//! Milestone 0.4 end to end: issues with labels, assignees and
//! milestones, cross references, closing keywords on landing, the inbox,
//! watching, mentions and search.

use axum::body::Body;
use axum::http::{header, Request, StatusCode};
use http_body_util::BodyExt;
use oxy_core::repo::Repo;
use oxygenhub::config::Config;
use oxygenhub::db;
use oxygenhub::repos::RepoName;
use oxygenhub::Shared;
use std::path::Path;
use tower::ServiceExt;

fn hermetic() {
    static ONCE: std::sync::Once = std::sync::Once::new();
    static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();
    ONCE.call_once(|| {
        let d = tempfile::tempdir().unwrap();
        std::env::set_var("OXY_HOME", d.path());
        DIR.set(d).ok();
    });
}

fn write(root: &Path, rel: &str, content: &[u8]) {
    let p = root.join(rel);
    std::fs::create_dir_all(p.parent().unwrap()).unwrap();
    std::fs::write(p, content).unwrap();
}

struct Hub {
    app: Shared,
    base: String,
    _dir: tempfile::TempDir,
}

async fn hub() -> Hub {
    hermetic();
    let dir = tempfile::tempdir().unwrap();
    let mut config = Config::load(dir.path()).unwrap();
    config.auth.push_tokens = vec!["site".into()];
    config.registration.mode = "open".into();
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
    let port = listener.local_addr().unwrap().port();
    config.server.base_url = format!("http://127.0.0.1:{port}");
    let app = oxygenhub::build(config).await.unwrap();
    let router = oxygenhub::router(app.clone());
    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
    Hub { app, base: format!("http://127.0.0.1:{port}"), _dir: dir }
}

struct Res {
    status: StatusCode,
    body: String,
    cookie: Option<String>,
    location: Option<String>,
}

async fn send(app: &Shared, method: &str, path: &str, cookie: Option<&str>, form: Option<&str>) -> Res {
    let mut req = Request::builder().method(method).uri(path);
    if let Some(c) = cookie {
        req = req.header(header::COOKIE, format!("oxyhub={c}"));
    }
    let body = match form {
        Some(f) => {
            req = req.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");
            Body::from(f.to_string())
        }
        None => Body::empty(),
    };
    let res = oxygenhub::router(app.clone()).oneshot(req.body(body).unwrap()).await.unwrap();
    let status = res.status();
    let cookie = res
        .headers()
        .get(header::SET_COOKIE)
        .and_then(|v| v.to_str().ok())
        .and_then(|v| v.split(';').next())
        .and_then(|kv| kv.split_once('='))
        .map(|(_, v)| v.to_string());
    let location = res.headers().get(header::LOCATION).and_then(|v| v.to_str().ok()).map(String::from);
    let bytes = res.into_body().collect().await.unwrap().to_bytes();
    Res { status, body: String::from_utf8_lossy(&bytes).into_owned(), cookie, location }
}

async fn get(app: &Shared, path: &str, cookie: Option<&str>) -> Res {
    send(app, "GET", path, cookie, None).await
}

async fn post(app: &Shared, path: &str, cookie: Option<&str>, form: &str) -> Res {
    send(app, "POST", path, cookie, Some(form)).await
}

async fn register(app: &Shared, user: &str) -> String {
    let r = post(app, "/register", None, &format!("username={user}&email={user}%40example.com&password=correct-horse-battery")).await;
    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);
    r.cookie.unwrap()
}

fn csrf_of(page: &str) -> String {
    let i = page.find("name=\"_csrf\" value=\"").expect("csrf field") + "name=\"_csrf\" value=\"".len();
    page[i..].split('"').next().unwrap().to_string()
}

#[tokio::test(flavor = "multi_thread")]
async fn issues_notifications_and_search() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    let repo = RepoName::parse("andy/demo").unwrap();
    app.repos.create(&repo, None).unwrap();
    db::repos::create(&app.db, "andy", "demo", "", hub_api::Visibility::Public).await.unwrap();

    // Labels and a milestone, by the owner.
    let labels_page = get(app, "/andy/demo/labels", Some(&andy)).await;
    let csrf_a = csrf_of(&labels_page.body);
    assert!(post(app, "/andy/demo/labels", Some(&andy), &format!("_csrf={csrf_a}&name=bug&colour=%23ff0000&description=Something+broke"))
        .await
        .body
        .contains("Saved bug"));
    assert!(post(app, "/andy/demo/milestones", Some(&andy), &format!("_csrf={csrf_a}&title=v1&description=First&due=2027-01-01"))
        .await
        .body
        .contains("v1"));
    assert_eq!(get(app, "/andy/demo/labels", Some(&bob)).await.status, StatusCode::OK, "readers see labels");
    assert!(!get(app, "/andy/demo/labels", Some(&bob)).await.body.contains("Add or change"), "but cannot edit them");

    // Bob watches the repository, then Andy opens an issue mentioning @bob: Bob is told twice at most once.
    let overview = get(app, "/andy/demo", Some(&bob)).await;
    let csrf_b = csrf_of(&overview.body);
    assert_eq!(post(app, "/andy/demo/watch", Some(&bob), &format!("_csrf={csrf_b}")).await.status, StatusCode::SEE_OTHER);
    assert!(get(app, "/andy/demo", Some(&bob)).await.body.contains("UNWATCH"));
    let new_page = get(app, "/andy/demo/issues/new", Some(&andy)).await;
    let csrf_a = csrf_of(&new_page.body);
    let r = post(
        app,
        "/andy/demo/issues/new",
        Some(&andy),
        &format!("_csrf={csrf_a}&title=Crash+on+start&body=cc+%40bob+see+%23999+and+deadbeefcafe1234"),
    )
    .await;
    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);
    assert_eq!(r.location.as_deref(), Some("/andy/demo/issue/1"));
    let page = get(app, "/andy/demo/issue/1", Some(&bob)).await;
    assert!(page.body.contains("Crash on start"));
    assert!(page.body.contains("href=\"/bob\""), "mention linked: {}", page.body);
    assert!(page.body.contains("/andy/demo/change/deadbeefcafe1234"), "hash linked: {}", page.body);
    assert!(page.body.contains("#999") && !page.body.contains("issue/999"), "unknown numbers are not linked");
    let unread = db::notify::unread(&app.db, db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id).await.unwrap();
    assert_eq!(unread, 1, "one notification, not one per reason");
    let inbox = get(app, "/notifications", Some(&bob)).await;
    assert!(inbox.body.contains("andy/demo#1: Crash on start"), "{}", inbox.body);
    assert!(get(app, "/andy/demo", Some(&bob)).await.body.contains("class=\"count\">1<"), "bell shows the count");

    // Triage: labels, assignee, milestone, pin, lock.
    let page = get(app, "/andy/demo/issue/1", Some(&andy)).await;
    let csrf_a = csrf_of(&page.body);
    let label_id: i64 = sqlx::query_scalar("SELECT id FROM labels WHERE name = 'bug'").fetch_one(&app.db).await.unwrap();
    let r = post(app, "/andy/demo/issue/1/labels", Some(&andy), &format!("_csrf={csrf_a}&label={label_id}")).await;
    assert!(r.body.contains(">bug<"), "{}", r.body);
    let r = post(app, "/andy/demo/issue/1/assign", Some(&andy), &format!("_csrf={csrf_a}&username=bob&action=add")).await;
    assert!(r.body.contains("href=\"/bob\">bob</a>"), "{}", r.body);
    let ms_id: i64 = sqlx::query_scalar("SELECT id FROM milestones WHERE title = 'v1'").fetch_one(&app.db).await.unwrap();
    let r = post(app, "/andy/demo/issue/1/milestone", Some(&andy), &format!("_csrf={csrf_a}&milestone={ms_id}")).await;
    assert!(r.body.contains(">v1<"), "{}", r.body);
    assert!(post(app, "/andy/demo/issue/1/state", Some(&andy), &format!("_csrf={csrf_a}&action=pin")).await.body.contains("UNPIN"));
    assert_eq!(
        post(
            app,
            "/andy/demo/issue/1/state",
            Some(&bob),
            &format!("_csrf={}&action=lock", csrf_of(&get(app, "/andy/demo/issue/1", Some(&bob)).await.body))
        )
        .await
        .status,
        StatusCode::NOT_FOUND,
        "bob cannot lock"
    );
    // Filters on the list.
    let list = get(app, "/andy/demo/issues?q=label:bug+assignee:bob+milestone:v1", None).await;
    assert!(list.body.contains("Crash on start"), "{}", list.body);
    assert!(!get(app, "/andy/demo/issues?q=label:feature", None).await.body.contains("Crash on start"));
    assert!(get(app, "/andy/demo/milestones", None).await.body.contains("1 open, 0 closed"));

    // Bob comments and closes; the author is told; search finds the comment.
    let csrf_b = csrf_of(&get(app, "/andy/demo/issue/1", Some(&bob)).await.body);
    let r = post(app, "/andy/demo/issue/1/comment", Some(&bob), &format!("_csrf={csrf_b}&body=Reproduced+with+the+flux+capacitor")).await;
    assert!(r.body.contains("flux capacitor"), "{}", r.body);
    assert!(get(app, "/notifications", Some(&andy)).await.body.contains("andy/demo#1"));
    let s = get(app, "/search?q=capacitor", None).await;
    assert!(s.body.contains("Crash on start") && s.body.contains("<mark>capacitor</mark>"), "{}", s.body);
    let s = get(app, "/search?q=demo", None).await;
    assert!(s.body.contains("/andy/demo\""), "repository hit: {}", s.body);
    // Bob is not triage, but as an assignee of an open issue he can comment-and-close? No: only the author or triage.
    let r = post(app, "/andy/demo/issue/1/comment", Some(&bob), &format!("_csrf={csrf_b}&body=closing&close=completed")).await;
    assert!(r.body.contains(">open<") || r.body.contains("head\">open"), "still open: {}", r.body);
    let r = post(app, "/andy/demo/issue/1/comment", Some(&andy), &format!("_csrf={csrf_a}&body=fixed&close=completed")).await;
    assert!(r.body.contains("closed"), "{}", r.body);
    assert!(get(app, "/andy/demo/issues?state=closed", None).await.body.contains("Crash on start"));

    // A second issue closed by a change message pushed to the default bookmark.
    let csrf_a = csrf_of(&get(app, "/andy/demo/issues/new", Some(&andy)).await.body);
    assert_eq!(
        post(app, "/andy/demo/issues/new", Some(&andy), &format!("_csrf={csrf_a}&title=Typo&body=")).await.location.as_deref(),
        Some("/andy/demo/issue/2")
    );
    let work = tempfile::tempdir().unwrap();
    let mut client = Repo::init(work.path()).unwrap();
    client.config.set("remote.origin.url", &format!("{}/andy/demo", h.base)).unwrap();
    client.config.set("remote.origin.token", "site").unwrap();
    client.save_config().unwrap();
    write(work.path(), "a.txt", b"a\n");
    client.snapshot("t").unwrap();
    client.commit("Fix the typo\n\nCloses #2", &[]).unwrap();
    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));
    tokio::time::sleep(std::time::Duration::from_millis(300)).await;
    let issue2 = db::issues::get(&app.db, db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap().id, 2).await.unwrap().unwrap();
    assert_eq!(issue2.state, "closed", "closed by the landed change");
    assert!(get(app, "/andy/demo/issue/2", None).await.body.contains("closed by change"));

    // Numbers are shared: the next proposal is #3, and /issue/3 redirects to it.
    client.bookmark_create("feat", None).unwrap();
    client.bookmark_switch("feat", false).unwrap();
    write(work.path(), "b.txt", b"b\n");
    client.snapshot("t").unwrap();
    client.commit("feat", &[]).unwrap();
    assert!(client.push_bookmark("origin", "feat", false).unwrap().iter().all(|r| r.ok));
    let csrf_a = csrf_of(&get(app, "/andy/demo/proposals/new?source=feat&target=main", Some(&andy)).await.body);
    let r = post(app, "/andy/demo/proposals/new", Some(&andy), &format!("_csrf={csrf_a}&title=Feat&target=main&source=feat")).await;
    assert_eq!(r.location.as_deref(), Some("/andy/demo/proposal/3"), "{}", r.body);
    assert_eq!(get(app, "/andy/demo/issue/3", None).await.location.as_deref(), Some("/andy/demo/proposal/3"));
    // A comment on the issue referencing #3 links to the proposal.
    let r = post(app, "/andy/demo/issue/2/comment", Some(&andy), &format!("_csrf={csrf_a}&body=see+%233")).await;
    assert!(r.body.contains("href=\"/andy/demo/proposal/3\""), "{}", r.body);
    // Bob (watcher) heard about the proposal; the inbox marks all read.
    assert!(get(app, "/notifications", Some(&bob)).await.body.contains("andy/demo#3: Feat"));
    let csrf_b = csrf_of(&get(app, "/notifications", Some(&bob)).await.body);
    let r = post(app, "/notifications/read", Some(&bob), &format!("_csrf={csrf_b}")).await;
    assert!(r.body.contains("0 unread"), "{}", r.body);
    // Email preference and the unsubscribe link.
    let r = post(app, "/settings/notifications", Some(&bob), &format!("_csrf={csrf_b}&email=1")).await;
    assert!(r.body.contains("Email notifications are on"));
    let key: String = sqlx::query_scalar("SELECT unsubscribe_key FROM accounts WHERE username = 'bob'").fetch_one(&app.db).await.unwrap();
    assert_eq!(get(app, &format!("/settings/notifications?unsubscribe={key}"), None).await.status, StatusCode::OK);
    let on: bool = sqlx::query_scalar("SELECT email_notifications FROM accounts WHERE username = 'bob'").fetch_one(&app.db).await.unwrap();
    assert!(!on);
}

#[tokio::test(flavor = "multi_thread")]
async fn dashboard_shows_what_needs_the_viewer() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    for (name, vis) in [("demo", hub_api::Visibility::Public), ("secret", hub_api::Visibility::Private)] {
        app.repos.create(&RepoName::parse(&format!("andy/{name}")).unwrap(), None).unwrap();
        db::repos::create(&app.db, "andy", name, "", vis).await.unwrap();
    }
    let demo = db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap();
    let secret = db::repos::get(&app.db, "andy", "secret").await.unwrap().unwrap();
    let bob_id = db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id;
    for (repo, title) in [(demo.id, "Faster startup"), (secret.id, "Hidden work")] {
        let p = db::proposals::create(
            &app.db,
            db::proposals::NewProposal {
                repo_id: repo,
                title,
                body: "",
                author_id: Some(bob_id),
                author: "bob",
                draft: false,
                target: "main",
                source_kind: "bookmark",
                source_repo_id: Some(repo),
                source_bookmark: "fast",
                source_changes: "",
            },
        )
        .await
        .unwrap();
        db::proposals::add_event(&app.db, p.id, "bob", "opened", "").await.unwrap();
    }

    // Signed out, `/` is still the repository list.
    let anon = get(app, "/", None).await;
    assert!(anon.body.contains("andy /") && !anon.body.contains("Dashboard <small>"), "{}", anon.body);

    // Andy owns both repositories: both proposals wait for his review.
    let page = get(app, "/", Some(&andy)).await;
    assert_eq!(page.status, StatusCode::OK);
    assert!(page.body.contains("Waiting for your review <small>2</small>"), "{}", page.body);
    assert!(page.body.contains("/andy/demo/proposal/1") && page.body.contains("/andy/secret/proposal/1"));
    assert!(page.body.contains("Your repositories"));
    assert!(page.body.contains("opened proposal"), "activity feed: {}", page.body);

    // Once he reviews one, it leaves his queue.
    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;
    let p = db::proposals::get(&app.db, demo.id, 1).await.unwrap().unwrap();
    db::proposals::add_review(&app.db, p.id, andy_id, "andy", "approve", "").await.unwrap();
    assert!(get(app, "/", Some(&andy)).await.body.contains("Waiting for your review <small>1</small>"));

    // Bob sees his own proposal on the public repository, never the private one's.
    let page = get(app, "/", Some(&bob)).await;
    assert!(page.body.contains("Your proposals <small>1</small>"), "{}", page.body);
    assert!(!page.body.contains("Hidden work"));
    assert!(page.body.contains("Waiting for your review <small>0</small>"));
    assert!(page.body.contains("Faster startup"));
    let feed = &page.body[page.body.find("Recent activity").unwrap()..];
    assert!(!feed.contains("andy/secret"), "private activity leaked: {feed}");

    // Explore still lists every visible repository.
    assert!(get(app, "/explore", Some(&bob)).await.body.contains("andy /"));
}

#[tokio::test(flavor = "multi_thread")]
async fn empty_repository_shows_a_quickstart() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    app.repos.create(&RepoName::parse("andy/fresh").unwrap(), None).unwrap();
    db::repos::create(&app.db, "andy", "fresh", "", hub_api::Visibility::Public).await.unwrap();

    let page = get(app, "/andy/fresh", Some(&andy)).await;
    assert!(page.body.contains("This repository is empty"), "{}", page.body);
    let clone_url = format!("{}/andy/fresh", h.base);
    assert!(page.body.contains(&format!("oxy remote add hub {clone_url}")), "{}", page.body);
    assert!(page.body.contains("oxy config remote.hub.token YOUR-TOKEN"));
    assert!(page.body.contains("oxy push hub"));
    assert!(
        page.body.contains("mkdir fresh &amp;&amp; cd fresh") || page.body.contains("mkdir fresh &#38;&#38; cd fresh"),
        "{}",
        page.body
    );
    assert!(page.body.contains("oxy git import --branch main"));
    assert!(!page.body.contains("oxyhub-ca.pem"), "no certificate step without a self-signed certificate");

    // A reader without write access is not told to push.
    let page = get(app, "/andy/fresh", Some(&bob)).await;
    assert!(page.body.contains("Nothing has been pushed yet") && !page.body.contains("oxy push hub"), "{}", page.body);

    // After a first push the quickstart gives way to the tree.
    let work = tempfile::tempdir().unwrap();
    let mut client = Repo::init(work.path()).unwrap();
    client.config.set("remote.hub.url", &clone_url).unwrap();
    client.config.set("remote.hub.token", "site").unwrap();
    client.save_config().unwrap();
    write(work.path(), "README.md", b"# fresh\n");
    client.commit("First change", &[]).unwrap();
    assert!(client.push("hub", false).unwrap().iter().all(|r| r.ok));
    let page = get(app, "/andy/fresh", Some(&andy)).await;
    assert!(!page.body.contains("This repository is empty") && page.body.contains("README.md"), "{}", page.body);
}

#[tokio::test(flavor = "multi_thread")]
async fn theme_is_chosen_in_settings_and_remembered_in_a_cookie() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let page = get(app, "/settings", Some(&andy)).await;
    assert!(page.body.contains("Appearance"));
    assert!(page.body.contains(r#"value="dark" checked"#), "dark by default: {}", page.body);
    assert!(page.body.contains("data-theme-toggle"), "the header has the switch");
    let csrf = csrf_of(&page.body);
    let r = post(app, "/settings/appearance", Some(&andy), &format!("_csrf={csrf}&theme=light")).await;
    assert_eq!(r.status, StatusCode::SEE_OTHER);
    assert_eq!(r.cookie.as_deref(), Some("light"));
    assert_eq!(r.location.as_deref(), Some("/settings"));
    let page = send_with_theme(app, &andy, "light").await;
    assert!(page.contains(r#"value="light" checked"#), "the form shows the cookie's theme");
    assert_eq!(post(app, "/settings/appearance", Some(&andy), &format!("_csrf={csrf}&theme=purple")).await.status, StatusCode::BAD_REQUEST);
    assert_eq!(post(app, "/settings/appearance", Some(&andy), "_csrf=nope&theme=light").await.status, StatusCode::BAD_REQUEST);
}

async fn send_with_theme(app: &Shared, session: &str, theme: &str) -> String {
    let req =
        Request::builder().uri("/settings").header(header::COOKIE, format!("oxyhub={session}; theme={theme}")).body(Body::empty()).unwrap();
    let res = oxygenhub::router(app.clone()).oneshot(req).await.unwrap();
    String::from_utf8_lossy(&res.into_body().collect().await.unwrap().to_bytes()).into_owned()
}