package api_test

import (
	"bytes"
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"strings"
	"testing"

	"vetting/internal/api"
	"vetting/internal/db"
	"vetting/internal/model"
	"vetting/internal/store"
)

func newUI(t *testing.T, publicURL string) (*api.UI, *store.Hosts) {
	t.Helper()
	tmp := t.TempDir()
	conn, err := db.Open(filepath.Join(tmp, "vetting.db"))
	if err != nil {
		t.Fatalf("open db: %v", err)
	}
	t.Cleanup(func() { _ = conn.Close() })
	hostStore := &store.Hosts{DB: conn}
	return &api.UI{
		Hosts:     hostStore,
		PublicURL: publicURL,
	}, hostStore
}

func validQuickRegisterBody() []byte {
	body, _ := json.Marshal(map[string]any{
		"name":             "qr-host-01",
		"mac":              "aa:bb:cc:dd:ee:01",
		"wol_broadcast_ip": "10.0.0.255",
		"wol_port":         9,
		"expected_spec_yaml": "cpu:\n  model: \"Xeon\"\n  logical_cores: 8\n" +
			"memory:\n  total_gib: 16\n",
		"notes": "registered via smoke test",
	})
	return body
}

func TestCreateHostJSON_Success(t *testing.T) {
	ui, hostStore := newUI(t, "")
	req := httptest.NewRequest(http.MethodPost, "/api/v1/hosts",
		bytes.NewReader(validQuickRegisterBody()))
	req.Header.Set("Content-Type", "application/json")
	rr := httptest.NewRecorder()
	ui.CreateHostJSON(rr, req)

	if rr.Code != http.StatusCreated {
		t.Fatalf("status = %d, want 201; body=%q", rr.Code, rr.Body.String())
	}
	var resp struct {
		ID   int64  `json:"id"`
		Name string `json:"name"`
		MAC  string `json:"mac"`
	}
	if err := json.NewDecoder(rr.Body).Decode(&resp); err != nil {
		t.Fatalf("decode: %v", err)
	}
	if resp.ID == 0 || resp.Name != "qr-host-01" || resp.MAC != "aa:bb:cc:dd:ee:01" {
		t.Fatalf("response = %+v", resp)
	}

	got, err := hostStore.Get(context.Background(), resp.ID)
	if err != nil {
		t.Fatalf("get host: %v", err)
	}
	if got.Name != "qr-host-01" || got.MAC != "aa:bb:cc:dd:ee:01" || got.WoLPort != 9 {
		t.Fatalf("host row = %+v", got)
	}
}

func TestCreateHostJSON_DefaultsWoLPort(t *testing.T) {
	ui, hostStore := newUI(t, "")
	body, _ := json.Marshal(map[string]any{
		"name":               "qr-host-noport",
		"mac":                "aa:bb:cc:dd:ee:02",
		"wol_broadcast_ip":   "10.0.0.255",
		"expected_spec_yaml": "cpu:\n  logical_cores: 4\n",
	})
	req := httptest.NewRequest(http.MethodPost, "/api/v1/hosts", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	rr := httptest.NewRecorder()
	ui.CreateHostJSON(rr, req)
	if rr.Code != http.StatusCreated {
		t.Fatalf("status = %d, want 201; body=%q", rr.Code, rr.Body.String())
	}
	hosts, err := hostStore.List(context.Background())
	if err != nil {
		t.Fatalf("list: %v", err)
	}
	if len(hosts) != 1 || hosts[0].WoLPort != 9 {
		t.Fatalf("hosts = %+v", hosts)
	}
}

func TestCreateHostJSON_BadMAC(t *testing.T) {
	ui, _ := newUI(t, "")
	body, _ := json.Marshal(map[string]any{
		"name":               "bad-mac",
		"mac":                "not-a-mac",
		"wol_broadcast_ip":   "10.0.0.255",
		"expected_spec_yaml": "cpu:\n  logical_cores: 1\n",
	})
	req := httptest.NewRequest(http.MethodPost, "/api/v1/hosts", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	rr := httptest.NewRecorder()
	ui.CreateHostJSON(rr, req)
	if rr.Code != http.StatusBadRequest {
		t.Fatalf("status = %d, want 400; body=%q", rr.Code, rr.Body.String())
	}
	var resp map[string]string
	_ = json.NewDecoder(rr.Body).Decode(&resp)
	if !strings.Contains(resp["error"], "MAC") {
		t.Fatalf("error = %q, want mention of MAC", resp["error"])
	}
}

func TestCreateHostJSON_BadYAML(t *testing.T) {
	ui, _ := newUI(t, "")
	body, _ := json.Marshal(map[string]any{
		"name":               "bad-yaml",
		"mac":                "aa:bb:cc:dd:ee:03",
		"wol_broadcast_ip":   "10.0.0.255",
		"expected_spec_yaml": "cpu: [unterminated",
	})
	req := httptest.NewRequest(http.MethodPost, "/api/v1/hosts", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	rr := httptest.NewRecorder()
	ui.CreateHostJSON(rr, req)
	if rr.Code != http.StatusBadRequest {
		t.Fatalf("status = %d, want 400; body=%q", rr.Code, rr.Body.String())
	}
}

func TestCreateHostJSON_DuplicateMAC(t *testing.T) {
	ui, hostStore := newUI(t, "")
	// Seed a host with the MAC we'll try to re-register.
	if _, err := hostStore.Create(context.Background(), model.Host{
		Name:             "existing",
		MAC:              "aa:bb:cc:dd:ee:04",
		WoLBroadcastIP:   "10.0.0.255",
		WoLPort:          9,
		ExpectedSpecYAML: "cpu:\n  logical_cores: 1\n",
	}); err != nil {
		t.Fatalf("seed host: %v", err)
	}
	body, _ := json.Marshal(map[string]any{
		"name":               "dupe",
		"mac":                "aa:bb:cc:dd:ee:04",
		"wol_broadcast_ip":   "10.0.0.255",
		"expected_spec_yaml": "cpu:\n  logical_cores: 1\n",
	})
	req := httptest.NewRequest(http.MethodPost, "/api/v1/hosts", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	rr := httptest.NewRecorder()
	ui.CreateHostJSON(rr, req)
	if rr.Code != http.StatusConflict {
		t.Fatalf("status = %d, want 409; body=%q", rr.Code, rr.Body.String())
	}
	var resp map[string]string
	_ = json.NewDecoder(rr.Body).Decode(&resp)
	if !strings.Contains(strings.ToLower(resp["error"]), "mac") {
		t.Fatalf("error = %q, want mention of MAC", resp["error"])
	}
}

func TestCreateHostJSON_BadJSON(t *testing.T) {
	ui, _ := newUI(t, "")
	req := httptest.NewRequest(http.MethodPost, "/api/v1/hosts",
		strings.NewReader("not json"))
	req.Header.Set("Content-Type", "application/json")
	rr := httptest.NewRecorder()
	ui.CreateHostJSON(rr, req)
	if rr.Code != http.StatusBadRequest {
		t.Fatalf("status = %d, want 400; body=%q", rr.Code, rr.Body.String())
	}
}

func TestQuickRegisterScript_UsesPublicURL(t *testing.T) {
	ui, _ := newUI(t, "https://vetting.example.lan")
	req := httptest.NewRequest(http.MethodGet, "/register/quick.sh", nil)
	rr := httptest.NewRecorder()
	ui.QuickRegisterScript(rr, req)
	if rr.Code != http.StatusOK {
		t.Fatalf("status = %d, want 200", rr.Code)
	}
	if ct := rr.Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/x-shellscript") {
		t.Fatalf("Content-Type = %q, want text/x-shellscript...", ct)
	}
	body := rr.Body.String()
	if !strings.Contains(body, "#!/usr/bin/env bash") {
		t.Fatalf("body missing bash shebang: %q", body[:min(120, len(body))])
	}
	if !strings.Contains(body, "https://vetting.example.lan") {
		t.Fatalf("body missing configured public URL")
	}
	if !strings.Contains(body, "/api/v1/hosts") {
		t.Fatalf("body missing POST target /api/v1/hosts")
	}
}

func TestQuickRegisterScript_FallsBackToRequestHost(t *testing.T) {
	ui, _ := newUI(t, "")
	req := httptest.NewRequest(http.MethodGet, "/register/quick.sh", nil)
	req.Host = "10.0.0.5:8080"
	rr := httptest.NewRecorder()
	ui.QuickRegisterScript(rr, req)
	if rr.Code != http.StatusOK {
		t.Fatalf("status = %d", rr.Code)
	}
	body := rr.Body.String()
	if !strings.Contains(body, "http://10.0.0.5:8080") {
		t.Fatalf("body missing request-host fallback URL; body prefix=%q",
			body[:min(160, len(body))])
	}
}

// Verifies the unique-name path also hits friendlyDBError, not just MAC.
func TestCreateHostJSON_DuplicateName(t *testing.T) {
	ui, hostStore := newUI(t, "")
	if _, err := hostStore.Create(context.Background(), model.Host{
		Name:             "already-taken",
		MAC:              "aa:bb:cc:dd:ee:05",
		WoLBroadcastIP:   "10.0.0.255",
		WoLPort:          9,
		ExpectedSpecYAML: "cpu:\n  logical_cores: 1\n",
	}); err != nil {
		t.Fatalf("seed: %v", err)
	}
	body, _ := json.Marshal(map[string]any{
		"name":               "already-taken",
		"mac":                "aa:bb:cc:dd:ee:99",
		"wol_broadcast_ip":   "10.0.0.255",
		"expected_spec_yaml": "cpu:\n  logical_cores: 1\n",
	})
	req := httptest.NewRequest(http.MethodPost, "/api/v1/hosts", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	rr := httptest.NewRecorder()
	ui.CreateHostJSON(rr, req)
	if rr.Code != http.StatusConflict {
		t.Fatalf("status = %d", rr.Code)
	}
	var resp map[string]string
	_ = json.NewDecoder(rr.Body).Decode(&resp)
	if !strings.Contains(strings.ToLower(resp["error"]), "name") {
		t.Fatalf("error = %q, want friendly name-conflict message", resp["error"])
	}
}