package bot

import (
	"crypto/rand"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strings"
	"sync/atomic"
	"testing"

	"lchat/internal/e2ee"
)

// fakeInviteServer implements the three endpoints Provision walks, the same
// wire shape agent/provision.mjs pins. It hands out one invite (the given
// fragment) and records how many claims it saw.
func fakeInviteServer(t *testing.T, fragment string, claims *atomic.Int32) *httptest.Server {
	t.Helper()
	inv, err := e2ee.DeriveInvite(fragment)
	if err != nil {
		t.Fatalf("derive invite: %v", err)
	}
	mux := http.NewServeMux()
	mux.HandleFunc("GET /api/key-invite/"+inv.ID, func(w http.ResponseWriter, r *http.Request) {
		json.NewEncoder(w).Encode(map[string]any{"ok": true, "wrapped": ""})
	})
	mux.HandleFunc("POST /api/key-invite/"+inv.ID+"/claim", func(w http.ResponseWriter, r *http.Request) {
		var body struct {
			ClaimSecret string `json:"claim_secret"`
		}
		json.NewDecoder(r.Body).Decode(&body)
		if body.ClaimSecret != inv.ClaimSecret {
			json.NewEncoder(w).Encode(map[string]any{"ok": false})
			return
		}
		claims.Add(1)
		json.NewEncoder(w).Encode(map[string]any{"ok": true, "token": "tok-ensure-test"})
	})
	mux.HandleFunc("POST /api/pubkey", func(w http.ResponseWriter, r *http.Request) {
		var body struct {
			Token     string `json:"token"`
			PublicKey string `json:"public_key"`
		}
		json.NewDecoder(r.Body).Decode(&body)
		if body.Token == "" || body.PublicKey == "" {
			http.Error(w, "missing", http.StatusBadRequest)
			return
		}
		json.NewEncoder(w).Encode(map[string]any{"ok": true})
	})
	return httptest.NewServer(mux)
}

func testFragment(t *testing.T) string {
	t.Helper()
	raw := make([]byte, 32)
	if _, err := rand.Read(raw); err != nil {
		t.Fatal(err)
	}
	return e2ee.B64uEncode(raw)
}

// The #806 shape: session file absent + invite present → redeem, write the
// session, and hand it back — so a fresh add-bot'd sidecar boots zero-touch.
func TestEnsureSessionProvisionsFromInvite(t *testing.T) {
	fragment := testFragment(t)
	var claims atomic.Int32
	srv := fakeInviteServer(t, fragment, &claims)
	defer srv.Close()

	path := filepath.Join(t.TempDir(), "eleven-session.json")
	sess, err := EnsureSession(srv.URL, path, fragment, "Eleven", t.Logf)
	if err != nil {
		t.Fatalf("EnsureSession: %v", err)
	}
	if sess == nil {
		t.Fatal("EnsureSession returned nil session despite an invite")
	}
	if sess.Name != "Eleven" || sess.Token != "tok-ensure-test" || sess.UserPriv == "" {
		t.Fatalf("unexpected session: name=%q token=%q priv-empty=%v", sess.Name, sess.Token, sess.UserPriv == "")
	}
	if claims.Load() != 1 {
		t.Fatalf("expected exactly one claim, got %d", claims.Load())
	}
	if _, err := os.Stat(path); err != nil {
		t.Fatalf("session file not persisted: %v", err)
	}

	// Second boot: the persisted session wins; the (now spent) invite is never
	// re-redeemed. The server is closed to prove no network is touched.
	srv.Close()
	again, err := EnsureSession(srv.URL, path, fragment, "Eleven", nil)
	if err != nil {
		t.Fatalf("EnsureSession reload: %v", err)
	}
	if again == nil || again.Token != "tok-ensure-test" {
		t.Fatalf("reload did not return the persisted session: %+v", again)
	}
}

// No session and no invite stays the normal "not provisioned" state — the
// caller keeps its clear operator-facing error.
func TestEnsureSessionMissingWithoutInvite(t *testing.T) {
	path := filepath.Join(t.TempDir(), "session.json")
	sess, err := EnsureSession("http://unused.invalid", path, "  ", "Claude", nil)
	if err != nil {
		t.Fatalf("EnsureSession: %v", err)
	}
	if sess != nil {
		t.Fatalf("expected nil session, got %+v", sess)
	}
}

// An existing session short-circuits: the invite is ignored and nothing dials
// out (the base URL is unresolvable on purpose).
func TestEnsureSessionPrefersExistingFile(t *testing.T) {
	path := filepath.Join(t.TempDir(), "session.json")
	existing := &Session{Token: "tok-existing", Name: "Eleven", UserPub: "pub", UserPriv: "priv"}
	if err := existing.Save(path); err != nil {
		t.Fatal(err)
	}
	sess, err := EnsureSession("http://unused.invalid", path, testFragment(t), "Eleven", nil)
	if err != nil {
		t.Fatalf("EnsureSession: %v", err)
	}
	if sess == nil || sess.Token != "tok-existing" {
		t.Fatalf("expected the existing session, got %+v", sess)
	}
}

// A spent invite (the crash-loop-after-burn case) fails with a provision
// error rather than looping silently.
func TestEnsureSessionSpentInvite(t *testing.T) {
	fragment := testFragment(t)
	inv, err := e2ee.DeriveInvite(fragment)
	if err != nil {
		t.Fatal(err)
	}
	mux := http.NewServeMux()
	mux.HandleFunc("GET /api/key-invite/"+inv.ID, func(w http.ResponseWriter, r *http.Request) {
		json.NewEncoder(w).Encode(map[string]any{"ok": false})
	})
	srv := httptest.NewServer(mux)
	defer srv.Close()

	path := filepath.Join(t.TempDir(), "session.json")
	_, err = EnsureSession(srv.URL, path, fragment, "Claude", nil)
	if err == nil || !strings.Contains(err.Error(), "invite is used or invalid") {
		t.Fatalf("expected spent-invite error, got %v", err)
	}
	if _, statErr := os.Stat(path); !os.IsNotExist(statErr) {
		t.Fatalf("no session file should be written on failure; stat: %v", statErr)
	}
}