import base64
import hashlib
import hmac
import json
from unittest.mock import Mock

import pytest

from pingcap_datapipelines.feishu_alerts import (
    DeliveryError,
    decode_event,
    message_text,
    relay,
    send_message,
    signature,
)


def envelope(state="open", job="pingcap-nexuscrm-extract"):
    event = {
        "incident": {
            "incident_id": "incident-test",
            "policy_name": "pingcap-datapipelines job failure",
            "state": state,
            "started_at": 1788850000,
            "summary": "secret material must never be forwarded",
            "resource": {
                "type": "cloud_run_job",
                "labels": {"project_id": "gcp-digital-bi", "job_name": job, "location": "us-west2"},
            },
        }
    }
    return {"message": {"data": base64.b64encode(json.dumps(event).encode()).decode()}}


def test_signature_uses_timestamp_and_secret_as_key_with_empty_message():
    expected = base64.b64encode(hmac.digest(b"123\nfake-signing-key", b"", hashlib.sha256)).decode()
    assert signature("123", "fake-signing-key") == expected


def test_sender_includes_signature_and_accepts_only_application_success(monkeypatch):
    post = Mock(return_value=Mock(status_code=200, json=lambda: {"code": 0}))
    monkeypatch.setattr("pingcap_datapipelines.feishu_alerts.httpx.post", post)
    monkeypatch.setattr("pingcap_datapipelines.feishu_alerts.time.time", lambda: 123)
    send_message("test", "https://open.feishu.cn/open-apis/bot/v2/hook/fake-hook", "fake-key")
    payload = post.call_args.kwargs["json"]
    assert payload["timestamp"] == "123"
    assert payload["sign"] == signature("123", "fake-key")
    assert post.call_args.kwargs["follow_redirects"] is False


@pytest.mark.parametrize("body", [{"code": 19021}, {}, {"code": "0"}, [], {"StatusCode": 1}])
def test_http_200_is_not_feishu_delivery_success(monkeypatch, body):
    monkeypatch.setattr(
        "pingcap_datapipelines.feishu_alerts.httpx.post", Mock(return_value=Mock(status_code=200, json=lambda: body))
    )
    with pytest.raises(DeliveryError):
        send_message("test", "https://open.feishu.cn/open-apis/bot/v2/hook/fake-hook", "fake-key")


def test_network_error_never_leaks_hook_or_signing_material(monkeypatch):
    monkeypatch.setattr(
        "pingcap_datapipelines.feishu_alerts.httpx.post", Mock(side_effect=RuntimeError("fake-hook fake-key"))
    )
    with pytest.raises(DeliveryError, match="^feishu_request_failed$"):
        send_message("test", "https://open.feishu.cn/open-apis/bot/v2/hook/fake-hook", "fake-key")


def test_payload_is_allowlisted_and_has_debug_links():
    event = decode_event(envelope(), "gcp-digital-bi")
    text = message_text(event, "gcp-digital-bi")
    assert "secret material" not in text
    assert "告警开始时间（UTC）" in text
    assert "pingcap-nexuscrm-extract" in text and "console.cloud.google.com/logs" in text
    with pytest.raises(ValueError, match="unexpected_project"):
        decode_event(envelope(), "wrong-project")


def test_success_persists_receipt_and_redelivery_does_not_send_twice():
    bucket = Mock()
    bucket.blob.return_value.exists.return_value = False
    sender = Mock()
    args = dict(project="gcp-digital-bi", bucket=bucket, webhook="fake-hook", secret="fake-key", sender=sender)
    assert relay(envelope(), **args)["event"] == "feishu_alert_sent"
    bucket.blob.return_value.upload_from_string.assert_called_once()
    receipt = bucket.blob.return_value.upload_from_string.call_args.args[0]
    assert "fake-key" not in receipt and "fake-hook" not in receipt
    bucket.blob.return_value.exists.return_value = True
    assert relay(envelope(), **args)["event"] == "alert_duplicate"
    sender.assert_called_once()


def test_failed_delivery_cannot_be_recorded_or_acknowledged_as_success():
    bucket = Mock()
    bucket.blob.return_value.exists.return_value = False
    with pytest.raises(DeliveryError):
        relay(
            envelope(),
            project="gcp-digital-bi",
            bucket=bucket,
            webhook="x",
            secret="y",
            sender=Mock(side_effect=DeliveryError("rejected")),
        )
    bucket.blob.return_value.upload_from_string.assert_not_called()


def test_closed_metric_window_is_not_sent_as_business_recovery():
    sender = Mock()
    assert (
        relay(envelope("closed"), project="gcp-digital-bi", bucket=Mock(), webhook="x", secret="y", sender=sender)[
            "event"
        ]
        == "alert_ignored"
    )
    sender.assert_not_called()


def test_real_smoke_failure_is_clearly_labelled_as_test():
    event = decode_event(envelope(job="pingcap-alert-smoke-20260908"), "gcp-digital-bi")
    assert "【测试告警】" in message_text(event, "gcp-digital-bi")