import Foundation
import Testing
@testable import CodexBarCore

#if os(macOS)
@Suite(.serialized)
struct ClaudeOAuthRefreshFailureGateTests {
    private let legacyBlockedUntilKey = "claudeOAuthRefreshBackoffBlockedUntilV1"
    private let legacyFailureCountKey = "claudeOAuthRefreshBackoffFailureCountV1"
    private let legacyFingerprintKey = "claudeOAuthRefreshBackoffFingerprintV2"
    private let terminalBlockedKey = "claudeOAuthRefreshTerminalBlockedV1"
    private let transientBlockedUntilKey = "claudeOAuthRefreshTransientBlockedUntilV1"
    private let transientFailureCountKey = "claudeOAuthRefreshTransientFailureCountV1"

    @Test
    func `blocks indefinitely when fingerprint unchanged`() {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        var fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting { fingerprint }
        defer { ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting(nil) }

        let start = Date(timeIntervalSince1970: 1000)
        ClaudeOAuthRefreshFailureGate.recordTerminalAuthFailure(now: start)

        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60)) == false)

        // Ensure we do not get unblocked unless fingerprint changes.
        fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60 * 4)) == false)
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60 * 60 * 24)) == false)
    }

    @Test
    func `migrates legacy blocked until in past does not block and clears key`() {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        let now = Date(timeIntervalSince1970: 10000)
        UserDefaults.standard.set(now.addingTimeInterval(-60).timeIntervalSince1970, forKey: self.legacyBlockedUntilKey)
        UserDefaults.standard.set(0, forKey: self.legacyFailureCountKey)
        UserDefaults.standard.removeObject(forKey: self.terminalBlockedKey)

        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: now) == true)
        #expect(UserDefaults.standard.object(forKey: self.legacyBlockedUntilKey) == nil)
    }

    @Test
    func `migrates legacy backoff to transient backoff does not set terminal block`() throws {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        let now = Date(timeIntervalSince1970: 20000)

        let fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting { fingerprint }
        defer { ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting(nil) }

        let legacyBlockedUntil = now.addingTimeInterval(60 * 10)
        UserDefaults.standard.set(2, forKey: self.legacyFailureCountKey)
        UserDefaults.standard.removeObject(forKey: self.terminalBlockedKey)
        UserDefaults.standard.set(legacyBlockedUntil.timeIntervalSince1970, forKey: self.legacyBlockedUntilKey)
        let data = try JSONEncoder().encode(fingerprint)
        UserDefaults.standard.set(data, forKey: self.legacyFingerprintKey)

        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: now) == false)
        #expect(UserDefaults.standard.bool(forKey: self.terminalBlockedKey) == false)
        #expect(UserDefaults.standard.object(forKey: self.legacyBlockedUntilKey) == nil)
        #expect(UserDefaults.standard.object(forKey: self.transientBlockedUntilKey) != nil)
        #expect(UserDefaults.standard.integer(forKey: self.transientFailureCountKey) == 2)
    }

    @Test
    func `unblocks when fingerprint becomes available after being unknown at failure`() {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        var fingerprint: ClaudeOAuthRefreshFailureGate.AuthFingerprint?
        ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting { fingerprint }
        defer { ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting(nil) }

        let start = Date(timeIntervalSince1970: 25000)
        ClaudeOAuthRefreshFailureGate.recordTerminalAuthFailure(now: start)

        // Still blocked while fingerprint is unavailable.
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(20)) == false)

        // Once fingerprint becomes available, the sentinel differs and we unblock.
        fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(40)) == true)
    }

    @Test
    func `unblocks immediately when fingerprint changes`() {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        var fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting { fingerprint }
        defer { ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting(nil) }

        let start = Date(timeIntervalSince1970: 2000)
        ClaudeOAuthRefreshFailureGate.recordTerminalAuthFailure(now: start)
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60)) == false)

        fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 2,
                createdAt: 2,
                persistentRefHash: "ref2"),
            credentialsFile: "file2")
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60 * 2)) == true)
    }

    @Test
    func `throttles fingerprint recheck while terminal blocked`() {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        var calls = 0
        let fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting {
            calls += 1
            return fingerprint
        }
        defer { ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting(nil) }

        let start = Date(timeIntervalSince1970: 30000)
        ClaudeOAuthRefreshFailureGate.recordTerminalAuthFailure(now: start)
        #expect(calls == 1)

        // First blocked check is throttled (we already captured fingerprint at failure).
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(1)) == false)
        #expect(calls == 1)

        // After the throttle window, it should re-read.
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(20)) == false)
        #expect(calls == 2)

        // Subsequent checks within the throttle window should not re-read again.
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(21)) == false)
        #expect(calls == 2)
    }

    @Test
    func `terminal block is monotonic when transient failure is recorded`() {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        let fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting { fingerprint }
        defer { ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting(nil) }

        let start = Date(timeIntervalSince1970: 35000)
        ClaudeOAuthRefreshFailureGate.recordTerminalAuthFailure(now: start)
        ClaudeOAuthRefreshFailureGate.recordTransientFailure(now: start.addingTimeInterval(1))

        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(20)) == false)
        #expect(UserDefaults.standard.bool(forKey: self.terminalBlockedKey) == true)
        #expect(UserDefaults.standard.object(forKey: self.transientBlockedUntilKey) == nil)
    }

    @Test
    func `record success clears terminal block`() {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        let fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting { fingerprint }
        defer { ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting(nil) }

        let start = Date(timeIntervalSince1970: 5000)
        ClaudeOAuthRefreshFailureGate.recordTerminalAuthFailure(now: start)
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60)) == false)

        ClaudeOAuthRefreshFailureGate.recordSuccess()
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60)) == true)
    }

    @Test
    func `transient backoff blocks until expiry then unblocks`() {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        let fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting { fingerprint }
        defer { ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting(nil) }

        let start = Date(timeIntervalSince1970: 60000)
        ClaudeOAuthRefreshFailureGate.recordTransientFailure(now: start)

        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(1)) == false)
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60 * 5 - 1)) == false)
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60 * 5 + 1)) == true)
    }

    @Test
    func `transient backoff is exponential and capped`() {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        let fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting { fingerprint }
        defer { ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting(nil) }

        let start = Date(timeIntervalSince1970: 70000)
        ClaudeOAuthRefreshFailureGate.recordTransientFailure(now: start)
        // Second failure before the first window expires should double the backoff.
        let secondFailureAt = start.addingTimeInterval(1)
        ClaudeOAuthRefreshFailureGate.recordTransientFailure(now: secondFailureAt)
        #expect(ClaudeOAuthRefreshFailureGate
            .shouldAttempt(now: secondFailureAt.addingTimeInterval(60 * 10 - 1)) == false)
        #expect(ClaudeOAuthRefreshFailureGate
            .shouldAttempt(now: secondFailureAt.addingTimeInterval(60 * 10 + 1)) == true)

        ClaudeOAuthRefreshFailureGate.resetInMemoryStateForTesting()
        for _ in 0..<20 {
            ClaudeOAuthRefreshFailureGate.recordTransientFailure(now: start)
        }

        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60 * 60 * 6 - 1)) == false)
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(60 * 60 * 6 + 1)) == true)
    }

    @Test
    func `transient backoff unblocks early when fingerprint changes`() {
        ClaudeOAuthRefreshFailureGate.resetForTesting()
        defer { ClaudeOAuthRefreshFailureGate.resetForTesting() }

        var fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 1,
                createdAt: 1,
                persistentRefHash: "ref1"),
            credentialsFile: "file1")
        ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting { fingerprint }
        defer { ClaudeOAuthRefreshFailureGate.setFingerprintProviderOverrideForTesting(nil) }

        let start = Date(timeIntervalSince1970: 80000)
        ClaudeOAuthRefreshFailureGate.recordTransientFailure(now: start)

        // Still blocked while timer is active and fingerprint unchanged.
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(20)) == false)

        fingerprint = ClaudeOAuthRefreshFailureGate.AuthFingerprint(
            keychain: ClaudeOAuthCredentialsStore.ClaudeKeychainFingerprint(
                modifiedAt: 2,
                createdAt: 2,
                persistentRefHash: "ref2"),
            credentialsFile: "file2")

        // Even though the 5-minute cooldown window hasn't elapsed, a fingerprint change should unblock.
        #expect(ClaudeOAuthRefreshFailureGate.shouldAttempt(now: start.addingTimeInterval(40)) == true)
    }
}
#endif