package services

import (
	"net/http/httptest"
	"path/filepath"
	"strings"
	"sync"
	"sync/atomic"
	"testing"
	"time"

	"agent-desk/internal/models"
	"agent-desk/internal/pkg/config"
	"agent-desk/internal/pkg/dto/response"
	"agent-desk/internal/pkg/enums"
	"agent-desk/internal/pkg/openidentity"
	"agent-desk/internal/repositories"

	"github.com/gin-gonic/gin"
	"github.com/glebarez/sqlite"
	"github.com/golang-jwt/jwt/v5"
	"github.com/mlogclub/simple/sqls"
	"gorm.io/gorm"
	"gorm.io/gorm/logger"
	"gorm.io/gorm/schema"
)

func setupIdentitySecurityDB(t *testing.T) (*gorm.DB, *models.Channel) {
	t.Helper()
	db, err := gorm.Open(sqlite.Open(filepath.Join(t.TempDir(), "identity.db")), &gorm.Config{
		NamingStrategy: schema.NamingStrategy{TablePrefix: "t_", SingularTable: true},
		Logger:         logger.Default.LogMode(logger.Silent),
	})
	if err != nil {
		t.Fatal(err)
	}
	if err := db.AutoMigrate(&models.Customer{}, &models.CustomerIdentity{}, &models.Channel{}, &models.Conversation{}); err != nil {
		t.Fatal(err)
	}
	previousDB, previousConfig := sqls.DB(), config.GetCurrent()
	sqls.SetDB(db)
	config.SetCurrent(&config.Config{CustomerSession: config.CustomerSessionConfig{Secret: "test-only-customer-session-key", TTLMinutes: 120}})
	t.Cleanup(func() {
		sqls.SetDB(previousDB)
		config.SetCurrent(previousConfig)
		sqlDB, _ := db.DB()
		_ = sqlDB.Close()
	})
	channel := &models.Channel{ChannelID: "channel-a", ChannelType: enums.ChannelTypeWeb, Status: enums.StatusOk, ConfigJSON: "{}"}
	if err := db.Create(channel).Error; err != nil {
		t.Fatal(err)
	}
	return db, channel
}

func scopedTestExternal(channel *models.Channel, issuer, id string) openidentity.ExternalUser {
	source := enums.ExternalSourceUser
	if issuer == "guest" {
		source = enums.ExternalSourceGuest
	}
	return openidentity.ExternalUser{ExternalSource: source, ExternalID: id, IdentityScope: openidentity.IdentityScope(channel.ChannelID, issuer), ChannelID: channel.ID}
}

func verifySecurityCustomerSession(t *testing.T, channel *models.Channel, token string) *CustomerSessionVerifyResult {
	t.Helper()
	ctx, _ := gin.CreateTestContext(httptest.NewRecorder())
	ctx.Request = httptest.NewRequest("GET", "/api/ws/open", nil)
	ctx.Request.Header.Set("Authorization", "Bearer "+token)
	result, err := CustomerSessionService.VerifyRequest(ctx, channel)
	if err != nil {
		t.Fatalf("verify customer credential: %v", err)
	}
	return result
}

func TestCustomerIdentitySeparatesTrustIssuerAndChannel(t *testing.T) {
	db, channel := setupIdentitySecurityDB(t)
	otherChannel := &models.Channel{ChannelID: "channel-b", ChannelType: enums.ChannelTypeWeb, Status: enums.StatusOk, ConfigJSON: "{}"}
	if err := db.Create(otherChannel).Error; err != nil {
		t.Fatal(err)
	}
	customerIDs := map[int64]bool{}
	for _, input := range []struct {
		channel *models.Channel
		issuer  string
	}{{channel, "hmac"}, {channel, "jwt"}, {channel, "guest"}, {otherChannel, "hmac"}} {
		exchanged, err := CustomerSessionService.Exchange(input.channel, scopedTestExternal(input.channel, input.issuer, "same-id"))
		if err != nil {
			t.Fatal(err)
		}
		if customerIDs[exchanged.Customer.ID] {
			t.Fatal("independent identity scopes were merged")
		}
		customerIDs[exchanged.Customer.ID] = true
		result := verifySecurityCustomerSession(t, input.channel, exchanged.CustomerSessionToken)
		if !CustomerSessionService.VerifyConnection(result) {
			t.Fatal("fresh scoped connection rejected")
		}
		wrongChannel := &models.Conversation{CustomerID: result.CustomerID, ChannelID: otherChannel.ID}
		if input.channel.ID != otherChannel.ID && ConversationService.IsCustomerConversationOwner(wrongChannel, *result.ExternalUser) {
			t.Fatal("customer acquired a different channel's conversation")
		}
	}
}

func TestGuestBootstrapCannotReclaimKnownAnonymousIdentity(t *testing.T) {
	_, channel := setupIdentitySecurityDB(t)
	first, err := CustomerSessionService.Exchange(channel, scopedTestExternal(channel, "guest", "caller-chosen-id"))
	if err != nil {
		t.Fatal(err)
	}
	stolenID := strings.TrimPrefix(first.IdentityKey, "guest:")
	if len(stolenID) != 64 || stolenID == "caller-chosen-id" {
		t.Fatal("guest identity was not server-generated")
	}
	second, err := CustomerSessionService.Exchange(channel, scopedTestExternal(channel, "guest", stolenID))
	if err != nil {
		t.Fatal(err)
	}
	if first.Customer.ID == second.Customer.ID || first.IdentityKey == second.IdentityKey {
		t.Fatal("public guest bootstrap reclaimed another guest identity")
	}
	original := verifySecurityCustomerSession(t, channel, first.CustomerSessionToken)
	if original.CustomerID != first.Customer.ID {
		t.Fatal("signed guest credential did not retain its owner")
	}
}

func TestCustomerIdentityDuplicatesFailClosedWithoutCreatingAnotherCustomer(t *testing.T) {
	db, channel := setupIdentitySecurityDB(t)
	external := scopedTestExternal(channel, "hmac", "duplicate")
	for i := 0; i < 2; i++ {
		customer := &models.Customer{Status: enums.StatusOk}
		if err := db.Create(customer).Error; err != nil {
			t.Fatal(err)
		}
		identity := &models.CustomerIdentity{CustomerID: customer.ID, IdentityScope: external.IdentityScope, ExternalSource: external.ExternalSource, ExternalID: external.ExternalID, Status: enums.StatusOk}
		if err := db.Create(identity).Error; err != nil {
			t.Fatal(err)
		}
	}
	if _, err := CustomerSessionService.Exchange(channel, external); err == nil {
		t.Fatal("ambiguous identity was accepted")
	}
	var count int64
	if err := db.Model(&models.Customer{}).Count(&count).Error; err != nil {
		t.Fatal(err)
	}
	if count != 2 {
		t.Fatalf("ambiguous mapping created another customer: %d", count)
	}
	identity, err := repositories.CustomerIdentityRepository.GetUniqueBy(db, external.IdentityScope, external.ExternalSource, external.ExternalID)
	if err == nil || identity != nil {
		t.Fatal("duplicate lookup did not fail closed")
	}
}

func TestCustomerSessionsRejectLegacyScopeAndLivePolicyChanges(t *testing.T) {
	db, channel := setupIdentitySecurityDB(t)
	exchanged, err := CustomerSessionService.Exchange(channel, scopedTestExternal(channel, "guest", "guest"))
	if err != nil {
		t.Fatal(err)
	}
	current := verifySecurityCustomerSession(t, channel, exchanged.CustomerSessionToken)
	claims, err := CustomerSessionService.verifyToken(exchanged.CustomerSessionToken)
	if err != nil {
		t.Fatal(err)
	}
	claims.IdentityScope = ""
	legacy, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(config.Current().CustomerSession.Secret))
	if err != nil {
		t.Fatal(err)
	}
	if _, err := CustomerSessionService.verifyToken(legacy); err == nil {
		t.Fatal("unscoped legacy credential accepted")
	}
	if err := db.Model(channel).Update("config_json", `{"requireSignedIdentity":true}`).Error; err != nil {
		t.Fatal(err)
	}
	if CustomerSessionService.VerifyConnection(current) {
		t.Fatal("existing guest retained access after signed-only policy change")
	}
	channel.ConfigJSON = `{"requireSignedIdentity":true}`
	if _, err := CustomerSessionService.Exchange(channel, scopedTestExternal(channel, "guest", "guest")); err == nil {
		t.Fatal("signed-only channel accepted guest exchange")
	}
}

func TestCustomerConnectionRejectsExpiryDisabledCustomerAndIdentityChanges(t *testing.T) {
	for _, scenario := range []string{"expiry", "disabled-customer", "disabled-channel", "disabled-identity", "rebound-identity", "duplicate-identity"} {
		t.Run(scenario, func(t *testing.T) {
			db, channel := setupIdentitySecurityDB(t)
			exchanged, err := CustomerSessionService.Exchange(channel, scopedTestExternal(channel, "hmac", "signed"))
			if err != nil {
				t.Fatal(err)
			}
			current := verifySecurityCustomerSession(t, channel, exchanged.CustomerSessionToken)
			switch scenario {
			case "expiry":
				current.ExpiresAt = time.Now()
			case "disabled-customer":
				err = db.Model(&models.Customer{}).Where("id = ?", current.CustomerID).Update("status", enums.StatusDisabled).Error
			case "disabled-channel":
				err = db.Model(channel).Update("status", enums.StatusDisabled).Error
			case "disabled-identity":
				err = db.Model(&models.CustomerIdentity{}).Where("customer_id = ?", current.CustomerID).Update("status", enums.StatusDisabled).Error
			case "rebound-identity":
				err = db.Model(&models.CustomerIdentity{}).Where("customer_id = ?", current.CustomerID).Update("customer_id", current.CustomerID+100).Error
			case "duplicate-identity":
				err = db.Create(&models.CustomerIdentity{CustomerID: current.CustomerID + 100, ExternalSource: current.ExternalUser.ExternalSource, ExternalID: current.ExternalUser.ExternalID, IdentityScope: current.ExternalUser.IdentityScope, Status: enums.StatusOk}).Error
			}
			if err != nil {
				t.Fatal(err)
			}
			if CustomerSessionService.VerifyConnection(current) {
				t.Fatal("invalidated customer connection retained authority")
			}
		})
	}
}

func TestCustomerRealtimeTopicsAndDeliveryRejectCrossScopeCollisions(t *testing.T) {
	db, channel := setupIdentitySecurityDB(t)
	ws := newWsService()
	signed, err := CustomerSessionService.Exchange(channel, scopedTestExternal(channel, "hmac", "known-id"))
	if err != nil {
		t.Fatal(err)
	}
	guest, err := CustomerSessionService.Exchange(channel, scopedTestExternal(channel, "guest", "known-id"))
	if err != nil {
		t.Fatal(err)
	}
	signedAuth := verifySecurityCustomerSession(t, channel, signed.CustomerSessionToken)
	guestAuth := verifySecurityCustomerSession(t, channel, guest.CustomerSessionToken)
	conversation := &models.Conversation{CustomerID: signed.Customer.ID, ChannelID: channel.ID}
	if err := db.Create(conversation).Error; err != nil {
		t.Fatal(err)
	}
	owner := &ClientSession{ID: "owner", Role: realtimeRoleUser, External: signedAuth.ExternalUser, CustomerSession: signedAuth, Topics: map[string]struct{}{}, Send: make(chan []byte, 4)}
	attacker := &ClientSession{ID: "guest", Role: realtimeRoleUser, External: guestAuth.ExternalUser, CustomerSession: guestAuth, Topics: map[string]struct{}{}, Send: make(chan []byte, 4)}
	if ws.customerTopic(signed.Customer.ID, channel.ID) == ws.customerTopic(guest.Customer.ID, channel.ID) {
		t.Fatal("trust namespaces collided")
	}
	if ws.customerTopic(signed.Customer.ID, channel.ID) == ws.customerTopic(signed.Customer.ID, channel.ID+1) {
		t.Fatal("channel namespaces collided")
	}
	ws.manager.Register(owner, ws.defaultTopics(owner))
	// Defense in depth: even an accidentally stale/wrong topic registration may
	// not grant the guest authorization to the signed customer's conversation.
	ws.manager.Register(attacker, ws.routeConversationTopics(conversation))
	ws.PublishAgentActivity(conversation, "step", "", "running")
	select {
	case <-owner.Send:
	default:
		t.Fatal("owner did not receive its event")
	}
	select {
	case <-attacker.Send:
		t.Fatal("guest received another customer's event")
	default:
	}
	if ws.canSubscribeConversation(attacker, conversation.ID) {
		t.Fatal("explicit foreign conversation subscription allowed")
	}
}

func TestScopedIdentityUniqueClaimPreservesLegacyRows(t *testing.T) {
	db, channel := setupIdentitySecurityDB(t)
	source := enums.ExternalSourceUser
	// Dirty legacy mappings remain migratable because their unique claim is NULL.
	for _, customerID := range []int64{100, 101} {
		if err := db.Create(&models.CustomerIdentity{CustomerID: customerID, ExternalSource: source, ExternalID: "same", Status: enums.StatusOk}).Error; err != nil {
			t.Fatal(err)
		}
	}
	scope := openidentity.IdentityScope(channel.ChannelID, "hmac")
	first := &models.CustomerIdentity{CustomerID: 102, IdentityScope: scope, ScopedKey: repositories.ScopedCustomerIdentityKey(scope, source, "same"), ExternalSource: source, ExternalID: "same", Status: enums.StatusOk}
	if err := db.Create(first).Error; err != nil {
		t.Fatal(err)
	}
	competing := &models.CustomerIdentity{CustomerID: 103, IdentityScope: scope, ScopedKey: repositories.ScopedCustomerIdentityKey(scope, source, "same"), ExternalSource: source, ExternalID: "same", Status: enums.StatusOk}
	if err := db.Create(competing).Error; err == nil {
		t.Fatal("database allowed a competing scoped identity claim")
	}
	otherScope := openidentity.IdentityScope(channel.ChannelID, "jwt")
	if err := db.Create(&models.CustomerIdentity{CustomerID: 104, IdentityScope: otherScope, ScopedKey: repositories.ScopedCustomerIdentityKey(otherScope, source, "same"), ExternalSource: source, ExternalID: "same", Status: enums.StatusOk}).Error; err != nil {
		t.Fatal("different issuer's claim was conflated")
	}
	found, err := repositories.CustomerIdentityRepository.GetUniqueBy(db, scope, source, "same")
	if err != nil || found == nil || found.CustomerID != 102 {
		t.Fatal("legacy mappings interfered with scoped identity")
	}
}

func TestWebIdentityPolicySurvivesOlderClientEdits(t *testing.T) {
	svc := newChannelService()
	raw, err := svc.preserveWebIdentityPolicy(`{"title":"New title"}`, `{"requireSignedIdentity":true}`)
	if err != nil {
		t.Fatal(err)
	}
	cfg, err := svc.ParseWebChannelConfig(raw)
	if err != nil || !cfg.RequireSignedIdentity {
		t.Fatal("older client edit silently disabled signed-only policy")
	}
	raw, err = svc.preserveWebIdentityPolicy(`{"requireSignedIdentity":false}`, `{"requireSignedIdentity":true}`)
	if err != nil {
		t.Fatal(err)
	}
	cfg, err = svc.ParseWebChannelConfig(raw)
	if err != nil || cfg.RequireSignedIdentity {
		t.Fatal("explicit policy change was not honored")
	}
	for _, raw := range []string{`{"requireSignedIdentity":null}`, `{"requireSignedIdentity":"false"}`, `{"requireSignedIdentity":0}`} {
		if _, err := svc.ParseWebChannelConfig(raw); err == nil {
			t.Fatal("non-boolean authentication policy accepted")
		}
	}
}

func TestCustomerSessionNearExpiryRefreshPreservesIdentity(t *testing.T) {
	db, channel := setupIdentitySecurityDB(t)
	exchanged, err := CustomerSessionService.Exchange(channel, scopedTestExternal(channel, "guest", "local-context"))
	if err != nil {
		t.Fatal(err)
	}
	claims, err := CustomerSessionService.verifyToken(exchanged.CustomerSessionToken)
	if err != nil {
		t.Fatal(err)
	}
	originalKey, originalScope, originalCustomer := claims.IdentityKey, claims.IdentityScope, claims.CustomerID
	claims.ExpiresAt = jwt.NewNumericDate(time.Now().Add(20 * time.Second))
	nearExpiry, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(config.Current().CustomerSession.Secret))
	if err != nil {
		t.Fatal(err)
	}
	refreshed := verifySecurityCustomerSession(t, channel, nearExpiry)
	if !refreshed.Refreshed || !refreshed.ExpiresAt.After(claims.ExpiresAt.Time) || refreshed.Token == nearExpiry {
		t.Fatal("near-expiry credential was not refreshed")
	}
	refreshedClaims, err := CustomerSessionService.verifyToken(refreshed.Token)
	if err != nil {
		t.Fatal(err)
	}
	if refreshedClaims.IdentityKey != originalKey || refreshedClaims.IdentityScope != originalScope || refreshedClaims.CustomerID != originalCustomer {
		t.Fatal("refresh changed anonymous identity")
	}
	var customers int64
	if err := db.Model(&models.Customer{}).Count(&customers).Error; err != nil {
		t.Fatal(err)
	}
	if customers != 1 {
		t.Fatal("refresh allocated another customer")
	}
	claims.ExpiresAt = jwt.NewNumericDate(time.Now().Add(-time.Second))
	expired, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(config.Current().CustomerSession.Secret))
	if err != nil {
		t.Fatal(err)
	}
	ctx, _ := gin.CreateTestContext(httptest.NewRecorder())
	ctx.Request = httptest.NewRequest("POST", "/api/customer/session_refresh", nil)
	ctx.Request.Header.Set("Authorization", "Bearer "+expired)
	if _, err := CustomerSessionService.VerifyRequest(ctx, channel); err == nil {
		t.Fatal("expired anonymous credential was silently renewed")
	}
}

func TestConcurrentCustomerSessionExchangesKeepOneScopedOwner(t *testing.T) {
	db, channel := setupIdentitySecurityDB(t)
	if err := db.Exec("PRAGMA journal_mode=WAL").Error; err != nil {
		t.Fatal(err)
	}
	pool, err := db.DB()
	if err != nil {
		t.Fatal(err)
	}
	pool.SetMaxOpenConns(4)
	external := scopedTestExternal(channel, "hmac", "concurrent-id")
	var queries atomic.Int32
	arrived := make(chan struct{}, 2)
	release := make(chan struct{})
	var releaseOnce sync.Once
	releaseBoth := func() { releaseOnce.Do(func() { close(release) }) }
	var exchanges sync.WaitGroup
	defer func() { releaseBoth(); exchanges.Wait() }()
	callbackName := "test:concurrent_scoped_lookup"
	if err := db.Callback().Query().After("gorm:query").Register(callbackName, func(tx *gorm.DB) {
		if tx.Statement.Table != "t_customer_identity" || tx.Error != nil || tx.RowsAffected != 0 {
			return
		}
		if queries.Add(1) <= 2 {
			arrived <- struct{}{}
			<-release
		}
	}); err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = db.Callback().Query().Remove(callbackName) })
	type result struct {
		value *response.CustomerSessionExchangeResponse
		err   error
	}
	results := make(chan result, 2)
	exchanges.Add(2)
	for i := 0; i < 2; i++ {
		go func() {
			defer exchanges.Done()
			value, err := CustomerSessionService.Exchange(channel, external)
			results <- result{value, err}
		}()
	}
	for i := 0; i < 2; i++ {
		select {
		case <-arrived:
		case <-time.After(2 * time.Second):
			releaseBoth()
			t.Fatal("concurrent transactions did not both reach initial identity lookup")
		}
	}
	releaseBoth()
	successes := 0
	var owner int64
	for i := 0; i < 2; i++ {
		select {
		case result := <-results:
			if result.err == nil {
				successes++
				owner = result.value.Customer.ID
			}
		case <-time.After(2 * time.Second):
			t.Fatal("concurrent exchange did not finish")
		}
	}
	if successes != 1 {
		t.Fatalf("expected one transaction winner, got %d", successes)
	}
	var customers, identities int64
	if err := db.Model(&models.Customer{}).Count(&customers).Error; err != nil {
		t.Fatal(err)
	}
	if err := db.Model(&models.CustomerIdentity{}).Count(&identities).Error; err != nil {
		t.Fatal(err)
	}
	if customers != 1 || identities != 1 {
		t.Fatal("losing transaction left an orphan or competing customer mapping")
	}
	retry, err := CustomerSessionService.Exchange(channel, external)
	if err != nil || retry.Customer.ID != owner {
		t.Fatal("retry did not resolve the unique winning owner")
	}
}