package httpapi

import (
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"knowledge-governance/internal/governance"
)

// 生产闸口与整库状态契约的针对性测试：不做数据库集成，只验证
// "证据不齐就不建作业" 与 "三类版本不互相顶替" 这两条硬规则。

// 复用既有 fakeJobStore 提供 Store 的其余方法，只覆盖整库作业这几个。
type fakeLibraryStore struct {
	fakeJobStore
	grant     *governance.LibraryReleaseAuthorization
	versions  []governance.LibraryVersion
	jobs      []governance.LibraryJob
	createN   int
	lastJob   governance.LibraryJob
	lastState governance.LibraryJobState
}

func (f *fakeLibraryStore) CreateLibraryJob(_ context.Context, job governance.LibraryJob, _ []string, _ time.Time) (governance.LibraryJob, bool, error) {
	f.createN++
	f.lastJob = job
	return job, false, nil
}

func (f *fakeLibraryStore) LibraryJob(_ context.Context, id string) (governance.LibraryJob, error) {
	return governance.LibraryJob{ID: id}, nil
}

func (f *fakeLibraryStore) ListLibraryJobs(_ context.Context, scope string, _ int) ([]governance.LibraryJob, error) {
	result := make([]governance.LibraryJob, 0, len(f.jobs))
	for _, job := range f.jobs {
		if job.Scope == scope {
			result = append(result, job)
		}
	}
	return result, nil
}

func (f *fakeLibraryStore) RecordLibraryVersion(_ context.Context, version governance.LibraryVersion) error {
	f.versions = append(f.versions, version)
	return nil
}

func (f *fakeLibraryStore) LibraryVersions(_ context.Context, scope string, _ int) ([]governance.LibraryVersion, error) {
	result := make([]governance.LibraryVersion, 0, len(f.versions))
	for _, version := range f.versions {
		if version.Scope == scope {
			result = append(result, version)
		}
	}
	return result, nil
}

func (f *fakeLibraryStore) UpdateLibraryStage(_ context.Context, _, _, _ string, _, _, _, _ *int64, _ string, _ time.Time) error {
	return nil
}

func (f *fakeLibraryStore) AdvanceLibraryJob(_ context.Context, _ string, state governance.LibraryJobState, _, _, _, _, _ string, _ time.Time) error {
	f.lastState = state
	return nil
}

func (f *fakeLibraryStore) CreateLibraryAuthorization(_ context.Context, item governance.LibraryReleaseAuthorization) error {
	f.grant = &item
	return nil
}

func (f *fakeLibraryStore) ActiveLibraryAuthorization(_ context.Context, scope, snapshotID, digest string, now time.Time) (governance.LibraryReleaseAuthorization, bool, error) {
	if f.grant == nil || f.grant.Scope != scope || f.grant.SnapshotID != snapshotID || f.grant.ParamsDigest != digest {
		return governance.LibraryReleaseAuthorization{}, false, nil
	}
	if !f.grant.ValidAt(now) {
		return governance.LibraryReleaseAuthorization{}, false, nil
	}
	return *f.grant, true, nil
}

func (f *fakeLibraryStore) LibraryAuthorizations(context.Context, string, int) ([]governance.LibraryReleaseAuthorization, error) {
	if f.grant == nil {
		return nil, nil
	}
	return []governance.LibraryReleaseAuthorization{*f.grant}, nil
}

func (f *fakeLibraryStore) RevokeLibraryAuthorization(context.Context, string, time.Time) error {
	return nil
}

func (f *fakeLibraryStore) AttachLibraryQueueJob(_ context.Context, _, _ string, _ time.Time) error {
	return nil
}

func (f *fakeLibraryStore) CancelLibraryJob(_ context.Context, _, _ string, _ time.Time) error {
	f.lastState = governance.LibraryJobCancelled
	return nil
}

func TestLibrarySyncGateRequiresEveryPieceOfEvidence(t *testing.T) {
	known := libraryKnownView{State: "known", Version: &libraryVersionView{ID: "v1"}}
	cases := []struct {
		name       string
		config     Config
		production libraryKnownView
		prebackup  libraryKnownView
		target     string
		allowed    bool
		reason     string
	}{
		{
			name:       "default installation is closed",
			config:     Config{},
			production: libraryKnownView{State: "unknown"},
			prebackup:  libraryKnownView{State: "unknown"},
			target:     "snap-1",
			allowed:    false,
			reason:     "生产写入闸口关闭",
		},
		{
			name: "flags on but restore evidence missing",
			config: Config{ProductionReleaseRequestsEnabled: true,
				LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int"},
			production: known,
			prebackup:  known,
			target:     "snap-1",
			allowed:    false,
			reason:     "没有已核验的生产恢复演练证据",
		},
		{
			name: "capacity budget missing blocks even when everything else is present",
			config: Config{ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
				LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int"},
			production: known,
			prebackup:  known,
			target:     "snap-1",
			allowed:    false,
			reason:     "容量预算未设置",
		},
		{
			name: "everything present",
			config: Config{ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
				LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int", LibraryCapacityBudgetBytes: 1 << 40},
			production: known,
			prebackup:  known,
			target:     "snap-1",
			allowed:    true,
		},
	}
	for _, testCase := range cases {
		t.Run(testCase.name, func(t *testing.T) {
			gate := librarySyncGateWithGrant(testCase.config, testCase.production, testCase.prebackup, testCase.target, true)
			if gate.SyncAllowed != testCase.allowed {
				t.Fatalf("sync_allowed = %v, want %v (%v)", gate.SyncAllowed, testCase.allowed, gate.Reasons)
			}
			if testCase.reason != "" {
				joined := strings.Join(gate.Reasons, "|")
				if !strings.Contains(joined, testCase.reason) {
					t.Fatalf("reasons %v missing %q", gate.Reasons, testCase.reason)
				}
			}
		})
	}
}

// 闸口关闭时 POST /api/v1/library/syncs 必须直接拒绝，并且**不创建**作业：
// 不能留下一个永远失败的空作业，也不能让按钮看起来接通了。
func TestLibrarySyncEnqueueRefusesWithoutCreatingJob(t *testing.T) {
	store := &fakeLibraryStore{}
	config := Config{Store: store}
	request := httptest.NewRequest(http.MethodPost, "/api/v1/library/syncs",
		strings.NewReader(`{"scope":"internal","target_snapshot_id":"snap-1"}`))
	recorder := httptest.NewRecorder()
	librarySyncEnqueue(recorder, request, config)
	if recorder.Code != http.StatusServiceUnavailable {
		t.Fatalf("status = %d, want 503", recorder.Code)
	}
	if store.createN != 0 {
		t.Fatalf("created %d jobs while gate is closed", store.createN)
	}
	var body struct {
		Code    string   `json:"code"`
		Reasons []string `json:"reasons"`
	}
	if err := json.Unmarshal(recorder.Body.Bytes(), &body); err != nil {
		t.Fatalf("decode body: %v", err)
	}
	if body.Code != "library_sync_blocked" || len(body.Reasons) == 0 {
		t.Fatalf("unexpected refusal body: %s", recorder.Body.String())
	}
}

// 预备份是作业内第一步生成的，不能拿"启动前还没有预备份"当门禁：
// 否则预备份只能由作业生成、作业又要求预备份，永远启动不了。
// 但"上一次预备份失败"必须阻断重试。
func TestLibrarySyncEnqueueDoesNotRequirePrebackupBeforeStart(t *testing.T) {
	store := &fakeLibraryStore{}
	config := Config{Store: store, ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
		LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int",
		LibraryCapacityBudgetBytes: 1 << 40}
	gate := librarySyncGateWithGrant(config, libraryKnownView{State: "known"}, libraryKnownView{State: "unknown"}, "snap-1", true)
	if !gate.SyncAllowed {
		t.Fatalf("missing prebackup must not block the start: %v", gate.Reasons)
	}
	failed := librarySyncGateWithGrant(config, libraryKnownView{State: "known"},
		libraryKnownView{State: "failed"}, "snap-1", true)
	if failed.SyncAllowed || !strings.Contains(strings.Join(failed.Reasons, "|"), "预备份失败") {
		t.Fatalf("failed prebackup must block: %v", failed.Reasons)
	}
}

// 首次发布：生产没有生效版本，但目标为空 = 合法空基线。
func TestLibrarySyncGateAllowsFirstPublishOnEmptyBaseline(t *testing.T) {
	config := Config{ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
		LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int",
		LibraryCapacityBudgetBytes: 1 << 40}
	empty := libraryKnownView{State: "unknown", EmptyBaseline: true}
	if gate := librarySyncGateWithGrant(config, empty, libraryKnownView{State: "unknown"}, "snap-1", true); !gate.SyncAllowed {
		t.Fatalf("empty production must be a legal first-publish baseline: %v", gate.Reasons)
	}
	// 非空但没有权威版本：仍然阻断。
	if gate := librarySyncGateWithGrant(config, libraryKnownView{State: "unknown"}, libraryKnownView{State: "unknown"}, "snap-1", true); gate.SyncAllowed {
		t.Fatal("unknown non-empty production must block")
	}
}

// 上一次预备份失败时必须阻断重试（预备份本身是作业内生成的，不能当启动前门禁）。
func TestLibrarySyncEnqueueRequiresPrebackupForTarget(t *testing.T) {
	store := &fakeLibraryStore{versions: []governance.LibraryVersion{{
		ID: "ver-prod-1", Scope: "internal", Kind: governance.LibraryVersionProductionEffective,
		SnapshotID: "prod-snap", VersionLabel: "prod-2026.10", CreatedAt: time.Now().UTC(),
	}, {
		ID: "ver-backup-1", Scope: "internal", Kind: governance.LibraryVersionProductionPrebackup,
		SnapshotID: "snap-1", CreatedAt: time.Now().UTC(),
	}}}
	config := Config{Store: store, ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
		LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int",
		LibraryCapacityBudgetBytes: 1 << 40}
	request := httptest.NewRequest(http.MethodPost, "/api/v1/library/syncs",
		strings.NewReader(`{"scope":"internal","target_snapshot_id":"snap-1"}`))
	recorder := httptest.NewRecorder()
	librarySyncEnqueue(recorder, request, config)
	// 没有授权仍然 503，但原因里不能再出现"还没有生产预备份"这种死循环门禁。
	if recorder.Code != http.StatusServiceUnavailable {
		t.Fatalf("status = %d, want 503", recorder.Code)
	}
	if strings.Contains(recorder.Body.String(), "还没有生产预备份") {
		t.Fatalf("start gate must not require a prebackup that only the job can create: %s", recorder.Body.String())
	}
}

// 证据齐全 + 有效授权时才会真正建作业并入队；缺授权一律拒绝且不建作业。
func TestLibrarySyncEnqueueCreatesJobOnlyWithGrant(t *testing.T) {
	target := "snap-1"
	digest, err := librarySyncParamsDigest("internal", target)
	if err != nil {
		t.Fatal(err)
	}
	store := &fakeLibraryStore{versions: []governance.LibraryVersion{
		{ID: "ver-prod", Scope: "internal", Kind: governance.LibraryVersionProductionEffective,
			SnapshotID: "prod-snap", VersionLabel: "prod-2026.10", CreatedAt: time.Now().UTC()},
		{ID: "ver-backup", Scope: "internal", Kind: governance.LibraryVersionProductionPrebackup,
			SnapshotID: target, CreatedAt: time.Now().UTC()},
	}}
	store.enqueueEchoRequestedID = true
	config := Config{Store: store, ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
		LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int", LibraryCapacityBudgetBytes: 1 << 40}
	body := `{"scope":"internal","target_snapshot_id":"` + target + `"}`

	// 先没有授权
	recorder := httptest.NewRecorder()
	librarySyncEnqueue(recorder, httptest.NewRequest(http.MethodPost, "/api/v1/library/syncs", strings.NewReader(body)), config)
	if recorder.Code != http.StatusServiceUnavailable {
		t.Fatalf("without grant status=%d body=%s", recorder.Code, recorder.Body.String())
	}
	if store.createN != 0 {
		t.Fatal("must not create a job without a grant")
	}

	// 补上绑定同一目标与快照的授权
	now := time.Now().UTC()
	store.grant = &governance.LibraryReleaseAuthorization{ID: "auth-1", Scope: "internal", SnapshotID: target,
		ParamsDigest: digest, AuthorizedBy: "admin", ExpiresAt: now.Add(30 * time.Minute), CreatedAt: now}
	recorder = httptest.NewRecorder()
	librarySyncEnqueue(recorder, httptest.NewRequest(http.MethodPost, "/api/v1/library/syncs", strings.NewReader(body)), config)
	if recorder.Code != http.StatusAccepted {
		t.Fatalf("with grant status=%d body=%s", recorder.Code, recorder.Body.String())
	}
	if store.createN != 1 {
		t.Fatalf("created=%d, want 1", store.createN)
	}
	if store.enqueued.Type != "library.sync" {
		t.Fatalf("enqueued type=%q, want library.sync", store.enqueued.Type)
	}
	if !strings.Contains(string(store.enqueued.Payload), store.lastJob.ID) {
		t.Fatalf("queue payload must carry the library job id: %s", store.enqueued.Payload)
	}
}

// 三类版本必须分开读：production_effective 才是生产当前，测试封存不能顶替。
func TestLibraryOverviewKeepsVersionKindsSeparate(t *testing.T) {
	now := time.Now().UTC()
	store := &fakeLibraryStore{versions: []governance.LibraryVersion{
		{ID: "ver-test", Scope: "internal", Kind: governance.LibraryVersionTestSealed, SnapshotID: "snap-1", CreatedAt: now},
		{ID: "ver-prod", Scope: "internal", Kind: governance.LibraryVersionProductionEffective,
			SnapshotID: "prod-snap", VersionLabel: "prod-2026.10", CreatedAt: now},
		{ID: "ver-backup-other", Scope: "internal", Kind: governance.LibraryVersionProductionPrebackup,
			SnapshotID: "other-snap", CreatedAt: now},
	}}
	config := Config{Store: store, LibraryArchiveRoot: t.TempDir()}
	request := httptest.NewRequest(http.MethodGet, "/api/v1/library/overview?scope=internal", nil)
	recorder := httptest.NewRecorder()
	libraryOverviewHandler(recorder, request, config)
	if recorder.Code != http.StatusOK {
		t.Fatalf("status = %d: %s", recorder.Code, recorder.Body.String())
	}
	var body struct {
		Production libraryKnownView `json:"production"`
		Prebackup  libraryKnownView `json:"prebackup"`
		Diff       struct {
			State string `json:"state"`
		} `json:"diff"`
		Gate struct {
			SyncAllowed bool `json:"sync_allowed"`
		} `json:"gate"`
	}
	if err := json.Unmarshal(recorder.Body.Bytes(), &body); err != nil {
		t.Fatalf("decode overview: %v", err)
	}
	if body.Production.State != "known" || body.Production.Version == nil || body.Production.Version.ID != "ver-prod" {
		t.Fatalf("production must be the effective version, got %+v", body.Production)
	}
	// 预备份只对匹配目标快照的那一份生效；这里目标为空（归档不可用），所以是未知。
	if body.Prebackup.State != "unknown" {
		t.Fatalf("prebackup must stay unknown without a matching target snapshot: %+v", body.Prebackup)
	}
	if body.Diff.State != "unknown" {
		t.Fatalf("diff must be unknown until the comparison is wired, got %q", body.Diff.State)
	}
	if body.Gate.SyncAllowed {
		t.Fatal("gate must stay closed")
	}
}