//go:build integration

package integration

import (
	"context"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base32"
	"encoding/binary"
	"errors"
	"fmt"
	"testing"
	"time"

	"github.com/google/uuid"

	"github.com/missionworkforce/missionmatch/internal/modules/auth"
	"github.com/missionworkforce/missionmatch/internal/platform/audit"
	"github.com/missionworkforce/missionmatch/internal/platform/security"
	"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)

// testAuthService builds the auth service against the live app pool with low cost crypto so the suite
// stays fast. The keys are test fixtures, never production secrets.
func testAuthService(t *testing.T) *auth.Service {
	t.Helper()
	pepper, err := security.NewPepper(1, map[int][]byte{1: key32("pepper")})
	if err != nil {
		t.Fatalf("pepper: %v", err)
	}
	hasher, err := security.NewHasher(pepper, 2000)
	if err != nil {
		t.Fatalf("hasher: %v", err)
	}
	tagger, err := security.NewTagger(key32("lookup"))
	if err != nil {
		t.Fatalf("tagger: %v", err)
	}
	svc, err := auth.NewService(auth.Deps{
		DB: appDB, Audit: audit.New(appDB), Hasher: hasher, Tagger: tagger, TOTP: security.TOTP{},
		TOTPKEKs: map[int][]byte{1: key32("kek")}, TOTPKEKActive: 1, TOTPIssuer: "test",
		IdleSeconds: 900, AbsoluteSeconds: 43200, PendingSeconds: 300, InviteSeconds: 3600, CookieSecure: false,
	})
	if err != nil {
		t.Fatalf("auth service: %v", err)
	}
	return svc
}

func key32(seed string) []byte {
	b := make([]byte, 32)
	copy(b, seed)
	return b
}

// provision creates an org + owner + activation token through the migrator definer, like the CLI.
func provision(t *testing.T, email string) (org, owner uuid.UUID, token string) {
	t.Helper()
	tok, hash, err := security.NewSessionToken()
	if err != nil {
		t.Fatalf("token: %v", err)
	}
	slug := "auth-" + uuid.NewString()[:12]
	var inv uuid.UUID
	err = migrator.QueryRow(context.Background(),
		`SELECT organization_id, owner_user_id, invite_id FROM provision_org($1,$2,$3,$4,$5,$6)`,
		"Auth Org", slug, email, "Owner Name", hash, 3600).Scan(&org, &owner, &inv)
	if err != nil {
		t.Fatalf("provision_org: %v", err)
	}
	return org, owner, tok
}

// totpCode computes the current SHA 256 TOTP for a base32 secret, matching the server.
func totpCode(t *testing.T, base32Secret string, at time.Time) string {
	t.Helper()
	secret, err := base32.StdEncoding.WithPadding(base32.NoPadding).DecodeString(base32Secret)
	if err != nil {
		t.Fatalf("decode secret: %v", err)
	}
	counter := uint64(at.Unix() / 30)
	var buf [8]byte
	binary.BigEndian.PutUint64(buf[:], counter)
	mac := hmac.New(sha256.New, secret)
	mac.Write(buf[:])
	sum := mac.Sum(nil)
	off := sum[len(sum)-1] & 0x0f
	bin := (uint32(sum[off])&0x7f)<<24 | uint32(sum[off+1])<<16 | uint32(sum[off+2])<<8 | uint32(sum[off+3])
	return fmt.Sprintf("%06d", bin%1000000)
}

// activateOwner runs the full bootstrap: accept the invite, enroll MFA, activate, and return the
// active session token plus the recovery codes.
func activateOwner(t *testing.T, svc *auth.Service, email, password, token string) (activeToken string, recovery []string) {
	t.Helper()
	ctx := context.Background()
	accepted, err := svc.AcceptInvite(ctx, auth.AcceptInput{Token: token, Password: [credential removed]}, "1.1.1.1", "test")
	if err != nil {
		t.Fatalf("accept invite: %v", err)
	}
	pending := accepted.Token

	// A pre MFA session must NOT resolve to an active tenant principal.
	if _, _, verr := svc.Validate(ctx, pending); !errors.Is(verr, auth.ErrInvalidSession) {
		t.Fatalf("pending session must not validate as active, got %v", verr)
	}

	enroll, err := svc.EnrollMFA(ctx, pending)
	if err != nil {
		t.Fatalf("enroll: %v", err)
	}
	code := totpCode(t, enroll.Secret, time.Now())
	res, err := svc.ActivateMFA(ctx, pending, auth.CodeInput{Code: code}, "1.1.1.1", "test")
	if err != nil {
		t.Fatalf("activate: %v", err)
	}
	if len(res.RecoveryCodes) != 10 {
		t.Fatalf("want 10 recovery codes, got %d", len(res.RecoveryCodes))
	}
	return res.Token, res.RecoveryCodes
}

func TestProvisionLifecycleAndActiveSession(t *testing.T) {
	svc := testAuthService(t)
	email := "owner-" + uuid.NewString()[:8] + "@example.com"
	org, owner, token := provision(t, email)

	activeToken, _ := activateOwner(t, svc, email, "a strong pilot password", token)

	principal, gotOrg, err := svc.Validate(context.Background(), activeToken)
	if err != nil {
		t.Fatalf("validate active: %v", err)
	}
	if gotOrg != org.String() {
		t.Fatalf("org = %s, want %s", gotOrg, org)
	}
	if principal.UserID != owner.String() || principal.Role != "owner" {
		t.Fatalf("principal = %+v, want owner %s", principal, owner)
	}
}

func TestAppRoleCannotProvisionOrg(t *testing.T) {
	// The app role has no organizations INSERT grant and no EXECUTE on provision_org.
	_, err := appDB.Pool.Exec(context.Background(),
		`INSERT INTO organizations (name, slug) VALUES ('rogue','rogue-`+uuid.NewString()[:8]+`')`)
	if pgCode(err) != "42501" {
		t.Fatalf("app INSERT into organizations should be permission denied (42501), got %v", err)
	}
	_, err = appDB.Pool.Exec(context.Background(),
		`SELECT provision_org('rogue','r','e@e.com','n','\x00'::bytea,3600)`)
	if pgCode(err) != "42501" {
		t.Fatalf("app EXECUTE on provision_org should be permission denied (42501), got %v", err)
	}
}

func TestAppRoleCannotReadSecretTables(t *testing.T) {
	// Default deny restored: the app role has no table grants on the secret bearing tables.
	for _, table := range []string{"auth_credentials", "auth_sessions", "mfa_totp", "mfa_recovery_codes", "user_invites"} {
		_, err := appDB.Pool.Exec(context.Background(), "SELECT 1 FROM "+table+" LIMIT 1")
		if pgCode(err) != "42501" {
			t.Fatalf("app SELECT on %s should be permission denied (42501), got %v", table, err)
		}
	}
}

func TestCrossTenantUserDenial(t *testing.T) {
	svc := testAuthService(t)
	emailA := "ownera-" + uuid.NewString()[:8] + "@example.com"
	orgA, ownerA, tokenA := provision(t, emailA)
	activateOwner(t, svc, emailA, "owner a password", tokenA)

	// A separate org B with its own user.
	orgB := seedOrg(t)
	var userB uuid.UUID
	if err := migrator.QueryRow(context.Background(),
		`INSERT INTO users (organization_id, email, full_name, role, status) VALUES ($1,$2,'B User','member','active') RETURNING id`,
		orgB, "userb-"+uuid.NewString()[:8]+"@example.com").Scan(&userB); err != nil {
		t.Fatalf("seed org B user: %v", err)
	}

	// Owner A acts in org A's tenant context and tries to change org B's user. The RLS scoped read of
	// the target returns nothing, so the operation is a not found, never a cross tenant mutation.
	ctxA := tenant.WithUser(tenant.WithOrg(context.Background(), orgA.String()), tenant.Principal{UserID: ownerA.String(), Role: "owner"})
	err := svc.ChangeRole(ctxA, userB.String(), auth.RoleChangeInput{Role: "viewer"}, "1.1.1.1", "test")
	if !errors.Is(err, auth.ErrNotFound) {
		t.Fatalf("cross tenant role change should be ErrNotFound, got %v", err)
	}
}

func TestRecoveryCodeSingleUse(t *testing.T) {
	svc := testAuthService(t)
	email := "rec-" + uuid.NewString()[:8] + "@example.com"
	_, _, token := provision(t, email)
	_, recovery := activateOwner(t, svc, email, "recovery pilot password", token)

	ctx := context.Background()
	// Log in to get a fresh pending session, then recover with a code.
	login, err := svc.Login(ctx, auth.LoginInput{Email: email, Password: "[credential removed] pilot password"}, "1.1.1.1", "test")
	if err != nil {
		t.Fatalf("login: %v", err)
	}
	if !login.MFAEnrolled {
		t.Fatal("login should report MFA enrolled")
	}
	if _, err := svc.RecoverMFA(ctx, login.Token, auth.CodeInput{Code: recovery[0]}, "1.1.1.1", "test"); err != nil {
		t.Fatalf("first recovery should succeed: %v", err)
	}

	// A second use of the same code (fresh pending session) must fail: single use is enforced atomically.
	login2, err := svc.Login(ctx, auth.LoginInput{Email: email, Password: "[credential removed] pilot password"}, "1.1.1.1", "test")
	if err != nil {
		t.Fatalf("login 2: %v", err)
	}
	if _, err := svc.RecoverMFA(ctx, login2.Token, auth.CodeInput{Code: recovery[0]}, "1.1.1.1", "test"); !errors.Is(err, auth.ErrInvalidCredentials) {
		t.Fatalf("reused recovery code must be rejected, got %v", err)
	}
}