package cli

import (
	"encoding/json"
	"net/http"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"testing"

	"git.knownelement.com/ukrrs/mopac-glpi-go/internal/fakeglpi"
)

const (
	testApp  = "fake-app-token-0123456789"
	testUser = "fake-user-token-0123456789"
)

func boot(t *testing.T) *fakeglpi.Server {
	t.Helper()
	srv := fakeglpi.New(testApp, testUser)
	t.Cleanup(srv.Close)
	t.Setenv("MGLPI_URL", srv.URL)
	t.Setenv("MGLPI_APP_TOKEN", testApp)
	t.Setenv("MGLPI_USER_TOKEN", testUser)
	t.Setenv("MGLPI_PROFILE_ID", "")
	return srv
}

func run(t *testing.T, args ...string) (string, string, int) {
	t.Helper()
	var out, errb strings.Builder
	code := Run(args, &out, &errb)
	return out.String(), errb.String(), code
}

func contentFile(t *testing.T, content string) string {
	t.Helper()
	path := filepath.Join(t.TempDir(), "content.txt")
	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
		t.Fatal(err)
	}
	return path
}

func TestUsageErrors(t *testing.T) {
	boot(t)
	tests := []struct {
		name string
		args []string
	}{
		{"no args", nil},
		{"unknown command", []string{"frobnicate"}},
		{"change alone", []string{"change"}},
		{"change create without title", []string{"change", "create"}},
		{"change show without id", []string{"change", "show"}},
		{"change show non-numeric id", []string{"change", "show", "abc"}},
		{"change transition bad status name", []string{"change", "transition", "5", "bogus"}},
		{"change list bad status name", []string{"change", "list", "--status", "bogus"}},
		{"ci search without term", []string{"ci", "search", "Computer"}},
		{"ci show without id", []string{"ci", "show", "Computer"}},
		{"whoami with positional", []string{"whoami", "extra"}},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			out, errb, code := run(t, tt.args...)
			if code != 1 {
				t.Fatalf("code = %d (out %q, err %q), want 1", code, out, errb)
			}
			if out != "" {
				t.Errorf("usage error wrote to stdout: %q", out)
			}
			if errb == "" {
				t.Errorf("no diagnostic on stderr")
			}
		})
	}
}

func TestConfigErrorIsExitOne(t *testing.T) {
	boot(t)
	t.Setenv("MGLPI_URL", "")
	t.Setenv("MGLPI_APP_TOKEN", "")
	t.Setenv("MGLPI_USER_TOKEN", "")
	_, errb, code := run(t, "change", "list")
	if code != 1 {
		t.Fatalf("code = %d, want 1 (config)", code)
	}
	if !strings.Contains(errb, "MGLPI_URL") {
		t.Fatalf("stderr = %q", errb)
	}
}

func TestWhoami(t *testing.T) {
	boot(t)
	out, errb, code := run(t, "whoami")
	if code != 0 {
		t.Fatalf("code = %d, stderr = %q", code, errb)
	}
	for _, want := range []string{"Self-Service", "Hotliner", "Super-admin", "active"} {
		if !strings.Contains(out, want) {
			t.Errorf("whoami output missing %q:\n%s", want, out)
		}
	}
	out, _, code = run(t, "whoami", "-o", "json")
	if code != 0 {
		t.Fatalf("json whoami code %d", code)
	}
	var got struct {
		Profiles []struct {
			ID       int    `json:"id"`
			Name     string `json:"name"`
			IsActive bool   `json:"is_active"`
		} `json:"profiles"`
	}
	if err := json.Unmarshal([]byte(out), &got); err != nil || len(got.Profiles) != 3 {
		t.Errorf("json whoami = %q err %v", out, err)
	}
}

func TestChangeCreateFullFlags(t *testing.T) {
	srv := boot(t)
	content := contentFile(t, "<p>scope body</p>")

	out, errb, code := run(t, "change", "create",
		"--title", "Quota: per-identity accounting",
		"--content", content,
		"--urgency", "3", "--impact", "4",
		"-o", "json")
	if code != 0 {
		t.Fatalf("code = %d, stderr = %q", code, errb)
	}
	var got struct {
		Change struct {
			ID int `json:"id"`
		} `json:"change"`
	}
	if err := json.Unmarshal([]byte(out), &got); err != nil || got.Change.ID == 0 {
		t.Fatalf("stdout not json: %v (%q)", err, out)
	}
	stored, ok := srv.Change(got.Change.ID)
	if !ok || stored.Name != "Quota: per-identity accounting" || stored.Content != "<p>scope body</p>" ||
		stored.Urgency != 3 || stored.Impact != 4 || stored.Status != fakeglpi.StatusNew {
		t.Errorf("stored = %+v", stored)
	}
}

func TestChangeCreateRequiresTitle(t *testing.T) {
	boot(t)
	_, errb, code := run(t, "change", "create")
	if code != 1 || !strings.Contains(errb, "--title") {
		t.Fatalf("code = %d stderr = %q, want usage naming --title", code, errb)
	}
}

func TestChangeList(t *testing.T) {
	srv := boot(t)
	open := srv.AddChange(fakeglpi.Change{Name: "open one", Status: fakeglpi.StatusNew, Urgency: 3, Impact: 3})
	solved := srv.AddChange(fakeglpi.Change{Name: "solved one", Status: fakeglpi.StatusSolved, Urgency: 3, Impact: 3})

	out, errb, code := run(t, "change", "list")
	if code != 0 {
		t.Fatalf("code = %d, stderr = %q", code, errb)
	}
	if !strings.Contains(out, "open one") || !strings.Contains(out, strconv.Itoa(open)) {
		t.Errorf("text list = %q", out)
	}
	out, _, code = run(t, "change", "list", "--status", "solved")
	if code != 0 || !strings.Contains(out, "solved one") || strings.Contains(out, "open one") {
		t.Errorf("status filter = %q code %d", out, code)
	}
	out, _, code = run(t, "change", "list", "--status", strconv.Itoa(fakeglpi.StatusNew))
	if code != 0 || !strings.Contains(out, "open one") || strings.Contains(out, "solved one") {
		t.Errorf("numeric status filter = %q code %d", out, code)
	}
	out, _, code = run(t, "change", "list", "-o", "json")
	if code != 0 {
		t.Fatalf("json list code %d", code)
	}
	var arr struct {
		Changes []struct {
			ID     int    `json:"id"`
			Name   string `json:"name"`
			Status int    `json:"status"`
		} `json:"changes"`
	}
	if err := json.Unmarshal([]byte(out), &arr); err != nil || len(arr.Changes) != 2 || arr.Changes[0].ID != open || arr.Changes[1].Status != fakeglpi.StatusSolved {
		t.Errorf("json list = %q err %v", out, err)
	}
	_ = solved
}

func TestChangeShow(t *testing.T) {
	srv := boot(t)
	id := srv.AddChange(fakeglpi.Change{Name: "shown change", Content: "body text", Status: fakeglpi.StatusAssigned, Urgency: 4, Impact: 3})

	out, errb, code := run(t, "change", "show", strconv.Itoa(id))
	if code != 0 {
		t.Fatalf("code = %d, stderr = %q", code, errb)
	}
	for _, want := range []string{strconv.Itoa(id), "shown change", "body text", "assigned", "4"} {
		if !strings.Contains(out, want) {
			t.Errorf("show output missing %q:\n%s", want, out)
		}
	}
	out, _, code = run(t, "change", "show", strconv.Itoa(id), "-o", "json")
	if code != 0 {
		t.Fatalf("json show code %d", code)
	}
	var got struct {
		Change struct {
			ID      int    `json:"id"`
			Name    string `json:"name"`
			Content string `json:"content"`
			Status  int    `json:"status"`
		} `json:"change"`
	}
	if err := json.Unmarshal([]byte(out), &got); err != nil || got.Change.Name != "shown change" || got.Change.Status != fakeglpi.StatusAssigned {
		t.Errorf("json show = %q err %v", out, err)
	}
}

func TestChangeTransition(t *testing.T) {
	srv := boot(t)
	id := srv.AddChange(fakeglpi.Change{Name: "flow", Status: fakeglpi.StatusNew, Urgency: 3, Impact: 3})

	out, errb, code := run(t, "change", "transition", strconv.Itoa(id), "solved")
	if code != 0 {
		t.Fatalf("code = %d, stderr = %q", code, errb)
	}
	if !strings.Contains(out, strconv.Itoa(id)) {
		t.Errorf("confirmation = %q", out)
	}
	if got, _ := srv.Change(id); got.Status != fakeglpi.StatusSolved {
		t.Errorf("stored status = %d, want solved", got.Status)
	}
	out, errb, code = run(t, "change", "transition", strconv.Itoa(id), strconv.Itoa(fakeglpi.StatusClosed))
	if code != 0 {
		t.Fatalf("numeric transition code = %d, stderr = %q", code, errb)
	}
	if got, _ := srv.Change(id); got.Status != fakeglpi.StatusClosed {
		t.Errorf("stored status = %d, want closed", got.Status)
	}
}

func TestChangeFollowup(t *testing.T) {
	srv := boot(t)
	id := srv.AddChange(fakeglpi.Change{Name: "with note", Status: fakeglpi.StatusNew, Urgency: 3, Impact: 3})
	content := contentFile(t, "REPORT delivered: see inbox")

	out, errb, code := run(t, "change", "followup", strconv.Itoa(id), "--content", content)
	if code != 0 {
		t.Fatalf("code = %d, stderr = %q", code, errb)
	}
	if !strings.Contains(out, strconv.Itoa(id)) {
		t.Errorf("confirmation = %q", out)
	}
	fups := srv.Followups(id)
	if len(fups) != 1 || fups[0].Content != "REPORT delivered: see inbox" {
		t.Errorf("followups = %+v", fups)
	}

	empty := contentFile(t, "")
	_, errb, code = run(t, "change", "followup", strconv.Itoa(id), "--content", empty)
	if code != 1 || !strings.Contains(errb, "content") {
		t.Errorf("empty followup = code %d stderr %q, want usage error", code, errb)
	}
}

func TestCISearchAndShow(t *testing.T) {
	srv := boot(t)
	web := srv.AddItem("Computer", map[string]any{"name": "web-01", "serial": "ABC123"})

	out, errb, code := run(t, "ci", "search", "Computer", "web")
	if code != 0 {
		t.Fatalf("code = %d, stderr = %q", code, errb)
	}
	if !strings.Contains(out, "web-01") || !strings.Contains(out, strconv.Itoa(web)) {
		t.Errorf("search = %q", out)
	}
	out, _, code = run(t, "ci", "search", "Computer", "web", "-o", "json")
	if code != 0 {
		t.Fatalf("json search code %d", code)
	}
	var arr struct {
		Results []struct {
			ID   int    `json:"id"`
			Name string `json:"name"`
		} `json:"results"`
	}
	if err := json.Unmarshal([]byte(out), &arr); err != nil || len(arr.Results) != 1 || arr.Results[0].Name != "web-01" {
		t.Errorf("json search = %q err %v", out, err)
	}

	out, _, code = run(t, "ci", "show", "Computer", strconv.Itoa(web), "-o", "json")
	if code != 0 {
		t.Fatalf("ci show code = %d", code)
	}
	var raw map[string]any
	if err := json.Unmarshal([]byte(out), &raw); err != nil || raw["serial"] != "ABC123" {
		t.Errorf("ci show = %q err %v", out, err)
	}
	if _, errb, code := run(t, "ci", "show", "Computer", "424242"); code != 2 || !strings.Contains(errb, "http 404") {
		t.Errorf("missing ci = code %d stderr %q, want exit 2 http 404", code, errb)
	}
}

// THE agent-mode CLI proof: the fake rejects change creation unless the
// session's active profile is 5; --profile and MGLPI_PROFILE_ID both
// must flip it.
func TestProfileSwitchAgentMode(t *testing.T) {
	tests := []struct {
		name       string
		envProfile string
		flag       []string
		wantCode   int
	}{
		{"no profile -> rejected", "", nil, 2},
		{"--profile 5 -> accepted", "", []string{"--profile", "5"}, 0},
		{"--profile 4 -> rejected", "", []string{"--profile", "4"}, 2},
		{"env profile 5 -> accepted", "5", nil, 0},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			srv := boot(t)
			srv.RequireChangeProfile = 5
			t.Setenv("MGLPI_PROFILE_ID", tt.envProfile)
			args := append([]string{"change", "create", "--title", "agent-mode", "--content", "-"}, tt.flag...)
			out, errb, code := run(t, args...)
			if code != tt.wantCode {
				t.Fatalf("code = %d (stderr %q), want %d", code, errb, tt.wantCode)
			}
			if tt.wantCode == 0 {
				if !strings.Contains(out, "created change #") {
					t.Errorf("out = %q", out)
				}
			} else if !strings.Contains(errb, "http 403") {
				t.Errorf("stderr = %q, want http 403", errb)
			}
		})
	}
}

// Real GLPI exposes the active profile only via GET /getActiveProfile.
// whoami must detect it there — and DEGRADE to all-inactive (not fail)
// when that endpoint is missing or permission-blocked.
func TestWhoamiActiveProfileDegradation(t *testing.T) {
	tests := []struct {
		name    string
		brk     int
		wantAct bool // [active] marker expected?
	}{
		{"working endpoint marks active", 0, true},
		{"403 degrades to all-inactive", http.StatusForbidden, false},
		{"404 degrades to all-inactive", http.StatusNotFound, false},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			srv := boot(t)
			srv.BreakActiveProfile = tt.brk
			out, errb, code := run(t, "whoami")
			if code != 0 {
				t.Fatalf("code = %d, stderr = %q, want 0", code, errb)
			}
			if !strings.Contains(out, "Hotliner") || !strings.Contains(out, "Super-admin") {
				t.Errorf("profiles missing from output: %q", out)
			}
			if got := strings.Contains(out, "[active]"); got != tt.wantAct {
				t.Errorf("[active] marker = %v, want %v (out %q)", got, tt.wantAct, out)
			}
		})
	}
	t.Run("500 on getActiveProfile still errors", func(t *testing.T) {
		srv := boot(t)
		srv.BreakActiveProfile = http.StatusInternalServerError
		_, _, code := run(t, "whoami")
		if code != 2 {
			t.Fatalf("code = %d, want 2 (unexpected server errors are surfaced)", code)
		}
	})
}

func TestAPIErrorIsExitTwo(t *testing.T) {
	srv := boot(t)
	srv.Fail = &fakeglpi.FailSpec{Status: 404, Body: `[{"ERROR_ITEM_NOT_FOUND":"gone %s"}]`}
	out, errb, code := run(t, "change", "list")
	if code != 2 {
		t.Fatalf("code = %d, want 2", code)
	}
	if out != "" {
		t.Errorf("stdout on API error: %q", out)
	}
	lines := strings.Split(strings.TrimRight(errb, "\n"), "\n")
	if len(lines) != 1 || !strings.Contains(lines[0], "http 404") {
		t.Fatalf("stderr = %q, want single parseable line with http 404", errb)
	}
}

func TestTokensNeverPrinted(t *testing.T) {
	srv := fakeglpi.New(testApp, testUser)
	t.Cleanup(srv.Close)
	t.Setenv("MGLPI_URL", srv.URL)
	t.Setenv("MGLPI_APP_TOKEN", "wrong-app-token")
	t.Setenv("MGLPI_USER_TOKEN", testUser)
	t.Setenv("MGLPI_PROFILE_ID", "")
	_, errb, code := run(t, "change", "list")
	if code != 2 {
		t.Fatalf("code = %d, want 2", code)
	}
	if strings.Contains(errb, "wrong-app-token") || strings.Contains(errb, testUser) || strings.Contains(errb, testApp) {
		t.Fatalf("stderr leaks a token: %q", errb)
	}
	if strings.Count(errb, "\n") != 1 { // one diagnostic line + trailing newline
		t.Fatalf("stderr not one line: %q", errb)
	}
}

func TestHelpExitsZero(t *testing.T) {
	boot(t)
	out, _, code := run(t, "help")
	if code != 0 || !strings.Contains(out, "change") {
		t.Fatalf("help code = %d out = %q", code, out)
	}
}