package com.talentcard.server.business.merchant;

import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatThrownBy;

import java.sql.Timestamp;
import java.time.LocalDateTime;
import java.util.List;
import java.util.Map;

import com.talentcard.server.business.merchant.auth.MerchantPrincipal;
import com.talentcard.server.business.portal.PendingUsePortalService;
import com.talentcard.server.common.BusinessException;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.test.context.ActiveProfiles;

/**
 * Seam: the 6-digit code shown to the customer can be typed in when the camera is unusable, and the
 * code rotation no longer invalidates the code the merchant has already scanned.
 *
 * <p>The rotation half is exercised through the talent side ({@link PendingUsePortalService#issueCode}):
 * a new code must not kill the previous one, so a scan that lands on the rotation instant still works.
 */
@SpringBootTest
@ActiveProfiles("test")
class MerchantNumericCodeVerificationTests {

    @Autowired
    private JdbcTemplate jdbc;

    @Autowired
    private MerchantVerificationService verificationService;

    @Autowired
    private MerchantWorkService merchantWorkService;

    @Autowired
    private PendingUsePortalService pendingUsePortalService;

    private Long talentId;
    private Long merchantId;
    private Long storeId;
    private Long cardId;
    private String huifuId;
    private String suffix;
    private long sequence;

    @BeforeEach
    void prepareData() {
        suffix = String.valueOf(System.nanoTime());
        jdbc.update("insert into talent_user(openid, name, mobile, status, deleted) values (?, ?, ?, 1, 0)",
                "numeric-code-openid-" + suffix, "Numeric code user", "13900000006");
        talentId = jdbc.queryForObject("select max(id) from talent_user", Long.class);
        jdbc.update("insert into merchant(merchant_name, contact_mobile, address, status, deleted) values (?, ?, ?, 1, 0)",
                "Numeric code merchant " + suffix, "08120000005", "Test address");
        merchantId = jdbc.queryForObject("select max(id) from merchant", Long.class);
        storeId = merchantId + 1;
        huifuId = "H" + suffix.substring(Math.max(0, suffix.length() - 8));
        jdbc.update("insert into talent_card(talent_id, card_no, card_level, card_type, status, deleted) values (?, ?, ?, 'PERSONAL', 1, 0)",
                talentId, "CARD-" + suffix, "卓越人才卡");
        cardId = jdbc.queryForObject("select max(id) from talent_card", Long.class);
        sequence = 0;
    }

    @Test
    void theSixDigitCodeCanBeTypedInAndConfirmedWithoutDisclosingWhichOrderItBelongsTo() {
        PaidOrder order = paidOrder();

        Map<String, Object> scanned = verificationService.scan(principal(), new VerificationScanRequest(order.displayCode()));

        assertThat(scanned)
                .as("手输的 6 位码就是订单核销码的另一副面孔")
                .containsEntry("credentialType", "ORDER_CODE")
                .containsEntry("canVerify", true)
                .containsEntry("numericEntry", true);
        assertThat(scanned)
                .as("不返回订单归属：6 位只有 100 万空间，带回去就是一张可以枚举的「号码 → 订单」映射表")
                .doesNotContainKey("orderNo");

        Map<String, Object> confirmed = merchantWorkService.confirmNumericVerification(
                principal(), (String) scanned.get("verificationId"), "numeric-confirm-" + suffix);

        assertThat(confirmed).as("确认核销走的是与扫码完全相同的那套订单核销实现").isNotEmpty();
        assertThat(jdbc.queryForObject("select verify_status from benefit_order where order_no = ?", Integer.class, order.orderNo()))
                .isEqualTo(1);
        assertThat(jdbc.queryForObject("select count(*) from verify_record where order_id = ?", Long.class, order.orderId()))
                .as("手输核销与扫码核销是同一套核销实现（核销记录只写一条）")
                .isEqualTo(1L);
    }

    @Test
    void aWrongGuessAndACollidingCodeAnswerExactlyTheSameWay() {
        PaidOrder first = paidOrder();
        PaidOrder second = paidOrder();
        String sharedCode = "424242";
        jdbc.update("update order_dynamic_verification_code set display_code = ? where order_id in (?, ?)",
                sharedCode, first.orderId(), second.orderId());

        String colliding = errorFrom(() -> verificationService.scan(principal(), new VerificationScanRequest(sharedCode)));
        String wrong = errorFrom(() -> verificationService.scan(principal(), new VerificationScanRequest("999999")));

        assertThat(colliding)
                .as("撞码与猜错必须用同一句话回答，否则答复本身就是「这个号确实有主」的探针")
                .isEqualTo(wrong);
    }

    @Test
    void consecutiveWrongCodesLockTheNumericEntryAndLockedMeansItIsNotEvenChecked() {
        PaidOrder order = paidOrder();
        for (int attempt = 0; attempt < MerchantNumericCodeAttemptGuard.MAX_CONSECUTIVE_FAILURES; attempt++) {
            assertThatThrownBy(() -> verificationService.scan(principal(), new VerificationScanRequest("000000")))
                    .isInstanceOf(BusinessException.class)
                    .hasMessageContaining("无效或已过期");
        }

        assertThat(errorFrom(() -> verificationService.scan(principal(), new VerificationScanRequest(order.displayCode()))))
                .as("锁定期间连校验都不做：正确的码也一样被挡在门外，枚举无从继续")
                .contains("锁定");
        assertThat(jdbc.queryForObject("""
                select count(*) from merchant_verification_attempt
                where merchant_id = ? and store_id = ? and operator_id = ?
                """, Long.class, merchantId, storeId, principal().operatorId()))
                .as("锁定期间不该产生任何扫码尝试")
                .isZero();
    }

    @Test
    void aWrongCodeThatIsFollowedByTheRightOneClearsTheFailureCount() {
        PaidOrder order = paidOrder();
        for (int attempt = 0; attempt < MerchantNumericCodeAttemptGuard.MAX_CONSECUTIVE_FAILURES - 1; attempt++) {
            assertThatThrownBy(() -> verificationService.scan(principal(), new VerificationScanRequest("000000")))
                    .isInstanceOf(BusinessException.class);
        }

        verificationService.scan(principal(), new VerificationScanRequest(order.displayCode()));

        assertThat(jdbc.queryForObject("""
                select consecutive_failures from merchant_numeric_code_attempt
                where merchant_id = ? and store_id = ? and operator_id = ?
                """, Integer.class, merchantId, storeId, principal().operatorId()))
                .as("输对一次就重新开始数，偶尔手误不该把收银员锁住")
                .isZero();
    }

    @Test
    void anExpiredNumericCodeIsRefusedLikeAnyOtherInvalidCode() {
        PaidOrder order = paidOrder();
        jdbc.update("update order_dynamic_verification_code set expires_at = ? where order_id = ?",
                Timestamp.valueOf(LocalDateTime.now().minusSeconds(1)), order.orderId());

        assertThat(errorFrom(() -> verificationService.scan(principal(), new VerificationScanRequest(order.displayCode()))))
                .as("数字码与动态码同有效期，过了就一样失效")
                .contains("无效或已过期");
    }

    /**
     * 轮换不再作废上一张码：商户扫到的那一瞬间恰好赶上翻转，两次都应该成功。
     *
     * <p>旧的 {@code issueCode} 一生成新码就把旧码置为已失效，于是「刚好翻转」必然失败。
     */
    @Test
    void rotatingTheCodeKeepsThePreviousOneUsableDuringTheOverlap() {
        PaidOrder order = paidOrder();
        String seededCodeToken = jdbc.queryForObject("select code_token from order_dynamic_verification_code where order_id = ?", String.class, order.orderId());
        Map<String, Object> first = pendingUsePortalService.issueCode(order.orderNo(), talentId);
        Map<String, Object> second = pendingUsePortalService.issueCode(order.orderNo(), talentId);

        assertThat(jdbc.queryForObject("select status from order_dynamic_verification_code where code_token = ?", Integer.class, first.get("token")))
                .as("轮换不再把上一张码立刻作废（旧实现一生成新码就把旧码置为已失效）")
                .isZero();
        // 新旧两张码都还能被识别：扫到时刚好翻转，不会再报「核销凭证已失效」。
        scanSucceeds(seededCodeToken);
        scanSucceeds((String) first.get("token"));
        scanSucceeds((String) second.get("token"));
    }

    /** 扫这张码会被识别（失败会抛业务异常）。 */
    private void scanSucceeds(String codeToken) {
        verificationService.scan(principal(), new VerificationScanRequest(codeToken));
    }

    private String errorFrom(org.assertj.core.api.ThrowableAssert.ThrowingCallable action) {
        Throwable thrown = org.assertj.core.api.Assertions.catchThrowable(action);
        assertThat(thrown).isInstanceOf(BusinessException.class);
        return thrown.getMessage();
    }

    private MerchantPrincipal principal() {
        return new MerchantPrincipal(merchantId + 1000, merchantId, storeId, "operator");
    }

    /** 一笔已支付、未核销、可核销的订单，附带一张有效期内的动态核销码（含 6 位数字码）。 */
    private PaidOrder paidOrder() {
        String orderNo = "NUMERIC-" + suffix + "-" + (++sequence);
        jdbc.update("""
                insert into benefit_order(order_no, talent_id, merchant_id, store_id, order_type, order_amount,
                                          base_pay_amount, pay_amount, order_status, verify_status, price_version,
                                          collect_huifu_id, product_name_snapshot)
                values (?, ?, ?, ?, 'GROUP_BUY', 10000, 10000, 10000, 1, 0, 1, ?, '手输核销码测试商品')
                """, orderNo, talentId, merchantId, storeId, huifuId);
        Long orderId = jdbc.queryForObject("select id from benefit_order where order_no = ?", Long.class, orderNo);
        String displayCode = String.format("%06d", 100000 + (System.nanoTime() % 900000));
        jdbc.update("""
                insert into order_dynamic_verification_code(code_token, display_code, order_id, talent_id, expires_at, status)
                values (?, ?, ?, ?, ?, 0)
                """, "numeric-token-" + orderNo, displayCode, orderId, talentId,
                Timestamp.valueOf(LocalDateTime.now().plusSeconds(60)));
        jdbc.update("""
                insert into payment_transaction(payment_no, provider, order_id, order_no, talent_id, merchant_id,
                                                provider_huifu_id, amount, status, idempotency_key, paid_at)
                values (?, 'HUIFU', ?, ?, ?, ?, ?, 10000, 'SUCCEEDED', ?, now())
                """, "P-" + orderNo, orderId, orderNo, talentId, merchantId, huifuId, "numeric-payment-" + orderNo);
        return new PaidOrder(orderNo, orderId, displayCode);
    }

    private record PaidOrder(String orderNo, Long orderId, String displayCode) {
    }
}