package auth

import (
	"context"
	"fmt"
	"os"
	"testing"
	"time"

	"github.com/veypi/vbase/cfg"
	"github.com/veypi/vbase/models"
)

// setupTestDB 初始化测试数据库
func setupTestDB() {
	// 使用 SQLite 内存模式
	cfg.Config.DB = "sqlite"
	cfg.Config.DSN = fmt.Sprintf("file::memory:?cache=shared&_time=%d", time.Now().UnixNano())

	// 初始化数据库表
	if err := models.AllModels.AutoMigrate(cfg.DB()); err != nil {
		panic(err)
	}
}

// TestMain 负责测试环境的全局初始化
func TestMain(m *testing.M) {
	setupTestDB()
	code := m.Run()
	os.Exit(code)
}

func getTestAuth() Auth {
	// 每次获取一个新的实例名，避免测试间冲突（虽然内存库是共享的，但数据清理可能不完全）
	// 为了简单起见，我们在 TestMain 中只初始化一次 DB，但可以通过应用名区分
	appKey := fmt.Sprintf("test_app_%d", time.Now().UnixNano())

	a := Factory.New(appKey, models.AppConfig{
		Name: "Test App",
		DefaultRoles: []models.RoleDefinition{
			{
				Code:     "admin",
				Name:     "Administrator",
				Policies: []string{"*:*"},
			},
			{
				Code: "editor",
				Name: "Editor",
				Policies: []string{
					"article:create",
					"article:read",
					"article:update",
				},
			},
			{
				Code: "viewer",
				Name: "Viewer",
				Policies: []string{
					"article:read",
				},
			},
			{
				Code: "deleter",
				Name: "Deleter",
				Policies: []string{
					"article:delete",
				},
			},
		},
	})

	// 初始化
	if err := a.(*appAuth).init(); err != nil {
		panic(err)
	}

	return a
}

// TestBasicPermission 测试基础权限授予与检查
func TestBasicPermission(t *testing.T) {
	a := getTestAuth()
	ctx := context.Background()
	userID := "user_basic_001"

	// 初始状态应该无权限
	ok, err := a.CheckPermission(ctx, userID, "", "article:read", "")
	if err != nil {
		t.Fatalf("CheckPermission failed: %v", err)
	}
	if ok {
		t.Error("Expected no permission initially")
	}

	// 授予 viewer 角色
	if err := a.GrantRole(ctx, userID, "", "viewer"); err != nil {
		t.Fatalf("GrantRole failed: %v", err)
	}

	// 应该有 article:read 权限
	ok, err = a.CheckPermission(ctx, userID, "", "article:read", "")
	if err != nil {
		t.Fatalf("CheckPermission failed: %v", err)
	}
	if !ok {
		t.Error("Expected article:read permission after granting viewer role")
	}

	// 不应该有 article:create 权限
	ok, err = a.CheckPermission(ctx, userID, "", "article:create", "")
	if err != nil {
		t.Fatalf("CheckPermission failed: %v", err)
	}
	if ok {
		t.Error("Expected no article:create permission for viewer")
	}
}

// TestWildcardPermission 测试通配符权限
func TestWildcardPermission(t *testing.T) {
	a := getTestAuth()
	ctx := context.Background()
	userID := "user_admin_001"

	// 授予 admin 角色 (*:*)
	if err := a.GrantRole(ctx, userID, "", "admin"); err != nil {
		t.Fatalf("GrantRole failed: %v", err)
	}

	// 应该拥有所有权限
	tests := []string{
		"article:read",
		"article:delete",
		"user:create",
		"config:update", // system:config:update 会被解析为 system 应用的权限，而 admin 是 test_app 的 admin
	}

	for _, perm := range tests {
		ok, err := a.CheckPermission(ctx, userID, "", perm, "")
		if err != nil {
			t.Errorf("CheckPermission %s failed: %v", perm, err)
			continue
		}
		if !ok {
			t.Errorf("Expected permission %s for admin", perm)
		}
	}
}

// TestStrictPermissionIsolation 验证权限严格隔离性 (用户请求场景)
// 验证：拥有 delete 权限的用户，是否能通过 read 权限检查
func TestStrictPermissionIsolation(t *testing.T) {
	a := getTestAuth()
	ctx := context.Background()
	userID := "user_deleter_001"

	// 授予 deleter 角色 (只包含 article:delete)
	if err := a.GrantRole(ctx, userID, "", "deleter"); err != nil {
		t.Fatalf("GrantRole failed: %v", err)
	}

	// 1. 检查 article:delete (应该通过)
	ok, err := a.CheckPermission(ctx, userID, "", "article:delete", "")
	if err != nil {
		t.Fatalf("CheckPermission error: %v", err)
	}
	if !ok {
		t.Errorf("Expected user to have article:delete permission")
	}

	// 2. 检查 article:read (应该失败)
	// 关键验证点：delete 不包含 read
	ok, err = a.CheckPermission(ctx, userID, "", "article:read", "")
	if err != nil {
		t.Fatalf("CheckPermission error: %v", err)
	}
	if ok {
		t.Errorf("Strict isolation failed: User with 'article:delete' passed 'article:read' check")
	}
}

// TestOrgIsolation 测试多租户/组织隔离
func TestOrgIsolation(t *testing.T) {
	a := getTestAuth()
	ctx := context.Background()
	userID := "user_org_001"
	orgA := "org_a"
	orgB := "org_b"

	// 在 OrgA 中授予 editor 角色
	if err := a.GrantRole(ctx, userID, orgA, "editor"); err != nil {
		t.Fatalf("GrantRole failed: %v", err)
	}

	// 在 OrgA 上下文中检查 article:create (应该通过)
	ok, err := a.CheckPermission(ctx, userID, orgA, "article:create", "")
	if err != nil {
		t.Fatalf("CheckPermission failed: %v", err)
	}
	if !ok {
		t.Error("Expected permission in OrgA")
	}

	// 在 OrgB 上下文中检查 article:create (应该失败)
	ok, err = a.CheckPermission(ctx, userID, orgB, "article:create", "")
	if err != nil {
		t.Fatalf("CheckPermission failed: %v", err)
	}
	if ok {
		t.Error("Expected no permission in OrgB (role was granted in OrgA)")
	}

	// 在全局上下文中检查 (应该失败，因为角色绑定在 OrgA)
	ok, err = a.CheckPermission(ctx, userID, "", "article:create", "")
	if err != nil {
		t.Fatalf("CheckPermission failed: %v", err)
	}
	if ok {
		t.Error("Expected no global permission")
	}
}

// TestResourcePermission 测试特定资源权限
func TestResourcePermission(t *testing.T) {
	a := getTestAuth()
	ctx := context.Background()
	userID := "user_res_001"
	resID := "doc_123"

	// 需要先创建权限定义，因为 GrantResourcePerm 会检查权限是否存在
	permID := fmt.Sprintf("%s:doc:read", a.(*appAuth).appKey)
	perm := models.Permission{
		ID:          permID,
		AppKey:      a.(*appAuth).appKey,
		Resource:    "doc",
		Action:      "read",
		Description: "Read Doc",
	}
	if err := cfg.DB().Create(&perm).Error; err != nil {
		t.Fatalf("Failed to create permission: %v", err)
	}

	// 初始无权限
	ok, err := a.CheckPermission(ctx, userID, "", "doc:read", resID)
	if err != nil {
		t.Fatalf("CheckPermission failed: %v", err)
	}
	if ok {
		t.Error("Expected no permission")
	}

	// 授予对特定资源 doc_123 的 doc:read 权限
	if err := a.GrantResourcePerm(ctx, userID, "", "doc:read", resID); err != nil {
		t.Fatalf("GrantResourcePerm failed: %v", err)
	}

	// 检查 doc:read on doc_123 (应该通过)
	ok, err = a.CheckPermission(ctx, userID, "", "doc:read", resID)
	if err != nil {
		t.Fatalf("CheckPermission failed: %v", err)
	}
	if !ok {
		t.Error("Expected permission on specific resource")
	}

	// 检查 doc:read on doc_456 (应该失败)
	ok, err = a.CheckPermission(ctx, userID, "", "doc:read", "doc_456")
	if err != nil {
		t.Fatalf("CheckPermission failed: %v", err)
	}
	if ok {
		t.Error("Expected no permission on other resource")
	}
}