import Foundation
import Testing
@testable import CodexBarCore

@Suite(.serialized)
@MainActor
struct CodexWebDashboardStrategyAuthorityTests {
    @Test
    func `web dashboard attach converts snapshot with authority attachment email`() throws {
        OpenAIDashboardCacheStore.clear()
        defer { OpenAIDashboardCacheStore.clear() }

        let authHome = try self.makeAuthHome(
            email: "owner@example.com",
            accountId: "acct-owner")
        defer { try? FileManager.default.removeItem(at: authHome) }

        let context = self.makeContext(
            authHome: authHome,
            knownOwners: [
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-owner"),
                    normalizedEmail: "owner@example.com"),
            ])
        let result = try CodexWebDashboardStrategy.makeAuthorizedDashboardResultForTesting(
            dashboard: self.makeDashboard(email: "owner@example.com"),
            context: context,
            routingTargetEmail: "route@example.com")

        #expect(result.usage.accountEmail(for: .codex) == "owner@example.com")
        #expect(result.credits?.remaining == 42)
    }

    @Test
    func `web dashboard attach preserves credits when usage limits are absent`() throws {
        OpenAIDashboardCacheStore.clear()
        defer { OpenAIDashboardCacheStore.clear() }

        let authHome = try self.makeAuthHome(
            email: "owner@example.com",
            accountId: "acct-owner")
        defer { try? FileManager.default.removeItem(at: authHome) }

        let context = self.makeContext(
            authHome: authHome,
            knownOwners: [
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-owner"),
                    normalizedEmail: "owner@example.com"),
            ])
        let dashboard = self.makeDashboardWithoutUsageLimits(email: "owner@example.com")

        let result = try CodexWebDashboardStrategy.makeAuthorizedDashboardResultForTesting(
            dashboard: dashboard,
            context: context,
            routingTargetEmail: "route@example.com")

        #expect(result.usage.primary == nil)
        #expect(result.usage.secondary == nil)
        #expect(result.usage.updatedAt == dashboard.updatedAt)
        #expect(result.usage.identity?.accountEmail == "owner@example.com")
        #expect(result.usage.identity?.loginMethod == "pro")
        #expect(result.credits?.remaining == 42)
        #expect(result.dashboard == dashboard)
    }

    @Test
    func `web dashboard display only throws typed policy error`() throws {
        OpenAIDashboardCacheStore.clear()
        defer { OpenAIDashboardCacheStore.clear() }

        let authHome = try self.makeAuthHome(email: "shared@example.com")
        defer { try? FileManager.default.removeItem(at: authHome) }

        let context = self.makeContext(
            authHome: authHome,
            knownOwners: [
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-alpha"),
                    normalizedEmail: "shared@example.com"),
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-beta"),
                    normalizedEmail: "shared@example.com"),
            ])
        let dashboard = self.makeDashboard(email: "shared@example.com")
        let expectedDecision = CodexDashboardAuthority.evaluate(
            CodexCLIDashboardAuthorityContext.makeLiveWebInput(
                dashboard: dashboard,
                context: context,
                routingTargetEmail: "route@example.com"))

        do {
            _ = try CodexWebDashboardStrategy.makeAuthorizedDashboardResultForTesting(
                dashboard: dashboard,
                context: context,
                routingTargetEmail: "route@example.com")
            Issue.record("Expected CodexDashboardPolicyError.displayOnly")
        } catch let error as CodexDashboardPolicyError {
            #expect(error == .displayOnly(expectedDecision))
        } catch {
            Issue.record("Expected CodexDashboardPolicyError.displayOnly, got \(error)")
        }
    }

    @Test
    func `web dashboard fail closed throws policy rejection`() throws {
        OpenAIDashboardCacheStore.clear()
        defer { OpenAIDashboardCacheStore.clear() }

        let authHome = try self.makeAuthHome(
            email: "owner@example.com",
            accountId: "acct-owner")
        defer { try? FileManager.default.removeItem(at: authHome) }

        let context = self.makeContext(
            authHome: authHome,
            knownOwners: [
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-other"),
                    normalizedEmail: "owner@example.com"),
            ])
        let dashboard = self.makeDashboard(email: "owner@example.com")
        let expectedDecision = CodexDashboardAuthority.evaluate(
            CodexCLIDashboardAuthorityContext.makeLiveWebInput(
                dashboard: dashboard,
                context: context,
                routingTargetEmail: "route@example.com"))

        do {
            _ = try CodexWebDashboardStrategy.makeAuthorizedDashboardResultForTesting(
                dashboard: dashboard,
                context: context,
                routingTargetEmail: "route@example.com")
            Issue.record("Expected OpenAIWebCodexError.policyRejected")
        } catch let error as OpenAIWebCodexError {
            #expect(error == .policyRejected(expectedDecision))
        } catch {
            Issue.record("Expected OpenAIWebCodexError.policyRejected, got \(error)")
        }
    }

    @Test
    func `web dashboard wrong email throws policy rejection`() throws {
        OpenAIDashboardCacheStore.clear()
        defer { OpenAIDashboardCacheStore.clear() }

        let authHome = try self.makeAuthHome(
            email: "owner@example.com",
            accountId: "acct-owner")
        defer { try? FileManager.default.removeItem(at: authHome) }

        let context = self.makeContext(
            authHome: authHome,
            knownOwners: [
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-owner"),
                    normalizedEmail: "owner@example.com"),
            ])
        let dashboard = self.makeDashboard(email: "other@example.com")
        let expectedDecision = CodexDashboardAuthority.evaluate(
            CodexCLIDashboardAuthorityContext.makeLiveWebInput(
                dashboard: dashboard,
                context: context,
                routingTargetEmail: "owner@example.com"))

        do {
            _ = try CodexWebDashboardStrategy.makeAuthorizedDashboardResultForTesting(
                dashboard: dashboard,
                context: context,
                routingTargetEmail: "owner@example.com")
            Issue.record("Expected OpenAIWebCodexError.policyRejected")
        } catch let error as OpenAIWebCodexError {
            #expect(error == .policyRejected(expectedDecision))
            if case let .policyRejected(decision) = error {
                #expect(decision.reason == .wrongEmail(expected: "owner@example.com", actual: "other@example.com"))
            }
        } catch {
            Issue.record("Expected OpenAIWebCodexError.policyRejected, got \(error)")
        }
    }

    @Test
    func `web dashboard provider account without scoped auth email fail closes on dashboard collision`() throws {
        OpenAIDashboardCacheStore.clear()
        defer { OpenAIDashboardCacheStore.clear() }

        let authHome = try self.makeAuthHome(email: nil, accountId: "acct-owner")
        defer { try? FileManager.default.removeItem(at: authHome) }

        let context = self.makeContext(
            authHome: authHome,
            knownOwners: [
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-alpha"),
                    normalizedEmail: "shared@example.com"),
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-beta"),
                    normalizedEmail: "shared@example.com"),
            ])
        let dashboard = self.makeDashboard(email: "shared@example.com")
        let expectedDecision = CodexDashboardAuthority.evaluate(
            CodexCLIDashboardAuthorityContext.makeLiveWebInput(
                dashboard: dashboard,
                context: context,
                routingTargetEmail: "shared@example.com"))

        do {
            _ = try CodexWebDashboardStrategy.makeAuthorizedDashboardResultForTesting(
                dashboard: dashboard,
                context: context,
                routingTargetEmail: "shared@example.com")
            Issue.record("Expected OpenAIWebCodexError.policyRejected")
        } catch let error as OpenAIWebCodexError {
            #expect(error == .policyRejected(expectedDecision))
            if case let .policyRejected(decision) = error {
                #expect(decision.reason == .providerAccountMissingScopedEmail)
            }
        } catch {
            Issue.record("Expected OpenAIWebCodexError.policyRejected, got \(error)")
        }
    }

    @Test
    func `web dashboard attach saves cache with attached email not routing fallback`() throws {
        OpenAIDashboardCacheStore.clear()
        defer { OpenAIDashboardCacheStore.clear() }

        let authHome = try self.makeAuthHome(
            email: "owner@example.com",
            accountId: "acct-owner")
        defer { try? FileManager.default.removeItem(at: authHome) }

        let context = self.makeContext(
            authHome: authHome,
            knownOwners: [
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-owner"),
                    normalizedEmail: "owner@example.com"),
            ])

        _ = try CodexWebDashboardStrategy.makeAuthorizedDashboardResultForTesting(
            dashboard: self.makeDashboard(email: "owner@example.com"),
            context: context,
            routingTargetEmail: "route@example.com")

        let cache = try #require(OpenAIDashboardCacheStore.load())
        #expect(cache.accountEmail == "owner@example.com")
        #expect(cache.accountEmail != "route@example.com")
    }

    @Test
    func `web dashboard fail closed clears stale cache`() throws {
        OpenAIDashboardCacheStore.save(OpenAIDashboardCache(
            accountEmail: "stale@example.com",
            snapshot: self.makeDashboard(email: "stale@example.com")))
        defer { OpenAIDashboardCacheStore.clear() }

        let authHome = try self.makeAuthHome(
            email: "owner@example.com",
            accountId: "acct-owner")
        defer { try? FileManager.default.removeItem(at: authHome) }

        let context = self.makeContext(
            authHome: authHome,
            knownOwners: [
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-other"),
                    normalizedEmail: "owner@example.com"),
            ])

        do {
            _ = try CodexWebDashboardStrategy.makeAuthorizedDashboardResultForTesting(
                dashboard: self.makeDashboard(email: "owner@example.com"),
                context: context,
                routingTargetEmail: "route@example.com")
            Issue.record("Expected OpenAIWebCodexError.policyRejected")
        } catch is OpenAIWebCodexError {}

        #expect(OpenAIDashboardCacheStore.load() == nil)
    }

    @Test
    func `web dashboard display only clears stale cache`() throws {
        OpenAIDashboardCacheStore.save(OpenAIDashboardCache(
            accountEmail: "stale@example.com",
            snapshot: self.makeDashboard(email: "stale@example.com")))
        defer { OpenAIDashboardCacheStore.clear() }

        let authHome = try self.makeAuthHome(email: "shared@example.com")
        defer { try? FileManager.default.removeItem(at: authHome) }

        let context = self.makeContext(
            authHome: authHome,
            knownOwners: [
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-alpha"),
                    normalizedEmail: "shared@example.com"),
                CodexDashboardKnownOwnerCandidate(
                    identity: .providerAccount(id: "acct-beta"),
                    normalizedEmail: "shared@example.com"),
            ])

        do {
            _ = try CodexWebDashboardStrategy.makeAuthorizedDashboardResultForTesting(
                dashboard: self.makeDashboard(email: "shared@example.com"),
                context: context,
                routingTargetEmail: "route@example.com")
            Issue.record("Expected CodexDashboardPolicyError.displayOnly")
        } catch is CodexDashboardPolicyError {}

        #expect(OpenAIDashboardCacheStore.load() == nil)
    }

    private func makeContext(
        authHome: URL? = nil,
        knownOwners: [CodexDashboardKnownOwnerCandidate]) -> ProviderFetchContext
    {
        let env = authHome.map { ["CODEX_HOME": $0.path] } ?? [:]
        let browserDetection = BrowserDetection(cacheTTL: 0)
        return ProviderFetchContext(
            runtime: .cli,
            sourceMode: .auto,
            includeCredits: true,
            webTimeout: 60,
            webDebugDumpHTML: false,
            verbose: false,
            env: env,
            settings: ProviderSettingsSnapshot.make(
                codex: .init(
                    usageDataSource: .auto,
                    cookieSource: .auto,
                    manualCookieHeader: nil,
                    dashboardAuthorityKnownOwners: knownOwners)),
            fetcher: UsageFetcher(environment: env),
            claudeFetcher: ClaudeUsageFetcher(browserDetection: browserDetection),
            browserDetection: browserDetection)
    }

    private func makeDashboard(email: String) -> OpenAIDashboardSnapshot {
        OpenAIDashboardSnapshot(
            signedInEmail: email,
            codeReviewRemainingPercent: 75,
            codeReviewLimit: RateWindow(
                usedPercent: 25,
                windowMinutes: 60,
                resetsAt: Date(timeIntervalSince1970: 3600),
                resetDescription: nil),
            creditEvents: [
                CreditEvent(
                    date: Date(timeIntervalSince1970: 1000),
                    service: "codex",
                    creditsUsed: 3),
            ],
            dailyBreakdown: [],
            usageBreakdown: [],
            creditsPurchaseURL: nil,
            primaryLimit: RateWindow(
                usedPercent: 10,
                windowMinutes: 300,
                resetsAt: Date(timeIntervalSince1970: 7200),
                resetDescription: nil),
            secondaryLimit: nil,
            creditsRemaining: 42,
            accountPlan: "pro",
            updatedAt: Date(timeIntervalSince1970: 2000))
    }

    private func makeDashboardWithoutUsageLimits(email: String) -> OpenAIDashboardSnapshot {
        OpenAIDashboardSnapshot(
            signedInEmail: email,
            codeReviewRemainingPercent: nil,
            creditEvents: [],
            dailyBreakdown: [],
            usageBreakdown: [],
            creditsPurchaseURL: nil,
            primaryLimit: nil,
            secondaryLimit: nil,
            creditsRemaining: 42,
            accountPlan: "pro",
            updatedAt: Date(timeIntervalSince1970: 2000))
    }

    private func makeAuthHome(email: String?, accountId: String? = nil) throws -> URL {
        let homeURL = FileManager.default.temporaryDirectory.appendingPathComponent(
            UUID().uuidString,
            isDirectory: true)
        try self.writeCodexAuthFile(homeURL: homeURL, email: email, accountId: accountId)
        return homeURL
    }

    private func writeCodexAuthFile(
        homeURL: URL,
        email: String?,
        accountId: String?) throws
    {
        try FileManager.default.createDirectory(at: homeURL, withIntermediateDirectories: true)
        var tokens: [String: Any] = [
            "accessToken": "access-token",
            "refreshToken": "refresh-token",
            "idToken": Self.fakeJWT(email: email, accountId: accountId),
        ]
        if let accountId {
            tokens["accountId"] = accountId
        }
        let auth = ["tokens": tokens]
        let data = try JSONSerialization.data(withJSONObject: auth)
        try data.write(to: homeURL.appendingPathComponent("auth.json"))
    }

    private static func fakeJWT(email: String?, accountId: String?) -> String {
        let header = (try? JSONSerialization.data(withJSONObject: ["alg": "none"])) ?? Data()
        var authClaims: [String: Any] = [
            "chatgpt_plan_type": "pro",
        ]
        if let accountId {
            authClaims["chatgpt_account_id"] = accountId
        }
        var claims: [String: Any] = [
            "chatgpt_plan_type": "pro",
            "https://api.openai.com/auth": authClaims,
        ]
        if let email {
            claims["email"] = email
        }
        let payload = (try? JSONSerialization.data(withJSONObject: claims)) ?? Data()

        func base64URL(_ data: Data) -> String {
            data.base64EncodedString()
                .replacingOccurrences(of: "=", with: "")
                .replacingOccurrences(of: "+", with: "-")
                .replacingOccurrences(of: "/", with: "_")
        }

        return "\(base64URL(header)).\(base64URL(payload))."
    }
}