import { faker } from "@faker-js/faker";
import { expect } from "chai";
import request from "supertest";
import { createApp } from "../src/app.js";
import { env } from "../src/config/env.js";
import { prisma } from "../src/db/prisma.js";
import { hashAdminPassword } from "../src/modules/admin/admin-auth.service.js";
import { resetDatabase } from "../test-support/reset-db.js";

const SECRET_HEADER = "X-Internal-Worker-Secret";
const VALID_STATUSES = ["up", "degraded", "down", "unknown"];

async function seedAdmin(): Promise<{ email: string; password: string }> {
  const email = faker.internet.email().toLowerCase();
  const password = faker.internet.password({ length: 16 });
  await prisma.adminUser.create({
    data: { email, name: faker.person.fullName(), passwordHash: await hashAdminPassword(password) },
  });
  return { email, password };
}

const adminSecretConfigured = env.ADMIN_JWT_SECRET !== undefined;
const workerSecretConfigured = env.INTERNAL_WORKER_SECRET !== undefined;

describe("Admin monitoring", () => {
  const app = createApp();

  beforeEach(async () => {
    await resetDatabase();
  });

  after(async () => {
    await prisma.$disconnect();
  });

  describe("POST /internal/tech-steps/heartbeat", () => {
    it("rejects a request with no worker secret with 401", async () => {
      const res = await request(app).post("/internal/tech-steps/heartbeat").send({ event: "boot" });
      expect(res.status).to.equal(401);
    });

    it("rejects a malformed body with 400", async function () {
      if (!workerSecretConfigured) {
        // biome-ignore lint/suspicious/noExplicitAny: mocha's `this.skip()` isn't typed here.
        (this as any).skip();
        return;
      }
      const res = await request(app)
        .post("/internal/tech-steps/heartbeat")
        .set(SECRET_HEADER, env.INTERNAL_WORKER_SECRET as string)
        .send({ event: "not-a-real-event" });
      expect(res.status).to.equal(400);
    });

    it("upserts the worker heartbeat, recording lastRunAt/lastResult for a job ping", async function () {
      if (!workerSecretConfigured) {
        // biome-ignore lint/suspicious/noExplicitAny: see above.
        (this as any).skip();
        return;
      }
      const res = await request(app)
        .post("/internal/tech-steps/heartbeat")
        .set(SECRET_HEADER, env.INTERNAL_WORKER_SECRET as string)
        .send({
          event: "job",
          job: "audit-low-confidence",
          ok: true,
          counts: { suggestions: 3 },
        });
      expect(res.status).to.equal(200);
      expect(res.body).to.deep.equal({ ok: true });

      const stored = await prisma.workerHeartbeat.findUniqueOrThrow({
        where: { workerKey: "tech-step-llm-worker" },
      });
      expect(stored.lastRunAt).to.not.equal(null);
      expect(stored.lastResult).to.deep.equal({
        job: "audit-low-confidence",
        ok: true,
        counts: { suggestions: 3 },
      });
    });

    it("leaves lastRunAt null for a boot/tick ping", async function () {
      if (!workerSecretConfigured) {
        // biome-ignore lint/suspicious/noExplicitAny: see above.
        (this as any).skip();
        return;
      }
      await request(app)
        .post("/internal/tech-steps/heartbeat")
        .set(SECRET_HEADER, env.INTERNAL_WORKER_SECRET as string)
        .send({ event: "boot" });

      const stored = await prisma.workerHeartbeat.findUniqueOrThrow({
        where: { workerKey: "tech-step-llm-worker" },
      });
      expect(stored.lastSeenAt).to.be.instanceOf(Date);
      expect(stored.lastRunAt).to.equal(null);
    });
  });

  describe("GET /admin/monitoring", () => {
    it("rejects a request with no admin session with 401", async () => {
      const res = await request(app).get("/admin/monitoring");
      expect(res.status).to.equal(401);
    });

    it("returns a status board covering all four targets, never crashing on an unreachable probe", async function () {
      if (!adminSecretConfigured) {
        // biome-ignore lint/suspicious/noExplicitAny: see above.
        (this as any).skip();
        return;
      }
      const { email, password } = await seedAdmin();
      const agent = request.agent(app);
      await agent.post("/admin/auth/login").send({ email, password });

      const res = await agent.get("/admin/monitoring");
      expect(res.status).to.equal(200);

      const keys = res.body.services.map((s: { key: string }) => s.key);
      expect(keys).to.have.members(["postgres", "api", "intent-service", "tech-step-llm-worker"]);
      for (const service of res.body.services) {
        expect(VALID_STATUSES).to.include(service.status);
      }

      const byKey = Object.fromEntries(res.body.services.map((s: { key: string }) => [s.key, s]));
      // The DB is up during the test run, and the API is answering us.
      expect(byKey.postgres.status).to.equal("up");
      expect(byKey.api.status).to.equal("up");
      // No heartbeat has ever been recorded (resetDatabase truncated it).
      expect(byKey["tech-step-llm-worker"].status).to.equal("unknown");
    });

    it("reports the worker as up once it has sent a recent heartbeat", async function () {
      if (!adminSecretConfigured || !workerSecretConfigured) {
        // biome-ignore lint/suspicious/noExplicitAny: see above.
        (this as any).skip();
        return;
      }
      await request(app)
        .post("/internal/tech-steps/heartbeat")
        .set(SECRET_HEADER, env.INTERNAL_WORKER_SECRET as string)
        .send({ event: "job", job: "transform-corrections", ok: true, counts: { suggestions: 0 } });

      const { email, password } = await seedAdmin();
      const agent = request.agent(app);
      await agent.post("/admin/auth/login").send({ email, password });

      const res = await agent.get("/admin/monitoring");
      const worker = res.body.services.find(
        (s: { key: string }) => s.key === "tech-step-llm-worker",
      );
      expect(worker.status).to.equal("up");
      expect(worker.lastResult.job).to.equal("transform-corrections");
      expect(worker.lastRunAt).to.be.a("string");
    });
  });
});