import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import { fileURLToPath } from "node:url";
import test from "node:test";

import { startPostgresFixture } from "./helpers/postgres-fixture.ts";
import {
  closeLocalPostgresDataPool,
  createLocalPostgresDataClient,
} from "../src/lib/db/local-postgres-client-core.ts";

const runnerPath = fileURLToPath(
  new URL("../scripts/db-migrate.mjs", import.meta.url),
);

function dockerAvailable(): boolean {
  return spawnSync("docker", ["version", "--format", "{{.Server.Version}}"], {
    encoding: "utf8",
    stdio: "ignore",
  }).status === 0;
}

const skipWithoutDocker = dockerAvailable() ? false : "docker unavailable on this host";

const USER_A = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
const USER_B = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
const REPORT_ID = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
const REQUEST_ID = "dddddddd-dddd-4ddd-8ddd-dddddddddddd";
const HASH = "1111111111111111111111111111111111111111111111111111111111111111";
const COMMIT = "2222222222222222222222222222222222222222";

function selectAsAuthenticated(userId: string, sql: string): string {
  return `
    set role authenticated;
    select set_config('request.jwt.claim.sub', '${userId}', true);
    ${sql}
  `;
}

function serviceSql(sql: string): string {
  return `set role service_role;\n${sql}`;
}

test("longform appendices are owner-read, service-written, and never change report status", { skip: skipWithoutDocker }, async () => {
  const fixture = startPostgresFixture();
  const schemaUrl = fixture.connectionUrl("schema_owner", "schema-owner-test-password");

  try {
    const migration = spawnSync(process.execPath, [runnerPath], {
      encoding: "utf8",
      env: { ...process.env, SCHEMA_DATABASE_URL: schemaUrl },
    });
    assert.equal(migration.status, 0, migration.stderr);
    assert.match(migration.stdout, /applied 20260905010000_personal_report_longform_appendices\.sql/);

    fixture.psql(`
      insert into identity.users (id, name, email, email_verified, email_verified_at)
      values
        ('${USER_A}', 'Appendix User A', 'appendix-a@example.com', true, now()),
        ('${USER_B}', 'Appendix User B', 'appendix-b@example.com', true, now());
      insert into public.personal_reports (
        id, user_id, request_id, request_fingerprint, report_type, status,
        schema_version, presentation_mode, requested_themes, depth,
        skill_name, skill_version, skill_source_commit, skill_snapshot_sha256
      ) values (
        '${REPORT_ID}', '${USER_A}', '${REQUEST_ID}', '${HASH}', 'personal_full', 'generating',
        'report_document.v2', 'default', array['career']::text[], 'standard',
        'jyotish-personal-report', '1.0.0', '${COMMIT}', '${HASH}'
      );
      update public.personal_reports
      set status = 'ready',
          report_document = '{"schemaVersion":"report_document.v2"}'::jsonb,
          completed_at = now(),
          calculation_hash = '${HASH}',
          evidence_hash = '${HASH}'
      where id = '${REPORT_ID}';
    `);

    assert.throws(
      () => fixture.psqlAs(
        "app_runtime",
        "app-runtime-test-password",
        selectAsAuthenticated(USER_A, `
          insert into public.personal_report_longform_appendices (
            report_id, user_id, request_id, status
          ) values ('${REPORT_ID}', '${USER_A}', '${REQUEST_ID}', 'pending');
        `),
      ),
      /permission denied for table personal_report_longform_appendices/,
    );

    fixture.psqlAs(
      "service_runtime",
      "service-runtime-test-password",
      serviceSql(`
        insert into public.personal_report_longform_appendices (
          report_id, user_id, request_id, status, markdown, content_sha256, generated_at
        ) values (
          '${REPORT_ID}', '${USER_A}', '${REQUEST_ID}', 'ready',
          '# Full', '${HASH}', now()
        );
      `),
    );

    assert.equal(
      fixture.psqlAs(
        "app_runtime",
        "app-runtime-test-password",
        selectAsAuthenticated(USER_A, `
          select status || ':' || length(markdown) from public.personal_report_longform_appendices
          where report_id = '${REPORT_ID}'
        `),
      ),
      `SET\n${USER_A}\nready:6`,
    );
    assert.equal(
      fixture.psqlAs(
        "app_runtime",
        "app-runtime-test-password",
        selectAsAuthenticated(USER_B, `
          select count(*) from public.personal_report_longform_appendices
          where report_id = '${REPORT_ID}'
        `),
      ),
      `SET\n${USER_B}\n0`,
    );

    fixture.psqlAs(
      "service_runtime",
      "service-runtime-test-password",
      serviceSql(`
        update public.personal_report_longform_appendices
        set status = 'unavailable', markdown = null, content_sha256 = null,
            last_error_code = 'upstream_unavailable', attempt_count = 2
        where report_id = '${REPORT_ID}';
      `),
    );

    assert.equal(
      fixture.psql(`select status from public.personal_reports where id = '${REPORT_ID}'`),
      "ready",
    );
    assert.equal(
      fixture.psql(`
        select status || ':' || coalesce(last_error_code, '')
        from public.personal_report_longform_appendices
        where report_id = '${REPORT_ID}'
      `),
      "unavailable:upstream_unavailable",
    );

    const serviceUrl = fixture.connectionUrl("service_runtime", "service-runtime-test-password");
    const admin = createLocalPostgresDataClient(serviceUrl, null, "service_role");
    try {
      const persisted = await admin.from("personal_report_longform_appendices").upsert({
        report_id: REPORT_ID,
        user_id: USER_A,
        request_id: REQUEST_ID,
        status: "unavailable",
        markdown: null,
        content_sha256: null,
        attempt_count: 2,
        last_error_code: "appendix_persist_failed",
      });
      assert.equal(persisted.error, null, persisted.error?.message);
      assert.equal(
        fixture.psql(`
          select last_error_code
          from public.personal_report_longform_appendices
          where report_id = '${REPORT_ID}'
        `),
        "appendix_persist_failed",
      );
    } finally {
      await closeLocalPostgresDataPool(serviceUrl);
    }
  } finally {
    fixture.stop();
  }
});