//go:build test && dev

package payments

import (
	"bytes"
	"context"
	"fmt"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"strings"
	"sync"
	"testing"

	"crussell/db"
	"crussell/internal/square"
	"crussell/testutils"
	"crussell/testutils/fixtures"
	"crussell/testutils/jwt"

	"github.com/go-chi/chi/v5"
	"github.com/stretchr/testify/require"
)

// =============================================================================
// R6: ccof charges must ALWAYS carry a CustomerID; one-off non-save charges
// use the cnon: nonce directly (no card-on-file, no customer).
// =============================================================================

// TestCreateBookingPayment_SavedCard_LegacyNoCustomer_ProvisionsAndCharges
// covers the lazy Square-customer provisioning for saved-card rows that
// predate P14 (square_customer_id empty): the row must be provisioned AND the
// provisioned id persisted on the row BEFORE the ccof: charge goes out.
func TestCreateBookingPayment_SavedCard_LegacyNoCustomer_ProvisionsAndCharges(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	userID, bookingID, userToken := setupPaymentStatusTest(t, ctx, tx, "confirmed")

	cardID, err := fixtures.CreateTestPaymentMethod(tx, userID, "ccof:sq_legacy", "VISA", "4242")
	require.NoError(t, err)
	// Row is seeded with square_customer_id empty (legacy).

	origClient := SquareClient
	rec := &recordingPaymentClient{SquareClient: square.NewDevClient()}
	SquareClient = rec
	defer func() { SquareClient = origClient }()

	req := CreateBookingPaymentRequest{
		Amount:         2500,
		PaymentType:    "deposit",
		CardID:         &cardID,
		IdempotencyKey: "legacy-cust-" + bookingID,
	}
	w := makePaymentRequest(CreateBookingPayment, "POST", "/api/bookings/"+bookingID+"/payment", req, userToken, ctx)
	require.Equal(t, http.StatusOK, w.Code, w.Body.String())

	rec.mu.Lock()
	got := rec.lastReq.CustomerID
	rec.mu.Unlock()
	require.NotEmpty(t, got, "a legacy ccof: charge must be provisioned a Square customer before charging")

	var persisted string
	require.NoError(t, tx.QueryRow(ctx, `SELECT COALESCE(square_customer_id, '') FROM user_saved_cards WHERE id = $1`, cardID).Scan(&persisted))
	require.Equal(t, got, persisted, "the provisioned customer id must be persisted on the saved-card row")
}

// TestCreateBookingPayment_SaveCard_ChargeForwardsCustomerID covers the save
// path of the new-card flow: the ccof: charge MUST carry the same provisioned
// customer id that CreateCardOnFile used.
func TestCreateBookingPayment_SaveCard_ChargeForwardsCustomerID(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	_, bookingID, userToken := setupPaymentStatusTest(t, ctx, tx, "confirmed")

	origClient := SquareClient
	cof := &recordingCardOnFileClient{SquareClient: square.NewDevClient()}
	rec := &recordingPaymentClient{SquareClient: cof}
	SquareClient = rec
	defer func() { SquareClient = origClient }()

	cardToken := "cnon:save-card-nonce"
	req := CreateBookingPaymentRequest{
		Amount:         2500,
		PaymentType:    "deposit",
		NewCardToken:   &cardToken,
		SaveCard:       true,
		IdempotencyKey: "save-charge-cust-" + bookingID,
	}
	w := makePaymentRequest(CreateBookingPayment, "POST", "/api/bookings/"+bookingID+"/payment", req, userToken, ctx)
	require.Equal(t, http.StatusOK, w.Code, w.Body.String())

	require.Equal(t, 1, cof.callCount(), "a save-card flow tokenizes via CreateCardOnFile exactly once")
	require.NotEmpty(t, cof.lastCustomerID(), "a save-card flow must provision a Square customer")

	rec.mu.Lock()
	got := rec.lastReq.CustomerID
	rec.mu.Unlock()
	require.Equal(t, cof.lastCustomerID(), got, "a save-card (ccof:) charge must carry the provisioned customer id")
	require.NotEmpty(t, got)
}

// TestBuyGiftCard_SaveCard_ChargeForwardsCustomerID is the BuyGiftCard
// counterpart of the above: the gift-card purchase's ccof: charge must carry
// the provisioned customer id.
func TestBuyGiftCard_SaveCard_ChargeForwardsCustomerID(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	userID, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	token := jwt.GenerateUserToken(userID)

	origClient := SquareClient
	cof := &recordingCardOnFileClient{SquareClient: square.NewDevClient()}
	rec := &recordingPaymentClient{SquareClient: cof}
	SquareClient = rec
	defer func() { SquareClient = origClient }()

	newToken := "cnon:save-gift-card-nonce"
	req := BuyGiftCardRequest{
		Amount:         1000,
		RecipientType:  "self",
		NewCardToken:   &newToken,
		SaveCard:       true,
		IdempotencyKey: "buy-gc-save-charge-cust",
	}
	w := makePaymentRequest(BuyGiftCard, "POST", "/api/gift-cards/buy", req, token, ctx)
	require.Equal(t, http.StatusCreated, w.Code, w.Body.String())

	require.Equal(t, 1, cof.callCount(), "a save-card flow tokenizes via CreateCardOnFile exactly once")
	rec.mu.Lock()
	got := rec.lastReq.CustomerID
	rec.mu.Unlock()
	require.Equal(t, cof.lastCustomerID(), got, "a save-card (ccof:) gift-card purchase must carry the provisioned customer id")
	require.NotEmpty(t, got)
}

// =============================================================================
// R2: BuyGiftCard requires an idempotency key
// =============================================================================

func TestBuyGiftCard_MissingIdempotencyKey_Rejected(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	userID, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	token := jwt.GenerateUserToken(userID)

	newToken := "cnon:test-card"
	req := BuyGiftCardRequest{
		Amount:        1000,
		RecipientType: "self",
		NewCardToken:  &newToken,
		SaveCard:      false,
	}
	w := makePaymentRequest(BuyGiftCard, "POST", "/api/gift-cards/buy", req, token, ctx)
	require.Equal(t, http.StatusBadRequest, w.Code, "an empty idempotency key must be rejected (R2)")
}

// =============================================================================
// R3: provisional (pre-Square) terminal checkout rows
// =============================================================================

// TestActiveTerminalCheckoutID_ResolvesProvisionalRow covers the crash-window
// guard: a PENDING row with a synthetic "tmp-" checkout_id never had a checkout
// created at Square, so it is provably not live — the guard must mark it failed
// and allow a fresh checkout instead of wedging the booking.
func TestActiveTerminalCheckoutID_ResolvesProvisionalRow(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	_, bookingID, _ := setupTestData(t, ctx, tx)

	provisionalID := "tmp-crash-window-1"
	if _, err := tx.Exec(ctx, `
		INSERT INTO terminal_checkouts (checkout_id, booking_id, payment_type, status, amount)
		VALUES ($1, $2, 'full', 'PENDING', 50.00)
	`, provisionalID, bookingID); err != nil {
		t.Fatalf("failed to seed provisional terminal checkout: %v", err)
	}

	got := activeTerminalCheckoutID(ctx, bookingID)
	require.Equal(t, "", got, "a provisional (pre-Square) row must not block a new checkout")

	var status string
	require.NoError(t, tx.QueryRow(ctx, `SELECT status FROM terminal_checkouts WHERE checkout_id = $1`, provisionalID).Scan(&status))
	require.Equal(t, "failed", status, "the provisional row must be marked failed")
}

// failingGetCheckoutClient errors on every GetCheckout — if the sweep wrongly
// resolves a provisional row against Square, the row is left pending (the error
// is not a terminal checkout state) and the test fails.
type failingGetCheckoutClient struct {
	square.SquareClient
}

func (c *failingGetCheckoutClient) GetCheckout(ctx context.Context, checkoutID string) (*square.PaymentResult, error) {
	return nil, fmt.Errorf("GetCheckout was called for %s — provisional rows must resolve without a Square round-trip", checkoutID)
}

// TestSweepStaleTerminalCheckouts_ResolvesProvisionalRowWithoutSquare proves
// the sweep resolves a stale provisional row to failed without calling Square.
func TestSweepStaleTerminalCheckouts_ResolvesProvisionalRowWithoutSquare(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	userID, bookingID, serviceID := setupTestData(t, ctx, tx)

	provisionalID := "tmp-sweep-provisional-1"
	if _, err := tx.Exec(ctx, `
		INSERT INTO terminal_checkouts (checkout_id, booking_id, payment_type, status, amount, created_at)
		VALUES ($1, $2, 'full', 'PENDING', 50.00, NOW() - INTERVAL '2 hours')
	`, provisionalID, bookingID); err != nil {
		t.Fatalf("failed to seed provisional terminal checkout: %v", err)
	}

	pgxTx := db.TxFromContext(ctx)
	require.NotNil(t, pgxTx)
	require.NoError(t, pgxTx.Commit(ctx))

	t.Cleanup(func() {
		_, _ = db.Conn.Exec(context.Background(), `DELETE FROM terminal_checkouts WHERE checkout_id = $1`, provisionalID)
		_, _ = db.Conn.Exec(context.Background(), `DELETE FROM bookings WHERE id = $1`, bookingID)
		_, _ = db.Conn.Exec(context.Background(), `DELETE FROM services WHERE id = $1`, serviceID)
		_, _ = db.Conn.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, userID)
	})

	freshCtx := context.Background()
	// Drop stale rows left by other sweep tests so the count is deterministic.
	if _, err := db.Conn.Exec(freshCtx, `DELETE FROM terminal_checkouts WHERE status IN ('PENDING', 'IN_PROGRESS') AND checkout_id <> $1`, provisionalID); err != nil {
		t.Fatalf("failed to clean leftover stale terminal checkouts: %v", err)
	}
	if _, err := db.Conn.Exec(freshCtx, `DELETE FROM till_sales WHERE status = 'pending' AND square_checkout_id IS NOT NULL`); err != nil {
		t.Fatalf("failed to clean leftover stale till sales: %v", err)
	}

	origClient := SquareClient
	SquareClient = &failingGetCheckoutClient{SquareClient: square.NewDevClient()}
	defer func() { SquareClient = origClient }()

	n, err := SweepStaleTerminalCheckouts(freshCtx)
	require.NoError(t, err)
	require.Equal(t, 1, n, "the stale provisional terminal checkout must be resolved by the sweep")

	var status string
	require.NoError(t, db.Conn.QueryRow(freshCtx, `SELECT status FROM terminal_checkouts WHERE checkout_id = $1`, provisionalID).Scan(&status))
	require.Equal(t, "failed", status)
}

// =============================================================================
// R5: GetDiscountPreviewHandler ownership (IDOR)
// =============================================================================

// TestGetDiscountPreviewHandler_WrongOwner_Forbidden covers the IDOR fix: a
// non-admin user must not read another user's booking discount preview.
func TestGetDiscountPreviewHandler_WrongOwner_Forbidden(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	_, bookingID, _ := setupDiscountPreviewTest(t, ctx, tx)

	otherUserID, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	otherToken := jwt.GenerateUserToken(otherUserID)

	w := serveDiscountPreviewHandler(bookingID, otherUserID, otherToken, ctx)
	require.Equal(t, http.StatusForbidden, w.Code, "a non-owner must not read another user's discount preview")
}

// TestGetDiscountPreviewHandler_NoUserContext_Unauthorized covers the fail-closed
// 401 for requests that carry no user id.
func TestGetDiscountPreviewHandler_NoUserContext_Unauthorized(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	_, bookingID, _ := setupDiscountPreviewTest(t, ctx, tx)

	req := httptest.NewRequest("GET", "/api/bookings/"+bookingID+"/discount-preview", nil)
	rctx := chi.NewRouteContext()
	rctx.URLParams.Add("id", bookingID)
	req = req.WithContext(ctx)
	req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))

	w := httptest.NewRecorder()
	GetDiscountPreviewHandler(w, req)
	require.Equal(t, http.StatusUnauthorized, w.Code)
}

// =============================================================================
// R8: DeletePaymentMethod disables the Square card before the local soft-delete
// =============================================================================

type deletingCardClient struct {
	square.SquareClient
	mu      sync.Mutex
	deleted []string
}

func (c *deletingCardClient) DeleteCardOnFile(ctx context.Context, cardID string) error {
	c.mu.Lock()
	c.deleted = append(c.deleted, cardID)
	c.mu.Unlock()
	return c.SquareClient.DeleteCardOnFile(ctx, cardID)
}

func (c *deletingCardClient) deletedIDs() []string {
	c.mu.Lock()
	defer c.mu.Unlock()
	return append([]string(nil), c.deleted...)
}

func TestDeletePaymentMethod_DisablesSquareCard(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	userID, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	cardID, err := fixtures.CreateTestPaymentMethod(tx, userID, "ccof:sq_del_disable", "VISA", "9999")
	require.NoError(t, err)

	origClient := SquareClient
	rec := &deletingCardClient{SquareClient: square.NewDevClient()}
	SquareClient = rec
	defer func() { SquareClient = origClient }()

	svc := NewPaymentService()
	require.NoError(t, svc.DeletePaymentMethod(ctx, cardID, userID))

	require.Equal(t, []string{"ccof:sq_del_disable"}, rec.deletedIDs(), "the Square card must be disabled on local delete (R8)")

	var deletedAt string
	require.NoError(t, tx.QueryRow(ctx, `SELECT COALESCE(deleted_at::text, '') FROM user_saved_cards WHERE id = $1`, cardID).Scan(&deletedAt))
	require.NotEqual(t, "", deletedAt, "the card must still be soft-deleted locally")
}

// TestDeletePaymentMethod_SquareFailure_StillDeletesLocally covers the
// best-effort contract: a Square disable failure must never block the local
// soft-delete.
func TestDeletePaymentMethod_SquareFailure_StillDeletesLocally(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	userID, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	cardID, err := fixtures.CreateTestPaymentMethod(tx, userID, "ccof:sq_del_fail", "VISA", "8888")
	require.NoError(t, err)

	origClient := SquareClient
	SquareClient = &failingDeleteClient{SquareClient: square.NewDevClient()}
	defer func() { SquareClient = origClient }()

	svc := NewPaymentService()
	require.NoError(t, svc.DeletePaymentMethod(ctx, cardID, userID))

	var deletedAt string
	require.NoError(t, tx.QueryRow(ctx, `SELECT COALESCE(deleted_at::text, '') FROM user_saved_cards WHERE id = $1`, cardID).Scan(&deletedAt))
	require.NotEqual(t, "", deletedAt, "the local soft-delete must proceed even when the Square call fails")
}

type failingDeleteClient struct {
	square.SquareClient
}

func (c *failingDeleteClient) DeleteCardOnFile(ctx context.Context, cardID string) error {
	return fmt.Errorf("square: network error disabling card %s", cardID)
}

// syncBuffer is a mutex-guarded slog writer so log records can be read safely
// under -race.
type syncBuffer struct {
	mu  sync.Mutex
	buf bytes.Buffer
}

func (b *syncBuffer) Write(p []byte) (int, error) {
	b.mu.Lock()
	defer b.mu.Unlock()
	return b.buf.Write(p)
}

func (b *syncBuffer) String() string {
	b.mu.Lock()
	defer b.mu.Unlock()
	return b.buf.String()
}

// tokenSafeFailingDeleteClient fails with a token-free error so the
// log-redaction test isolates redaction of the square_card_id attribute rather
// than the error string.
type tokenSafeFailingDeleteClient struct {
	square.SquareClient
}

func (c *tokenSafeFailingDeleteClient) DeleteCardOnFile(ctx context.Context, cardID string) error {
	return fmt.Errorf("square: network error disabling card at Square")
}

// TestDeletePaymentMethod_LogsRedactCardToken verifies the local card-delete
// warning logs the redacted tokenPrefix form of the square_card_id (a ccof:
// token), never the full value (SECURITY: full ccof tokens must not reach
// server logs).
func TestDeletePaymentMethod_LogsRedactCardToken(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	userID, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	fullToken := "ccof:secret_token_123456"
	cardID, err := fixtures.CreateTestPaymentMethod(tx, userID, fullToken, "VISA", "9999")
	require.NoError(t, err)

	origClient := SquareClient
	SquareClient = &tokenSafeFailingDeleteClient{SquareClient: square.NewDevClient()}
	defer func() { SquareClient = origClient }()

	var sb syncBuffer
	origLogger := slog.Default()
	slog.SetDefault(slog.New(slog.NewTextHandler(&sb, nil)))
	defer slog.SetDefault(origLogger)

	svc := NewPaymentService()
	require.NoError(t, svc.DeletePaymentMethod(ctx, cardID, userID))

	logs := sb.String()
	if strings.Contains(logs, fullToken) {
		t.Errorf("full ccof token %q leaked into logs: %q", fullToken, logs)
	}
	if !strings.Contains(logs, "ccof:sec...") {
		t.Errorf("expected redacted token prefix in logs, got %q", logs)
	}
}