAccountID:         "ig-123",
		InstagramBusinessAccountID: "ig-business-123",
		PageAccessToken:            "page-token",
		ConnectedFBPageID:          "page-123",
		InstagramAccountName:       "gochat",
	}
	if err := db.Create(&channel).Error; err != nil {
		t.Fatalf("create instagram channel: %v", err)
	}
	t.Setenv("INSTAGRAM_APP_SECRET", "ig-secret")

	body := []byte(`{"object":"instagram","entry":[{"id":"ig-123","time":1,"messaging":[{"sender":{"id":"user-1"},"recipient":{"id":"ig-123"},"timestamp":1,"message":{"mid":"mid-1","text":"hello"}}]}]}`)
	h := NewFacebookWebhookHandler(nil, nil, db)
	r := gin.New()
	r.POST("/webhooks/instagram", h.HandleInstagramWebhook)
	req := httptest.NewRequest(http.MethodPost, "/webhooks/instagram", bytes.NewReader(body))
	req.Header.Set("X-Hub-Signature-256", metaSignature("ig-secret", body))
	w := httptest.NewRecorder()

	r.ServeHTTP(w, req)

	if w.Code != http.StatusOK {
		t.Fatalf("expected 200, got %d body=%s", w.Code, w.Body.String())
	}
}