package e2e

import (
	"bytes"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"testing"

	"github.com/gin-gonic/gin"

	"galo/internal/app"
	"galo/internal/config"
	"galo/internal/models"
)

// TestAuthProfileFlowOverHTTP drives the whole account lifecycle through the
// real HTTP router: register phone-only, log in, add an email, change the
// password (revoking sessions), and delete the account.
func TestAuthProfileFlowOverHTTP(t *testing.T) {
	st, closeDB := openStack(t, filepath.Join(t.TempDir(), "galo.db"), t.TempDir())
	defer closeDB()

	gin.SetMode(gin.TestMode)
	srv := app.New(&config.Config{}, st.repos, st.db.PingContext, st.tm, st.storage, st.hub)
	router := srv.Router()

	do := func(method, path, token string, body any) *httptest.ResponseRecorder {
		var buf bytes.Buffer
		if body != nil {
			_ = json.NewEncoder(&buf).Encode(body)
		}
		req := httptest.NewRequest(method, path, &buf)
		req.Header.Set("Content-Type", "application/json")
		if token != "" {
			req.Header.Set("Authorization", "Bearer "+token)
		}
		rec := httptest.NewRecorder()
		router.ServeHTTP(rec, req)
		return rec
	}

	type tokens struct {
		AccessToken  string `json:"access_token"`
		RefreshToken string `json:"refresh_token"`
	}
	type authBody struct {
		User   models.SelfUser `json:"user"`
		Tokens tokens          `json:"tokens"`
	}

	phone := "+15550007000"
	// Register with a phone only — no email.
	rec := do(http.MethodPost, "/api/auth/register", "", map[string]string{
		"phone": phone, "password": "password123", "name": "Phone Only",
	})
	if rec.Code != http.StatusCreated {
		t.Fatalf("register status = %d body = %s", rec.Code, rec.Body.String())
	}
	var registered authBody
	if err := json.Unmarshal(rec.Body.Bytes(), &registered); err != nil {
		t.Fatalf("decode register: %v", err)
	}
	if registered.User.Phone != phone || registered.User.Email != "" {
		t.Fatalf("registered user = %+v", registered.User)
	}

	// Log in by phone.
	rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
		"identifier": phone, "password": "password123",
	})
	if rec.Code != http.StatusOK {
		t.Fatalf("login status = %d body = %s", rec.Code, rec.Body.String())
	}
	var logged authBody
	_ = json.Unmarshal(rec.Body.Bytes(), &logged)
	access := logged.Tokens.AccessToken

	// Add the missing email identifier.
	rec = do(http.MethodPost, "/api/auth/me/identifiers", access, map[string]string{
		"email": "phoneonly@test.local",
	})
	if rec.Code != http.StatusOK {
		t.Fatalf("add identifier status = %d body = %s", rec.Code, rec.Body.String())
	}
	var added struct {
		User models.SelfUser `json:"user"`
	}
	_ = json.Unmarshal(rec.Body.Bytes(), &added)
	if added.User.Email != "phoneonly@test.local" {
		t.Fatalf("email not added: %+v", added.User)
	}

	// Change the password, which revokes every refresh token.
	rec = do(http.MethodPost, "/api/auth/me/password", access, map[string]string{
		"current_password": "password123", "new_password": "newpassword",
	})
	if rec.Code != http.StatusNoContent {
		t.Fatalf("change password status = %d body = %s", rec.Code, rec.Body.String())
	}
	rec = do(http.MethodPost, "/api/auth/refresh", "", map[string]string{
		"refresh_token": logged.Tokens.RefreshToken,
	})
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("refresh after password change status = %d, want 401", rec.Code)
	}

	// The new password works; login by the added email.
	rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
		"identifier": "phoneonly@test.local", "password": "newpassword",
	})
	if rec.Code != http.StatusOK {
		t.Fatalf("login with new password status = %d body = %s", rec.Code, rec.Body.String())
	}
	var relogged authBody
	_ = json.Unmarshal(rec.Body.Bytes(), &relogged)

	// Delete the account: it disappears immediately.
	rec = do(http.MethodDelete, "/api/auth/me", relogged.Tokens.AccessToken, map[string]string{
		"password": "newpassword",
	})
	if rec.Code != http.StatusNoContent {
		t.Fatalf("delete status = %d body = %s", rec.Code, rec.Body.String())
	}
	rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
		"identifier": phone, "password": "newpassword",
	})
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("login after delete status = %d, want 401", rec.Code)
	}
}