package members_client_test

import (
	"context"
	"os"
	"path/filepath"
	"reflect"
	"regexp"
	"strings"
	"testing"

	"code.tnxs.net/vernonkeenan/lib/api/members/members_client"
	"code.tnxs.net/vernonkeenan/lib/api/members/members_client/databases"
	"code.tnxs.net/vernonkeenan/lib/api/members/members_models"
	openapiruntime "github.com/go-openapi/runtime"
	"github.com/go-openapi/strfmt"
)

type databaseMetadataCaptureTransport struct {
	operation *openapiruntime.ClientOperation
}

func (transport *databaseMetadataCaptureTransport) Submit(
	operation *openapiruntime.ClientOperation,
) (any, error) {
	return transport.SubmitContext(context.Background(), operation)
}

func (transport *databaseMetadataCaptureTransport) SubmitContext(
	_ context.Context,
	operation *openapiruntime.ClientOperation,
) (any, error) {
	transport.operation = operation
	if operation.ID != "getDatabases" {
		panic("unexpected generated Database metadata operation: " + operation.ID)
	}
	return databases.NewGetDatabasesOK(), nil
}

func TestGeneratedDatabaseMetadataOperationIsFixedReadOnlyAndAuthenticated(t *testing.T) {
	transport := &databaseMetadataCaptureTransport{}
	auth := openapiruntime.ClientAuthInfoWriterFunc(
		func(openapiruntime.ClientRequest, strfmt.Registry) error { return nil },
	)
	tenantID := strfmt.UUID("77777777-7777-4777-8777-777777777777")
	databaseID := strfmt.UUID("88888888-8888-4888-8888-888888888888")
	params := databases.NewGetDatabasesParams().
		WithTenantID(tenantID).
		WithDatabaseID(&databaseID)
	_, err := databases.New(transport, strfmt.Default).GetDatabases(params, auth)
	if err != nil {
		t.Fatalf("generated Database metadata operation failed: %v", err)
	}
	if transport.operation == nil {
		t.Fatal("generated client did not submit an operation")
	}
	if transport.operation.ID != "getDatabases" ||
		transport.operation.Method != "GET" ||
		transport.operation.PathPattern != "/databases" {
		t.Fatalf(
			"operation = %s %s %s, want getDatabases GET /databases",
			transport.operation.ID,
			transport.operation.Method,
			transport.operation.PathPattern,
		)
	}
	if transport.operation.AuthInfo == nil {
		t.Fatal("generated operation discarded its compound auth writer")
	}
	if params.TenantID != tenantID || params.DatabaseID == nil ||
		*params.DatabaseID != databaseID {
		t.Fatal("generated Database metadata client lost tenant or record filter")
	}
}

func TestDatabaseMetadataSpecRequiresExactScopeTenantAndCompoundAuth(t *testing.T) {
	specText := readMembersLearningSpec(t)
	pathBlock := learningSpecPathBlock(t, specText, "/databases")
	for _, forbidden := range []string{"    post:", "    put:", "    patch:", "    delete:"} {
		if strings.Contains(pathBlock, forbidden) {
			t.Errorf("/databases exposes unsupported %s", strings.TrimSpace(forbidden))
		}
	}
	block := learningSpecOperationBlock(t, specText, "/databases", "get")
	for _, required := range []string{
		"      operationId: getDatabases\n",
		"members:database:read",
		`- $ref: "#/parameters/databaseTenantId"`,
		"      security:\n        - ApiKeyAuth: []\n          kvSessionCookie: []",
	} {
		if !strings.Contains(block, required) {
			t.Errorf("GET /databases lost required contract %q", required)
		}
	}
}

func TestDatabaseMetadataModelContainsOnlyCredentialFreeFields(t *testing.T) {
	assertExactModelFields(t, members_models.DatabaseMetadata{}, map[string]string{
		"Active":           "*bool",
		"ClusterID":        "*strfmt.UUID",
		"CreatedDate":      "*strfmt.DateTime",
		"DatabaseName":     "*string",
		"ID":               "*strfmt.UUID",
		"LastModifiedDate": "*strfmt.DateTime",
		"Status":           "*string",
		"TenantID":         "*strfmt.UUID",
		"Type":             "*string",
	})
}

func TestDatabaseMetadataClientHasNoProvisioningMutation(t *testing.T) {
	contract := reflect.TypeOf((*databases.ClientService)(nil)).Elem()
	for index := 0; index < contract.NumMethod(); index++ {
		method := contract.Method(index).Name
		for _, forbidden := range []string{
			"Post", "Put", "Patch", "Delete", "Create", "Update",
			"Provision", "DSN", "Credential",
		} {
			if strings.Contains(method, forbidden) {
				t.Errorf("Database metadata client exposes forbidden method %s", method)
			}
		}
	}
	root := reflect.TypeOf(members_client.Members{})
	if _, exists := root.FieldByName("Databases"); !exists {
		t.Fatal("root Members client does not expose Database metadata")
	}
}

func TestGeneratedDatabaseMetadataSurfaceHasNoRetiredOrSecretCoupling(t *testing.T) {
	repoRoot := learningRepoRoot(t)
	targets := []string{
		filepath.Join(repoRoot, "api", "members", "members_client", "databases"),
		filepath.Join(
			repoRoot, "api", "members", "members_models", "database_metadata.go",
		),
		filepath.Join(
			repoRoot,
			"api",
			"members",
			"members_models",
			"database_metadata_response.go",
		),
	}
	credentialLiteral := regexp.MustCompile(
		`(?i)(api[_-]?key|password|secret)\s*[:=]\s*["'][^"']+["']`,
	)
	for _, target := range targets {
		err := filepath.WalkDir(target, func(
			path string,
			entry os.DirEntry,
			walkErr error,
		) error {
			if walkErr != nil {
				return walkErr
			}
			if entry.IsDir() || !strings.HasSuffix(path, ".go") ||
				strings.HasSuffix(path, "_test.go") {
				return nil
			}
			content, err := os.ReadFile(path)
			if err != nil {
				return err
			}
			lower := strings.ToLower(string(content))
			for _, forbidden := range []string{
				"salesforce", "sf-gate", "go-force", "cache",
				"processortoken",
				"postdatabases", "putdatabases", "deletedatabases",
			} {
				if strings.Contains(lower, forbidden) {
					t.Errorf("%s contains forbidden boundary %q", path, forbidden)
				}
			}
			if credentialLiteral.Match(content) {
				t.Errorf("%s contains a credential-shaped literal", path)
			}
			return nil
		})
		if err != nil {
			t.Fatalf("scan generated Database metadata target %s: %v", target, err)
		}
	}
}