package packs

import (
	"context"
	"regexp"
	"strings"
	"testing"

	"github.com/DATA-DOG/go-sqlmock"
)

// TestWebhookSecret_InstallRoundTripViaPack verifies that applying a
// webhookSecretComponent writes the expected row to _System_WebhookSecret,
// and that LiveProjection reads back the same data that ExpectedProjection declares.
//
// This test uses sqlmock to simulate the DB layer so it runs without a live TiDB
// instance (no //go:build integration tag required). The projection equality check
// mirrors the default verifyPackComponentDefault logic.
func TestWebhookSecret_InstallRoundTripViaPack(t *testing.T) {
	db, mock, err := sqlmock.New()
	if err != nil {
		t.Fatalf("sqlmock.New: %v", err)
	}
	defer db.Close()

	packName := "my-pack"
	defName := "order-events"
	algorithm := "HMAC-SHA256"
	description := "Order event webhook"

	comp, err := NewWebhookSecretComponent(packName, webhookSecretDefinition{
		Name:        defName,
		Algorithm:   algorithm,
		Description: &description,
	})
	if err != nil {
		t.Fatalf("NewWebhookSecretComponent: %v", err)
	}

	// Apply: expect an INSERT (upsert) into _System_WebhookSecret.
	mock.ExpectExec(regexp.QuoteMeta("INSERT INTO _System_WebhookSecret")).
		WillReturnResult(sqlmock.NewResult(1, 1))

	deps := ApplyDeps{DB: db}
	if err := comp.Apply(context.Background(), deps); err != nil {
		t.Fatalf("Apply: %v", err)
	}

	// Verify that LiveProjection matches ExpectedProjection.
	// Simulate the SELECT from _System_WebhookSecret.
	mock.ExpectQuery(regexp.QuoteMeta("SELECT OwnerPack, Name, Algorithm, Description")).
		WithArgs(packName, defName).
		WillReturnRows(sqlmock.NewRows([]string{"OwnerPack", "Name", "Algorithm", "Description"}).
			AddRow(packName, defName, algorithm, description))

	expected, err := comp.ExpectedProjection()
	if err != nil {
		t.Fatalf("ExpectedProjection: %v", err)
	}
	live, err := comp.LiveProjection(context.Background(), VerifyDeps{DB: db})
	if err != nil {
		t.Fatalf("LiveProjection: %v", err)
	}

	// Deep equality check mirrors verifyPackComponentDefault.
	expectedRow := expected.(webhookSecretProjectionRow)
	liveRow := live.(webhookSecretProjectionRow)

	if expectedRow.OwnerPack != liveRow.OwnerPack {
		t.Errorf("OwnerPack: expected %q, got %q", expectedRow.OwnerPack, liveRow.OwnerPack)
	}
	if expectedRow.Name != liveRow.Name {
		t.Errorf("Name: expected %q, got %q", expectedRow.Name, liveRow.Name)
	}
	if expectedRow.Algorithm != liveRow.Algorithm {
		t.Errorf("Algorithm: expected %q, got %q", expectedRow.Algorithm, liveRow.Algorithm)
	}
	if expectedRow.Description != nil && liveRow.Description != nil {
		if *expectedRow.Description != *liveRow.Description {
			t.Errorf("Description: expected %q, got %q", *expectedRow.Description, *liveRow.Description)
		}
	}

	if err := mock.ExpectationsWereMet(); err != nil {
		t.Fatalf("unmet sql expectations: %v", err)
	}
}

// TestWebhookSecretAdmin_RotateUpdatesValue_PayloadHashUnchanged is the
// PayloadHash invariance test (highest-value test per design.md).
//
// Proof strategy:
//  1. Build a pack with one webhookSecretComponent.
//  2. Compute PackPayloadHash → hashBefore.
//  3. Use sqlmock to simulate the rotate write to _System_WebhookSecretValue
//     via a direct ExecContext (the same INSERT ... ON DUPLICATE KEY UPDATE SQL
//     that webhook_secret_admin.go:RotateSecret executes). Verify the mock
//     expectation was met — this proves the value-table write is part of the
//     test trace.
//  4. Compute PackPayloadHash on the same pack → hashAfter.
//  5. Assert hashBefore == hashAfter.
//
// The design property under test: _System_WebhookSecretValue is structurally
// outside the component's hash inputs (PayloadHash covers component
// definitions — name/algorithm/description — not runtime secret values), so
// a value-table write cannot affect the hash.
func TestWebhookSecretAdmin_RotateUpdatesValue_PayloadHashUnchanged(t *testing.T) {
	packName := "my-pack"
	description := "Order events"
	comp, err := NewWebhookSecretComponent(packName, webhookSecretDefinition{
		Name:        "order-events",
		Algorithm:   "HMAC-SHA256",
		Description: &description,
	})
	if err != nil {
		t.Fatalf("NewWebhookSecretComponent: %v", err)
	}

	// Build a minimal in-memory pack for hash computation.
	pack := &testWebhookPack{name: packName, components: []PackComponent{comp}}

	// Step 2: hash before the rotate write.
	hashBefore, err := PackPayloadHash(pack)
	if err != nil {
		t.Fatalf("PackPayloadHash before rotate: %v", err)
	}

	// Step 3: simulate the rotate write to _System_WebhookSecretValue.
	// This mirrors the exact SQL issued by WebhookSecretAdminService.RotateConnectorWebhookSecret.
	// The mock expectation verifies the write actually fires during this test.
	db, mock, err := sqlmock.New()
	if err != nil {
		t.Fatalf("sqlmock.New: %v", err)
	}
	defer db.Close()

	mock.ExpectExec(regexp.QuoteMeta("INSERT INTO _System_WebhookSecretValue")).
		WillReturnResult(sqlmock.NewResult(1, 1))

	_, err = db.ExecContext(
		context.Background(),
		`INSERT INTO _System_WebhookSecretValue
  (Id, WebhookSecretId, SecretValue, IsActive, RotatedAt, CreatedDate, LastModifiedDate)
VALUES (?, ?, ?, 1, NOW(), NOW(), NOW())
ON DUPLICATE KEY UPDATE
  SecretValue = VALUES(SecretValue),
  IsActive = 1,
  RotatedAt = VALUES(RotatedAt),
  LastModifiedDate = NOW()`,
		"val-id-001", "def-id-001", "newsecretvalue",
	)
	if err != nil {
		t.Fatalf("rotate ExecContext: %v", err)
	}
	if err := mock.ExpectationsWereMet(); err != nil {
		t.Fatalf("rotate write expectation not met: %v", err)
	}

	// Step 4: hash after the rotate write — same in-memory pack components.
	hashAfter, err := PackPayloadHash(pack)
	if err != nil {
		t.Fatalf("PackPayloadHash after rotate: %v", err)
	}

	// Step 5: the value-table write must not change the component hash.
	if hashBefore != hashAfter {
		t.Errorf("PayloadHash changed after rotate:\n  before=%q\n  after=%q", hashBefore, hashAfter)
	}
}

// TestUpsertWebhookSecretDefinition_NormalizesNameToLowercase verifies that
// upsertWebhookSecretDefinition passes a lowercase Name to the SQL INSERT,
// regardless of the case present in the incoming definition.
func TestUpsertWebhookSecretDefinition_NormalizesNameToLowercase(t *testing.T) {
	db, mock, err := sqlmock.New()
	if err != nil {
		t.Fatalf("sqlmock.New: %v", err)
	}
	defer db.Close()

	def := webhookSecretDefinition{
		Name:      "Events", // mixed case — should be stored as "events"
		Algorithm: "HMAC-SHA256",
	}

	// Expect the exec with normalized lowercase Name arg (3rd positional arg after Id, OwnerPack).
	mock.ExpectExec(regexp.QuoteMeta("INSERT INTO _System_WebhookSecret")).
		WithArgs(sqlmock.AnyArg(), "my-pack", "events", "HMAC-SHA256", nil).
		WillReturnResult(sqlmock.NewResult(1, 1))

	if err := upsertWebhookSecretDefinition(context.Background(), db, "my-pack", def); err != nil {
		t.Fatalf("upsertWebhookSecretDefinition: %v", err)
	}
	if err := mock.ExpectationsWereMet(); err != nil {
		t.Fatalf("unmet sql expectations: %v", err)
	}
}

// TestUpsertWebhookSecretDefinition_CaseOnlyRenameConverges verifies that the
// ON DUPLICATE KEY UPDATE clause includes Name = VALUES(Name) so that a case-only
// manifest rename (e.g. "events" → "Events") converges the stored row to the new
// canonical lowercase form on the second upsert rather than leaving a stale value.
func TestUpsertWebhookSecretDefinition_CaseOnlyRenameConverges(t *testing.T) {
	db, mock, err := sqlmock.New()
	if err != nil {
		t.Fatalf("sqlmock.New: %v", err)
	}
	defer db.Close()

	// First upsert: name="events" (fresh insert).
	mock.ExpectExec(regexp.QuoteMeta("INSERT INTO _System_WebhookSecret")).
		WithArgs(sqlmock.AnyArg(), "my-pack", "events", "HMAC-SHA256", nil).
		WillReturnResult(sqlmock.NewResult(1, 1))

	def1 := webhookSecretDefinition{Name: "events", Algorithm: "HMAC-SHA256"}
	if err := upsertWebhookSecretDefinition(context.Background(), db, "my-pack", def1); err != nil {
		t.Fatalf("first upsert: %v", err)
	}

	// Second upsert: name="Events" (case-only rename in manifest) → stored as "events".
	// ON DUPLICATE KEY UPDATE must include Name = VALUES(Name) for convergence.
	mock.ExpectExec(regexp.QuoteMeta("Name = VALUES(Name)")).
		WithArgs(sqlmock.AnyArg(), "my-pack", "events", "HMAC-SHA256", nil).
		WillReturnResult(sqlmock.NewResult(1, 1))

	def2 := webhookSecretDefinition{Name: "Events", Algorithm: "HMAC-SHA256"}
	if err := upsertWebhookSecretDefinition(context.Background(), db, "my-pack", def2); err != nil {
		t.Fatalf("second upsert: %v", err)
	}
	if err := mock.ExpectationsWereMet(); err != nil {
		t.Fatalf("unmet sql expectations: %v", err)
	}
}

// TestNewWebhookSecretComponent_NormalizesInputs verifies that
// NewWebhookSecretComponent stores normalized (lowercase + trimmed) values for
// both packName and def.Name, so that ExpectedProjection and BusinessKey always
// emit canonical lowercase identifiers regardless of the caller's casing.
func TestNewWebhookSecretComponent_NormalizesInputs(t *testing.T) {
	comp, err := NewWebhookSecretComponent("My-Pack", webhookSecretDefinition{
		Name:      "Events", // mixed case
		Algorithm: "HMAC-SHA256",
	})
	if err != nil {
		t.Fatalf("NewWebhookSecretComponent: %v", err)
	}

	proj, err := comp.ExpectedProjection()
	if err != nil {
		t.Fatalf("ExpectedProjection: %v", err)
	}
	row := proj.(webhookSecretProjectionRow)
	if row.Name != "events" {
		t.Errorf("ExpectedProjection.Name = %q, want %q", row.Name, "events")
	}
	if row.OwnerPack != "my-pack" {
		t.Errorf("ExpectedProjection.OwnerPack = %q, want %q", row.OwnerPack, "my-pack")
	}

	bk := comp.BusinessKey()
	if !strings.HasSuffix(bk, "/events") {
		t.Errorf("BusinessKey() = %q, want suffix %q", bk, "/events")
	}
	if !strings.HasPrefix(bk, "my-pack/") {
		t.Errorf("BusinessKey() = %q, want prefix %q", bk, "my-pack/")
	}
}

// testWebhookPack is a minimal in-memory Pack implementation for hash tests.
// It implements Pack, ComposablePack, and PayloadHasher so PackPayloadHash works.
type testWebhookPack struct {
	name       string
	components []PackComponent
}

func (p *testWebhookPack) Name() string                               { return p.name }
func (p *testWebhookPack) Category() Category                         { return ConnectorPack }
func (p *testWebhookPack) Apply(_ context.Context, _ ApplyDeps) error { return nil }
func (p *testWebhookPack) Verify(_ context.Context, _ VerifyDeps) error {
	return nil
}
func (p *testWebhookPack) Components() []PackComponent {
	return append([]PackComponent(nil), p.components...)
}
func (p *testWebhookPack) PayloadHash() (string, error) {
	return packComponentsPayloadHashV1(p, p.components)
}