package handler

import (
	"baron-sso-backend/internal/domain"
	"baron-sso-backend/internal/service"
	"bytes"
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gofiber/fiber/v2"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/mock"
)

type MockRPService struct {
	mock.Mock
}

func (m *MockRPService) Create(ctx context.Context, tenantID string, client domain.HydraClient) (*domain.RelyingParty, error) {
	args := m.Called(ctx, tenantID, client)
	return args.Get(0).(*domain.RelyingParty), args.Error(1)
}

func (m *MockRPService) Get(ctx context.Context, clientID string) (*domain.RelyingParty, *domain.HydraClient, error) {
	args := m.Called(ctx, clientID)
	return args.Get(0).(*domain.RelyingParty), args.Get(1).(*domain.HydraClient), args.Error(2)
}

func (m *MockRPService) List(ctx context.Context, tenantID string) ([]domain.RelyingParty, error) {
	args := m.Called(ctx, tenantID)
	return args.Get(0).([]domain.RelyingParty), args.Error(1)
}

func (m *MockRPService) ListAll(ctx context.Context) ([]domain.RelyingParty, error) {
	args := m.Called(ctx)
	return args.Get(0).([]domain.RelyingParty), args.Error(1)
}

func (m *MockRPService) ListByTenantIDs(ctx context.Context, tenantIDs []string) ([]domain.RelyingParty, error) {
	args := m.Called(ctx, tenantIDs)
	return args.Get(0).([]domain.RelyingParty), args.Error(1)
}

func (m *MockRPService) Update(ctx context.Context, clientID string, client domain.HydraClient) (*domain.RelyingParty, error) {
	args := m.Called(ctx, clientID, client)
	return args.Get(0).(*domain.RelyingParty), args.Error(1)
}

func (m *MockRPService) Delete(ctx context.Context, clientID string) error {
	args := m.Called(ctx, clientID)
	return args.Error(0)
}

func (m *MockRPService) CheckPermission(ctx context.Context, userID, clientID, relation string) (bool, error) {
	args := m.Called(ctx, userID, clientID, relation)
	return args.Bool(0), args.Error(1)
}

func (m *MockRPService) AddOwner(ctx context.Context, clientID, subject string) error {
	args := m.Called(ctx, clientID, subject)
	return args.Error(0)
}

func (m *MockRPService) RemoveOwner(ctx context.Context, clientID, subject string) error {
	args := m.Called(ctx, clientID, subject)
	return args.Error(0)
}

func (m *MockRPService) ListOwners(ctx context.Context, clientID string) ([]string, error) {
	args := m.Called(ctx, clientID)
	return args.Get(0).([]string), args.Error(1)
}

func withMockProfile(profile *domain.UserProfileResponse) fiber.Handler {
	return func(c *fiber.Ctx) error {
		c.Locals("user_profile", profile)
		return c.Next()
	}
}

func TestListClients_Success(t *testing.T) {
	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
		if r.URL.Path == "/clients" {
			return httpJSONAny(r, http.StatusOK, []map[string]interface{}{
				{"client_id": "client-1", "client_name": "App One", "metadata": map[string]interface{}{"status": "active"}},
				{"client_id": "client-2", "client_name": "App Two", "metadata": map[string]interface{}{"status": "inactive"}},
			}), nil
		}
		return httpJSONAny(r, http.StatusNotFound, map[string]string{"error": "not found"}), nil
	})

	h := &DevHandler{
		Hydra: &service.HydraAdminService{
			AdminURL:   "http://hydra.test",
			HTTPClient: &http.Client{Transport: transport},
		},
	}
	app := fiber.New()
	adminProfile := &domain.UserProfileResponse{
		ID:   "admin-1",
		Role: domain.RoleSuperAdmin,
	}
	app.Get("/api/v1/dev/clients", withMockProfile(adminProfile), h.ListClients)

	req := httptest.NewRequest(http.MethodGet, "/api/v1/dev/clients", nil)
	resp, _ := app.Test(req, -1)

	assert.Equal(t, http.StatusOK, resp.StatusCode)

	var res struct {
		Items []clientSummary `json:"items"`
	}
	json.NewDecoder(resp.Body).Decode(&res)
	assert.Equal(t, 2, len(res.Items))
	assert.Equal(t, "client-1", res.Items[0].ID)
	assert.Equal(t, "App One", res.Items[0].Name)
}

func TestGetClient_Success(t *testing.T) {
	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
		if r.URL.Path == "/clients/client-123" {
			return httpJSONAny(r, http.StatusOK, map[string]interface{}{
				"client_id":   "client-123",
				"client_name": "Test App",
				"metadata":    map[string]interface{}{"status": "active"},
			}), nil
		}
		return httpJSONAny(r, http.StatusNotFound, map[string]string{"error": "not found"}), nil
	})

	h := &DevHandler{
		Hydra: &service.HydraAdminService{
			AdminURL:   "http://hydra.test",
			PublicURL:  "http://hydra-public.test", // PublicURL 추가
			HTTPClient: &http.Client{Transport: transport},
		},
	}
	app := fiber.New()
	adminProfile := &domain.UserProfileResponse{
		ID:   "admin-1",
		Role: domain.RoleSuperAdmin,
	}
	app.Get("/api/v1/dev/clients/:id", withMockProfile(adminProfile), h.GetClient)

	req := httptest.NewRequest(http.MethodGet, "/api/v1/dev/clients/client-123", nil)
	resp, _ := app.Test(req, -1)

	assert.Equal(t, http.StatusOK, resp.StatusCode)

	var res clientDetailResponse
	json.NewDecoder(resp.Body).Decode(&res)
	assert.Equal(t, "client-123", res.Client.ID)
	assert.Equal(t, "Test App", res.Client.Name)
	assert.Equal(t, "http://hydra-public.test/oauth2/auth", res.Endpoints.Authorization)
}

func TestGetClient_NotFound(t *testing.T) {
	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
		return httpJSONAny(r, http.StatusNotFound, map[string]string{"error": "not found"}), nil
	})

	h := &DevHandler{
		Hydra: &service.HydraAdminService{
			AdminURL:   "http://hydra.test",
			HTTPClient: &http.Client{Transport: transport},
		},
	}
	app := fiber.New()
	adminProfile := &domain.UserProfileResponse{
		ID:   "admin-1",
		Role: domain.RoleSuperAdmin,
	}
	app.Get("/api/v1/dev/clients/:id", withMockProfile(adminProfile), h.GetClient)

	req := httptest.NewRequest(http.MethodGet, "/api/v1/dev/clients/non-existent", nil)
	resp, _ := app.Test(req, -1)

	assert.Equal(t, http.StatusNotFound, resp.StatusCode)
}

func TestCreateClient_Success(t *testing.T) {
	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
		if r.Method == http.MethodPost && r.URL.Path == "/clients" {
			return httpJSONAny(r, http.StatusCreated, map[string]interface{}{
				"client_id":     "new-client-123",
				"client_name":   "New App",
				"client_secret": "secret-123",
			}), nil
		}
		if r.Method == http.MethodGet && r.URL.Path == "/clients/new-client-123" {
			return httpJSONAny(r, http.StatusOK, map[string]interface{}{
				"client_id":     "new-client-123",
				"client_name":   "New App",
				"client_secret": "secret-123",
				"metadata":      map[string]interface{}{"status": "active"},
			}), nil
		}
		return httpJSONAny(r, http.StatusInternalServerError, map[string]string{"error": "hydra error path: " + r.URL.Path}), nil
	})

	secretRepo := &mockSecretRepo{secrets: make(map[string]string)}
	redisRepo := &mockRedisRepo{data: make(map[string]string)}
	mockRP := new(MockRPService)

	h := &DevHandler{
		Hydra: &service.HydraAdminService{
			AdminURL:   "http://hydra.test",
			PublicURL:  "http://hydra-public.test",
			HTTPClient: &http.Client{Transport: transport},
		},
		SecretRepo: secretRepo,
		Redis:      redisRepo,
		RPService:  mockRP,
	}
	app := fiber.New()
	adminProfile := &domain.UserProfileResponse{
		ID:   "admin-1",
		Role: domain.RoleSuperAdmin,
	}
	app.Post("/api/v1/dev/clients", withMockProfile(adminProfile), h.CreateClient)

	body, _ := json.Marshal(map[string]interface{}{
		"client_name":  "New App",
		"type":         "confidential",
		"redirectUris": []string{"http://localhost/cb"},
	})

	mockRP.On("Create", mock.Anything, "t1", mock.Anything).Return(&domain.RelyingParty{ClientID: "new-client-123"}, nil)

	req := httptest.NewRequest(http.MethodPost, "/api/v1/dev/clients", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-Tenant-ID", "t1")

	resp, _ := app.Test(req, -1)
	assert.Equal(t, http.StatusCreated, resp.StatusCode)

	secret, _ := secretRepo.GetByID(nil, "new-client-123")
	assert.Equal(t, "secret-123", secret)
}