from __future__ import annotations

from pathlib import Path

from fastapi.testclient import TestClient

from beaver.interfaces.web.app import create_app
from beaver.services.agent_service import AgentService
from beaver.services.user_file_resolver import UserFileStorageResolver
from beaver.services.user_files import LocalUserFileStorage, UserFileService


def _auth_headers(app, username: str = "alice") -> dict[str, str]:
    token = f"test-token-{username}"
    app.state.auth_tokens[token] = username
    return {"Authorization": f"Bearer {token}"}


def test_workspace_browser_api_manages_workspace_files(tmp_path: Path) -> None:
    service = AgentService(workspace=tmp_path)
    app = create_app(service=service, manage_service_lifecycle=False)

    with TestClient(app) as client:
        root = client.get("/api/workspace/browse")
        mkdir = client.post("/api/workspace/mkdir", params={"path": "docs"})
        upload = client.post(
            "/api/workspace/upload",
            data={"path": "docs"},
            files={"file": ("hello.txt", b"hello workspace", "text/plain")},
        )
        docs = client.get("/api/workspace/browse", params={"path": "docs"})
        download = client.get("/api/workspace/download", params={"path": "docs/hello.txt"})
        deleted = client.delete("/api/workspace/delete", params={"path": "docs/hello.txt"})
        after_delete = client.get("/api/workspace/browse", params={"path": "docs"})

    assert root.status_code == 200
    assert root.json()["path"] == ""
    assert all(item["name"] != "docs" for item in root.json()["items"])
    assert mkdir.status_code == 200
    assert mkdir.json()["path"] == "docs"
    assert upload.status_code == 200
    assert upload.json()["path"] == "docs/hello.txt"
    assert docs.status_code == 200
    assert [item["name"] for item in docs.json()["items"]] == ["hello.txt"]
    assert download.status_code == 200
    assert download.content == b"hello workspace"
    assert deleted.status_code == 200
    assert deleted.json() == {"ok": True}
    assert after_delete.status_code == 200
    assert after_delete.json()["items"] == []


def test_attachment_file_api_round_trips_uploaded_file(tmp_path: Path) -> None:
    service = AgentService(workspace=tmp_path)
    app = create_app(service=service, manage_service_lifecycle=False)

    with TestClient(app) as client:
        upload = client.post(
            "/api/files/upload",
            data={"session_id": "web:test"},
            files={"file": ("note.txt", b"hello attachment", "text/plain")},
        )
        file_id = upload.json()["file_id"]
        listed = client.get("/api/files", params={"session_id": "web:test"})
        download = client.get(f"/api/files/{file_id}")
        deleted = client.delete(f"/api/files/{file_id}")
        missing = client.get(f"/api/files/{file_id}")

    assert upload.status_code == 200
    assert upload.json()["name"] == "note.txt"
    assert upload.json()["url"] == f"/api/files/{file_id}"
    assert listed.status_code == 200
    assert [item["file_id"] for item in listed.json()] == [file_id]
    assert download.status_code == 200
    assert download.content == b"hello attachment"
    assert deleted.status_code == 200
    assert deleted.json() == {"ok": True}
    assert missing.status_code == 404


def test_user_files_api_uses_virtual_roots_and_hides_workspace(tmp_path: Path) -> None:
    service = AgentService(workspace=tmp_path)
    app = create_app(service=service, manage_service_lifecycle=False)

    with TestClient(app) as client:
        headers = _auth_headers(app)
        root = client.get("/api/user-files/browse", headers=headers)
        status = client.get("/api/user-files/status", headers=headers)
        upload = client.post(
            "/api/user-files/upload",
            data={"path": "uploads"},
            files={"file": ("hello.txt", b"hello user files", "text/plain")},
            headers=headers,
        )
        uploads = client.get("/api/user-files/browse", params={"path": "uploads"}, headers=headers)
        preview = client.get("/api/user-files/preview", params={"path": "uploads/hello.txt"}, headers=headers)
        download = client.get("/api/user-files/download", params={"path": "uploads/hello.txt"}, headers=headers)

    assert root.status_code == 200
    assert [item["name"] for item in root.json()["items"]] == ["uploads", "outputs", "shared", "tasks"]
    assert all("bucket" not in item for item in root.json()["items"])
    assert status.status_code == 200
    assert status.json()["workspace_visible"] is False
    assert "base_path" not in status.json()
    assert upload.status_code == 200
    assert upload.json()["path"] == "uploads/hello.txt"
    assert uploads.status_code == 200
    assert [item["name"] for item in uploads.json()["items"]] == ["hello.txt"]
    assert preview.status_code == 200
    assert preview.json()["content"] == "hello user files"
    assert download.status_code == 200
    assert download.content == b"hello user files"


def test_user_files_api_rejects_invalid_paths_and_root_delete(tmp_path: Path) -> None:
    service = AgentService(workspace=tmp_path)
    app = create_app(service=service, manage_service_lifecycle=False)

    with TestClient(app) as client:
        headers = _auth_headers(app)
        traversal = client.get("/api/user-files/browse", params={"path": "uploads/../state"}, headers=headers)
        unknown_root = client.get("/api/user-files/browse", params={"path": "memory/private.txt"}, headers=headers)
        absolute_browse = client.get("/api/user-files/browse", params={"path": "/uploads/input.txt"}, headers=headers)
        absolute_download = client.get("/api/user-files/download", params={"path": "/outputs/result.txt"}, headers=headers)
        absolute_preview = client.get("/api/user-files/preview", params={"path": "/shared/profile.json"}, headers=headers)
        absolute_mkdir = client.post("/api/user-files/mkdir", params={"path": "/tasks/task-123/draft.md"}, headers=headers)
        absolute_upload = client.post(
            "/api/user-files/upload",
            data={"path": "/uploads"},
            files={"file": ("input.txt", b"x", "text/plain")},
            headers=headers,
        )
        delete_root = client.delete("/api/user-files/delete", params={"path": "uploads"}, headers=headers)

    assert traversal.status_code == 400
    assert unknown_root.status_code == 400
    assert absolute_browse.status_code == 400
    assert absolute_download.status_code == 400
    assert absolute_preview.status_code == 400
    assert absolute_mkdir.status_code == 400
    assert absolute_upload.status_code == 400
    assert delete_root.status_code == 400


def test_user_files_api_rejects_anonymous_access_before_storage(tmp_path: Path) -> None:
    service = AgentService(workspace=tmp_path)
    app = create_app(service=service, manage_service_lifecycle=False)

    with TestClient(app) as client:
        browse = client.get("/api/user-files/browse")
        status = client.get("/api/user-files/status")
        upload = client.post(
            "/api/user-files/upload",
            data={"path": "uploads"},
            files={"file": ("hello.txt", b"hello user files", "text/plain")},
        )
        delete = client.delete("/api/user-files/delete", params={"path": "uploads/hello.txt"})
        mkdir = client.post("/api/user-files/mkdir", params={"path": "uploads/new"})

    assert browse.status_code == 401
    assert status.status_code == 401
    assert upload.status_code == 401
    assert delete.status_code == 401
    assert mkdir.status_code == 401


def test_user_files_api_authenticated_request_resolves_identity(tmp_path: Path, monkeypatch) -> None:
    service = AgentService(workspace=tmp_path)
    app = create_app(service=service, manage_service_lifecycle=False)
    seen = []

    async def fake_service(self):
        seen.append(self.auth_context)
        return UserFileService(LocalUserFileStorage(tmp_path / "user-files"))

    monkeypatch.setattr(UserFileStorageResolver, "service", fake_service)

    with TestClient(app) as client:
        alice_headers = _auth_headers(app, "alice")
        upload = client.post(
            "/api/user-files/upload",
            data={"path": "uploads"},
            files={"file": ("alice.txt", b"alice", "text/plain")},
            headers=alice_headers,
        )

    assert upload.status_code == 200
    assert seen
    assert seen[0].username == "alice"
    assert seen[0].backend_id == "alice"
    assert seen[0].storage_namespace == "users/alice"


def test_user_files_api_streams_upload_and_enforces_configured_limit(tmp_path: Path, monkeypatch) -> None:
    monkeypatch.setenv("BEAVER_USER_FILES_MAX_UPLOAD_BYTES", "5")
    service = AgentService(workspace=tmp_path)
    app = create_app(service=service, manage_service_lifecycle=False)

    with TestClient(app) as client:
        headers = _auth_headers(app)
        ok_upload = client.post(
            "/api/user-files/upload",
            data={"path": "uploads"},
            files={"file": ("small.txt", b"abcde", "text/plain")},
            headers=headers,
        )
        too_large = client.post(
            "/api/user-files/upload",
            data={"path": "uploads"},
            files={"file": ("large.txt", b"abcdef", "text/plain")},
            headers=headers,
        )
        preview = client.get("/api/user-files/preview", params={"path": "uploads/small.txt"}, headers=headers)

    assert ok_upload.status_code == 200
    assert ok_upload.json()["path"] == "uploads/small.txt"
    assert too_large.status_code == 413
    assert "File too large" in too_large.json()["detail"]
    assert preview.status_code == 200
    assert preview.json()["content"] == "abcde"
