import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import { test } from "bun:test";

import { createInMemoryMonitorCentralStore, createMonitorCentralService, mapPostgresFindingRow, MONITOR_CENTRAL_MIGRATIONS, MonitorCentralConfigurationError, monitorCentralStableJson, normalizeMonitorCentralIngest, structuredMonitorCentralError } from "./monitor-central-persistence";

function service() { return createMonitorCentralService({ store: createInMemoryMonitorCentralStore(), pageSize: 50 }); }
function locator(runId: string) { return { ownerNode: "NC01", ownerLane: "v03", ownerPvc: "sentinel-pvc", stateDir: `/state/${runId}`, relativePath: "analysis/report.json", sha256: "sha256:abc", sizeBytes: 12, kind: "report", reachable: true }; }
function input(runId: string, updatedAt = "2026-07-12T10:00:00.000Z", scope: Record<string, string> = {}) { return { sentinelId: scope.sentinelId ?? "sentinel-a", node: scope.node ?? "NC01", lane: scope.lane ?? "v03", runId, updatedAt, status: "succeeded", payload: { runId, views: { summary: { state: "ready" } } }, findings: [{ id: `${runId}-0` }, { id: `${runId}-1` }], artifactLocators: [locator(runId)], timeline: [{ phase: "done" }] }; }
async function ingest(target: ReturnType<typeof service>, runId: string, updatedAt?: string, scope?: Record<string, string>) { return target.ingest(input(runId, updatedAt, scope)); }

test("schema covers runner FK, locator reachability, and atomic insert contract", () => {
  const schema = MONITOR_CENTRAL_MIGRATIONS.join("\n");
  for (const name of ["schema_migrations", "runners", "runs", "findings", "run_payloads", "artifact_locators", "timeline_events", "import_manifests"]) assert.match(schema, new RegExp(`monitor\\.${name}`));
  assert.match(schema, /foreign key \(sentinel_id, node, lane\) references monitor\.runners/u);
  assert.match(schema, /owner_pvc.*state_dir.*relative_path.*reachable/u);
  assert.doesNotMatch(schema, /blob|bytea/iu);
});

test("HTTP terminal ingest is unbound-safe, ignores caller hash, and maps conflict to 409", async () => {
  const target = service();
  const fetch = target.fetch;
  const first = await fetch(new Request("http://local/api/ingest", { method: "POST", body: JSON.stringify(input("run-1")) }));
  const repeated = await fetch(new Request("http://local/api/ingest", { method: "POST", body: JSON.stringify({ ...input("run-1"), payloadHash: "sha256:forged" }) }));
  const conflict = await fetch(new Request("http://local/api/ingest", { method: "POST", body: JSON.stringify({ ...input("run-1"), status: "blocked", payloadHash: "sha256:forged" }) }));
  assert.equal(first.status, 201);
  assert.equal((await first.json() as any).disposition, "inserted");
  assert.equal(repeated.status, 200);
  assert.equal((await repeated.json() as any).disposition, "idempotent");
  assert.equal(conflict.status, 409);
  assert.equal((await conflict.json() as any).error.code, "payload_hash_conflict");
  assert.equal((await fetch(new Request("http://local/health"))).status, 200);
});

test("full terminal envelope controls hash and concurrent same identity converges", async () => {
  const target = service();
  const base = { ...input("run-envelope"), payloadHash: "sha256:caller-controlled" };
  const results = await Promise.all([target.ingest(base), target.ingest(base)]);
  assert.deepEqual(new Set(results.map((item) => item.disposition)), new Set(["inserted", "idempotent"]));
  await assert.rejects(() => target.ingest({ ...base, findings: [{ id: "changed" }] }), { code: "payload_hash_conflict" });
  const availability = await target.ingest({ ...base, artifactLocators: [{ ...locator("run-envelope"), reachable: false }] });
  assert.equal(availability.disposition, "idempotent");
  const detail = await (await target.fetch(new Request("http://local/api/runs/run-envelope?sentinelId=sentinel-a&node=NC01&lane=v03"))).json() as any;
  assert.equal(detail.run.artifactLocators[0].reachable, false);
});

test("stable JSON accepts optional fields and in-memory view matches the PG contract", async () => {
  assert.equal(monitorCentralStableJson({ optional: undefined, value: "ok", list: [undefined] }), '{"list":[null],"value":"ok"}');
  const store = createInMemoryMonitorCentralStore();
  const normalized = normalizeMonitorCentralIngest({ ...input("top-level-view"), payload: { views: { summary: { state: "ready" } }, optional: undefined } });
  await store.ingest(normalized);
  assert.deepEqual(await store.view({ sentinelId: "sentinel-a", node: "NC01", lane: "v03" }, "top-level-view", "summary"), { run: { sentinelId: "sentinel-a", node: "NC01", lane: "v03", runId: "top-level-view", updatedAt: normalized.updatedAt, status: normalized.status, payloadHash: normalized.payloadHash }, view: "summary", value: { state: "ready" } });
});

test("global and scoped latest use updatedAt then runId descending", async () => {
  const target = service();
  await ingest(target, "run-a", "2026-07-12T10:00:00.000Z");
  await ingest(target, "run-b", "2026-07-12T10:00:00.000Z");
  await ingest(target, "run-c", "2026-07-12T09:00:00.000Z", { sentinelId: "sentinel-b" });
  const overview = await (await target.fetch(new Request("http://local/api/overview"))).json() as any;
  const scoped = await (await target.fetch(new Request("http://local/api/overview?sentinelId=sentinel-b"))).json() as any;
  assert.equal(overview.overview.latest.runId, "run-b");
  assert.equal(scoped.overview.latest.runId, "run-c");
});

test("detail and view require full composite identity", async () => {
  const target = service();
  await ingest(target, "shared", undefined, { sentinelId: "sentinel-a" });
  await ingest(target, "shared", undefined, { sentinelId: "sentinel-b" });
  const missing = await target.fetch(new Request("http://local/api/runs/shared"));
  const detail = await (await target.fetch(new Request("http://local/api/runs/shared?sentinelId=sentinel-b&node=NC01&lane=v03"))).json() as any;
  const view = await (await target.fetch(new Request("http://local/api/runs/shared/views/summary?sentinelId=sentinel-b&node=NC01&lane=v03"))).json() as any;
  assert.equal(missing.status, 400);
  assert.equal((await missing.json() as any).error.code, "scope_required");
  assert.equal(detail.run.sentinelId, "sentinel-b");
  assert.equal(view.view.value.state, "ready");
});

test("findings cursor contains finding index and does not skip a same-run page", async () => {
  const target = service();
  await ingest(target, "run-findings");
  const first = await (await target.fetch(new Request("http://local/api/findings?limit=1"))).json() as any;
  const second = await (await target.fetch(new Request(`http://local/api/findings?limit=1&cursor=${first.nextCursor}`))).json() as any;
  assert.equal(first.items[0].findingIndex, 1);
  assert.equal(second.items[0].findingIndex, 0);
});

test("PG finding mapping preserves selected status and payload hash", () => {
  const row = mapPostgresFindingRow({ sentinel_id: "sentinel-a", node: "NC01", lane: "v03", run_id: "run-pg", updated_at: "2026-07-12T10:00:00.000Z", status: "blocked", payload_hash: "sha256:terminal", finding_index: 2, finding: { id: "pg" } });
  assert.deepEqual(row, { sentinelId: "sentinel-a", node: "NC01", lane: "v03", runId: "run-pg", updatedAt: "2026-07-12T10:00:00.000Z", status: "blocked", payloadHash: "sha256:terminal", findingIndex: 2, finding: { id: "pg" } });
});

test("run detail returns normalized locator metadata without artifact bytes", async () => {
  const target = service();
  await ingest(target, "run-detail");
  const response = await (await target.fetch(new Request("http://local/api/runs/run-detail?sentinelId=sentinel-a&node=NC01&lane=v03"))).json() as any;
  assert.deepEqual(response.run.artifactLocators[0], locator("run-detail"));
  assert.equal(response.valuesRedacted, true);
});

test("configuration is explicit and missing environment projection fails structurally", async () => {
  const target = service();
  assert.equal((await target.health()).ok, true);
  assert.throws(() => createMonitorCentralService({ databaseUrl: "", pageSize: 50 }), MonitorCentralConfigurationError);
  assert.throws(() => createMonitorCentralService({ store: createInMemoryMonitorCentralStore() }), { code: "monitor_central_page_size_missing" });
  const result = spawnSync("bun", ["scripts/monitor-central-service.ts"], { cwd: process.cwd(), encoding: "utf8", env: { PATH: process.env.PATH ?? "" } });
  assert.equal(result.status, 2);
  assert.equal(JSON.parse(result.stdout).error.code, "monitor_central_runtime_config_missing");
});

test("structured error projection redacts database credentials", () => {
  const error = new Error("connect postgres://user:secret@example.test/monitor failed");
  assert.deepEqual(structuredMonitorCentralError(error), { code: "invalid_request", message: "connect postgres://<redacted> failed" });
});