//go:build integration

package integration

import (
	"context"
	"strings"
	"testing"

	"github.com/google/uuid"
	"github.com/jackc/pgx/v5"

	"github.com/missionworkforce/missionmatch/internal/modules/matching"
	"github.com/missionworkforce/missionmatch/internal/platform/audit"
	"github.com/missionworkforce/missionmatch/internal/platform/database/dbgen"
	"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)

// TestDataFlowPersistsAndReadsAcrossTools is the Workstream E proof that the pipeline persists at each
// stage and each tool reads the others' STORED artifacts rather than recomputing, with no mock data.
// It walks the real flow against Postgres: intake a candidate and a requirement, screenMATCH qualifies
// and persists the evaluation, slateMATCH freezes a slate member, then missionMATCH reads the persisted
// evaluation (who can support) and records the cross tool access. The read not recompute property is
// proven by mutating the candidate AFTER the screen and confirming the rollup still returns the frozen
// stored score, which a rescore would not.
func TestDataFlowPersistsAndReadsAcrossTools(t *testing.T) {
	ctx := context.Background()
	org := seedOrg(t)

	var userID uuid.UUID
	if err := migrator.QueryRow(ctx,
		`INSERT INTO users (organization_id, email, full_name, role, status)
		 VALUES ($1, $2, 'Flow Reviewer', 'owner', 'active') RETURNING id`,
		org, "flow-"+org.String()[:8]+"@example.com").Scan(&userID); err != nil {
		t.Fatalf("seed user: %v", err)
	}
	userCtx := tenant.WithUser(tenant.WithOrg(ctx, org.String()), tenant.Principal{UserID: userID.String(), Role: "owner"})

	// Stage 1, intake: a requirement and a candidate enter shared Postgres.
	req, err := dbgen.New(migrator).CreateRequirement(ctx, dbgen.CreateRequirementParams{
		OrganizationID: org, Title: "Pipeline Role", RequiredLevel: "secret", RequiredPoly: "none", RequiredYears: 5,
	})
	if err != nil {
		t.Fatalf("seed requirement: %v", err)
	}
	cand := seedCandidate(t, org, "secret", "active", true)
	if _, err := migrator.Exec(ctx, "UPDATE candidates SET years_experience=10 WHERE id=$1", cand.ID); err != nil {
		t.Fatalf("enrich candidate: %v", err)
	}

	svc := matching.NewService(appDB, nil, audit.New(appDB))

	// Stage 2, screenMATCH: qualify and PERSIST the evaluation (100.00 Green).
	mr, err := svc.ScreenCandidate(userCtx, cand.ID, req.ID)
	if err != nil {
		t.Fatalf("ScreenCandidate: %v", err)
	}
	if mr.Total.StringFixed(2) != "100.00" {
		t.Fatalf("screen total = %s, want 100.00", mr.Total.StringFixed(2))
	}
	assertOneRow(t, org, "candidate_evaluations", "candidate_id=$2 AND requirement_id=$3", cand.ID, req.ID)

	// Stage 3, slateMATCH: freeze the candidate onto a slate; the member score is persisted.
	slate, err := svc.GenerateSlate(userCtx, matching.GenerateSlateInput{RequirementID: req.ID, Name: "Pipeline Slate"})
	if err != nil {
		t.Fatalf("GenerateSlate: %v", err)
	}
	assertOneRow(t, org, "slate_members", "slate_id=$2 AND candidate_id=$3", slate.SlateID, cand.ID)
	// The slate path must NOT write an evaluation: there is still exactly one candidate_evaluations row
	// (the screen's), so the two stored artifacts stay distinct and WhoCanSupport keeps reading the screen.
	assertOneRow(t, org, "candidate_evaluations", "candidate_id=$2 AND requirement_id=$3", cand.ID, req.ID)

	// Stage 4, missionMATCH: read the STORED evaluation (no rescore) and record the cross tool access.
	support, err := svc.WhoCanSupport(userCtx, req.ID)
	if err != nil {
		t.Fatalf("WhoCanSupport: %v", err)
	}
	if len(support) != 1 || support[0].Total != "100.00" {
		t.Fatalf("rollup = %+v, want one supporter at 100.00 from the stored evaluation", support)
	}
	// The cross tool access is recorded, scoped to the requirement, and carries the reader and source but
	// NO candidate PII or score: assert the payload, not merely that an event exists.
	var payload, entityID string
	if err := appDB.RunInTenantTx(ctxOrg(org), func(ctx context.Context, tx pgx.Tx) error {
		return tx.QueryRow(ctx,
			`SELECT new_values::text, entity_id FROM audit_logs
			 WHERE organization_id=$1 AND action='aedt.cross_tool.read' ORDER BY created_at DESC LIMIT 1`,
			org).Scan(&payload, &entityID)
	}); err != nil {
		t.Fatalf("read cross tool audit: %v", err)
	}
	if entityID != req.ID.String() {
		t.Fatalf("cross tool event entity = %s, want the requirement %s", entityID, req.ID)
	}
	for _, want := range []string{"missionMATCH", "screenMATCH.evaluations", req.ID.String(), "count"} {
		if !strings.Contains(payload, want) {
			t.Fatalf("cross tool payload missing %q: %s", want, payload)
		}
	}
	if strings.Contains(payload, cand.ID.String()) {
		t.Fatalf("cross tool audit payload leaked the candidate id (PII): %s", payload)
	}

	// Stage 5, read not recompute: downgrade the candidate's clearance AFTER the screen. A rescore would
	// now score clearance 0 (total 75); the rollup must still return the frozen stored 100.00 because it
	// READS the persisted artifact.
	if _, err := migrator.Exec(ctx, "UPDATE candidates SET clearance_level='none' WHERE id=$1", cand.ID); err != nil {
		t.Fatalf("downgrade clearance: %v", err)
	}
	support2, err := svc.WhoCanSupport(userCtx, req.ID)
	if err != nil {
		t.Fatalf("WhoCanSupport (after downgrade): %v", err)
	}
	if len(support2) != 1 || support2[0].Total != "100.00" {
		t.Fatalf("rollup after downgrade = %+v, want the STORED 100.00 (a recompute would be 75.00)", support2)
	}
}

func assertOneRow(t *testing.T, org uuid.UUID, table, where string, args ...any) {
	t.Helper()
	if n := countRows(t, org, table, where, args...); n != 1 {
		t.Fatalf("%s: want exactly 1 row, got %d", table, n)
	}
}

func countRows(t *testing.T, org uuid.UUID, table, where string, args ...any) int {
	t.Helper()
	var n int
	full := "SELECT count(*) FROM " + table + " WHERE organization_id=$1 AND " + where
	qargs := append([]any{org}, args...)
	if err := appDB.RunInTenantTx(ctxOrg(org), func(ctx context.Context, tx pgx.Tx) error {
		return tx.QueryRow(ctx, full, qargs...).Scan(&n)
	}); err != nil {
		t.Fatalf("count %s: %v", table, err)
	}
	return n
}