package service

import (
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"gorm.io/driver/sqlite"
	"gorm.io/gorm"
	"gorm.io/gorm/logger"

	"github.com/gochat/gochat/internal/auth"
	"github.com/gochat/gochat/internal/model"
)

func setupRBACCustomRoleTest(t *testing.T) (*RBACService, *gorm.DB) {
	t.Helper()
	db, err := gorm.Open(sqlite.Open("file::memory:"), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
	require.NoError(t, err)
	require.NoError(t, db.AutoMigrate(&model.Account{}, &model.User{}, &model.AccountUser{}, &model.CustomRole{}))
	t.Cleanup(func() {
		sqlDB, _ := db.DB()
		sqlDB.Close()
	})
	return NewRBACService(db), db
}

func TestRBACService_CustomRoleUsesAgentRoleAndCustomRoleID(t *testing.T) {
	svc, db := setupRBACCustomRoleTest(t)
	account := &model.Account{Name: "RBAC Custom Role", Active: true}
	require.NoError(t, db.Create(account).Error)
	user := &model.User{AccountID: account.ID, Name: "Custom Agent", Email: "custom-agent@example.com", Password: "pw", Active: true}
	require.NoError(t, db.Create(user).Error)
	role := &model.CustomRole{AccountID: account.ID, Name: "Reporter"}
	require.NoError(t, role.SetPermissionKeys([]model.PermissionDimension{model.DimensionReportManage}))
	require.NoError(t, db.Create(role).Error)

	au, err := svc.AddAccountUser(user.ID, account.ID, "custom_role", role.ID, 0)
	require.NoError(t, err)
	assert.Equal(t, "agent", au.Role)
	assert.Equal(t, role.ID, au.CustomRoleID)

	pc, err := svc.BuildPolicyContext(user.ID, account.ID)
	require.NoError(t, err)
	assert.True(t, pc.IsCustomRole())
	assert.True(t, pc.Can("read", "report"))
	assert.True(t, pc.Can("manage", "report"))
	assert.False(t, pc.Can("manage", "contact"))
}

func TestRBACService_UpdateAccountUserRoleStoresAgentForCustomRole(t *testing.T) {
	svc, db := setupRBACCustomRoleTest(t)
	account := &model.Account{Name: "RBAC Update Role", Active: true}
	require.NoError(t, db.Create(account).Error)
	user := &model.User{AccountID: account.ID, Name: "Update Agent", Email: "update-agent@example.com", Password: "pw", Active: true}
	require.NoError(t, db.Create(user).Error)
	role := &model.CustomRole{AccountID: account.ID, Name: "Contact Manager"}
	require.NoError(t, role.SetPermissionKeys([]model.PermissionDimension{model.DimensionContactManage}))
	require.NoError(t, db.Create(role).Error)
	require.NoError(t, db.Create(&model.AccountUser{AccountID: account.ID, UserID: user.ID, Role: "agent"}).Error)

	au, err := svc.UpdateAccountUserRole(user.ID, account.ID, "custom_role", role.ID)
	require.NoError(t, err)
	assert.Equal(t, "agent", au.Role)
	assert.Equal(t, role.ID, au.CustomRoleID)
}

func TestRBACService_CustomRoleConversationPermissionKeys(t *testing.T) {
	pc := auth.NewPolicyContext(1, 1, "custom_role", 7, auth.PermissionMatrixMap{
		auth.DimensionConversationUnassignedManage: auth.PermissionFull,
	})
	assert.True(t, pc.Can("read", "conversation"))
	assert.True(t, pc.Can("manage", "conversation"))
	assert.True(t, pc.Can("create", "message"))
	assert.False(t, pc.Can("delete", "conversation"))
}