package cli

import (
	"bytes"
	"context"
	"errors"
	"io"
	"net/url"
	"os"
	"path/filepath"
	"slices"
	"strings"
	"testing"

	"git.pcux.cn/xuans/Scert/backend/internal/config"
	"git.pcux.cn/xuans/Scert/backend/internal/database"
	"git.pcux.cn/xuans/Scert/backend/internal/secretstore"
)

func TestPostgresRealBackupRestore(t *testing.T) {
	f := startRealPostgres(t)
	for _, scenario := range []string{"success", "certificate", "cancel", "permission", "inventory", "authentication", "tls"} {
		t.Run(scenario, func(t *testing.T) {
			dbName := "scert_" + scenario
			realPostgresExec(t, f.admin, "CREATE DATABASE "+dbName+" OWNER scert_owner")
			conn := f.connect(t, dbName, "scert_owner")
			var tls bool
			if err := conn.QueryRow(t.Context(), "SELECT ssl FROM pg_stat_ssl WHERE pid = pg_backend_pid()").Scan(&tls); err != nil || !tls {
				t.Fatal("真实数据库连接必须启用 TLS")
			}
			root := filepath.Join(f.root, scenario)
			cfg := config.Default(root)
			cfg.Paths = config.PathsConfig{
				Install: root, Config: filepath.Join(root, "conf"), Data: filepath.Join(root, "data"),
				Certificate: filepath.Join(root, "ssl"), Log: filepath.Join(root, "log"), Backup: filepath.Join(root, "snapshots"),
			}
			cfg.Database = config.DatabaseConfig{Driver: "postgres", DSN: f.dsn(dbName, ""), CredentialRef: "secret://database/maintenance", MaxOpenConns: 4, MaxIdleConns: 2}
			current := filepath.Join(cfg.Paths.Config, "scert.json")
			if err := cfg.Save(current); err != nil {
				t.Fatal(err)
			}
			store, err := secretstore.Open(cfg.Paths.Config)
			if err != nil {
				t.Fatal(err)
			}
			if err := store.Put(t.Context(), cfg.Database.CredentialRef, map[string]string{"username": "scert_owner", "password": f.password}); err != nil {
				t.Fatal(err)
			}
			connection, err := resolveMaintenanceDatabase(t.Context(), cfg.Database, cfg.Paths.Config)
			if err != nil {
				t.Fatal(err)
			}
			db, err := database.Open(t.Context(), connection)
			if err != nil {
				t.Fatal("真实数据库迁移连接失败")
			}
			err = database.Migrate(t.Context(), db.DB, "postgres")
			_ = db.Close()
			if err != nil {
				t.Fatal(err)
			}
			realPostgresExec(t, conn, "INSERT INTO settings (key, value) VALUES ('integration', 'backup')")
			realPostgresExec(t, conn, "INSERT INTO audit_logs (action, resource_type, resource_id, status, message) VALUES ('backup', 'test', '1', 'ok', 'backup')")
			realPostgresExec(t, conn, "GRANT SELECT ON settings TO scert_reader")
			if scenario == "permission" {
				admin := f.connect(t, dbName, "postgres")
				realPostgresExec(t, admin, "CREATE TABLE protected_record (value TEXT)")
				realPostgresExec(t, admin, "INSERT INTO protected_record VALUES ('preserved')")
				realPostgresExec(t, admin, "GRANT SELECT ON protected_record TO scert_owner")
			}
			if err := os.MkdirAll(cfg.Paths.Certificate, 0o700); err != nil {
				t.Fatal(err)
			}
			certificate := filepath.Join(cfg.Paths.Certificate, "integration.pem")
			certData, err := os.ReadFile(f.ca)
			if err != nil {
				t.Fatal(err)
			}
			realPostgresWrite(t, certificate, certData)
			previous := configPath
			configPath = current
			t.Cleanup(func() { configPath = previous })
			input := filepath.Join(root, "backup")
			if _, err := f.runCLI(t, current, "backup", "--output", input); err != nil {
				t.Fatal(err)
			}
			if err := validateBackupManifest(input); err != nil {
				t.Fatal(err)
			}
			if scenario == "authentication" || scenario == "tls" {
				if scenario == "authentication" {
					if err := store.Put(t.Context(), cfg.Database.CredentialRef, map[string]string{"username": "scert_owner", "password": "incorrect-password"}); err != nil {
						t.Fatal(err)
					}
				} else {
					// 使用不信任服务端的独立 CA，验证不能静默降级 TLS。
					wrongCA := filepath.Join(root, "untrusted.crt")
					realPostgresTLS(t, wrongCA, filepath.Join(root, "untrusted.key"))
					cfg.Database.DSN = postgresIntegrationCA(t, cfg.Database.DSN, wrongCA)
					if err := cfg.Save(current); err != nil {
						t.Fatal(err)
					}
				}
				output := filepath.Join(root, "rejected-backup")
				if _, err := f.runCLI(t, current, "backup", "--output", output); err == nil || strings.Contains(err.Error(), f.password) {
					t.Fatal("认证或 TLS 错误必须拒绝且不得泄漏密码")
				}
				if _, err := os.Stat(output); !os.IsNotExist(err) {
					t.Fatal("认证或 TLS 失败不得发布备份")
				}
				return
			}
			realPostgresExec(t, conn, "UPDATE settings SET value = 'current' WHERE key = 'integration'")
			realPostgresExec(t, conn, "INSERT INTO audit_logs (action, resource_type, resource_id, status, message) VALUES ('current', 'test', '2', 'ok', 'current')")
			cfg.Server.Port++
			if err := cfg.Save(current); err != nil {
				t.Fatal(err)
			}
			if err := store.Put(t.Context(), "secret://integration/marker", map[string]string{"value": "current"}); err != nil {
				t.Fatal(err)
			}
			realPostgresWrite(t, certificate, []byte("current-certificate"))
			if scenario == "certificate" {
				if err := os.Rename(cfg.Paths.Certificate, cfg.Paths.Certificate+"-preserved"); err != nil {
					t.Fatal(err)
				}
				realPostgresWrite(t, cfg.Paths.Certificate, []byte("blocked-target"))
			}
			if scenario == "inventory" {
				realPostgresExec(t, conn, "CREATE TABLE extra_record (value TEXT)")
			}
			before := make(map[string][]byte)
			for _, name := range []string{"scert.json", "master.key", "secrets.json"} {
				before[name], err = os.ReadFile(filepath.Join(cfg.Paths.Config, name))
				if err != nil {
					t.Fatal(err)
				}
			}
			var output bytes.Buffer
			command := newRestoreCommand()
			ctx, cancel := context.WithCancel(t.Context())
			defer cancel()
			if scenario == "cancel" {
				// 真正导入完成后确定性取消，反向回滚仍执行官方工具和真实数据库。
				command = newRestoreCommandWithPostgresTools(func(ctx context.Context) (*postgresTools, error) {
					tools, err := loadPostgresTools(ctx)
					if err != nil {
						return nil, err
					}
					tools.run = func(ctx context.Context, path string, args, env []string, output io.Writer) error {
						err := executePostgresTool(ctx, path, args, env, output)
						if err == nil && slices.Contains(args, "--single-transaction") && args[len(args)-1] == filepath.Join(input, "scert.pgdump") {
							cancel()
						}
						return err
					}
					return tools, nil
				})
			}
			command.SetArgs([]string{"--input", input})
			command.SetContext(ctx)
			command.SetOut(&output)
			command.SetErr(&output)
			if scenario == "cancel" {
				err = command.Execute()
			} else {
				var text string
				text, err = f.runCLI(t, current, "restore", "--input", input)
				output.WriteString(text)
			}
			want, count := "backup", 1
			if scenario == "success" {
				if err != nil || !strings.Contains(output.String(), "恢复已完成") {
					t.Fatalf("真实恢复失败：%v", err)
				}
				for _, name := range []string{"scert.json", "master.key", "secrets.json"} {
					assertRealPostgresFile(t, filepath.Join(cfg.Paths.Config, name), filepath.Join(input, name))
				}
				assertRealPostgresFile(t, certificate, filepath.Join(input, "certificates", "integration.pem"))
			} else {
				want, count = "current", 2
				if err == nil || strings.Contains(output.String(), "恢复已完成") || strings.Contains(err.Error(), f.password) {
					t.Fatal("受控失败不得误报成功或泄漏密码")
				}
				if scenario == "permission" && !strings.Contains(err.Error(), "数据库自动回滚失败") {
					t.Fatal("恢复及反向导入权限不足时必须提示人工处理")
				}
				if scenario == "cancel" && !errors.Is(err, context.Canceled) {
					t.Fatal("取消场景必须到达真实导入后的取消检查")
				}
				if scenario == "certificate" && !strings.Contains(err.Error(), "恢复敏感配置或证书失败") {
					t.Fatal("证书失败场景必须到达数据库导入后的资源恢复阶段")
				}
				if scenario == "inventory" && !strings.Contains(err.Error(), "对象清单不一致") {
					t.Fatal("额外对象必须由归档清单检查拦截")
				}
				for name, expected := range before {
					actual, readErr := os.ReadFile(filepath.Join(cfg.Paths.Config, name))
					if readErr != nil || !bytes.Equal(actual, expected) {
						t.Fatalf("失败恢复改变了当前文件：%s", name)
					}
				}
			}
			var value, owner string
			var rows, next int
			var allowed bool
			if err := conn.QueryRow(t.Context(), "SELECT value FROM settings WHERE key = 'integration'").Scan(&value); err != nil || value != want {
				t.Fatal("真实数据库内容不符合恢复或回滚结果")
			}
			if err := conn.QueryRow(t.Context(), "SELECT count(*) FROM audit_logs").Scan(&rows); err != nil || rows != count {
				t.Fatal("真实审计记录未正确恢复")
			}
			if err := conn.QueryRow(t.Context(), "SELECT nextval(pg_get_serial_sequence('audit_logs', 'id'))").Scan(&next); err != nil || next != count+1 {
				t.Fatal("真实自增序列未正确恢复")
			}
			if err := conn.QueryRow(t.Context(), "SELECT tableowner FROM pg_tables WHERE schemaname = 'public' AND tablename = 'settings'").Scan(&owner); err != nil || owner != "scert_owner" {
				t.Fatal("对象所有者未保留")
			}
			if err := conn.QueryRow(t.Context(), "SELECT has_table_privilege('scert_reader', 'settings', 'SELECT')").Scan(&allowed); err != nil || !allowed {
				t.Fatal("对象授权未保留")
			}
			if scenario == "permission" {
				if err := conn.QueryRow(t.Context(), "SELECT value FROM protected_record").Scan(&value); err != nil || value != "preserved" {
					t.Fatal("权限失败不能改变受保护表")
				}
			}
			snapshots, err := filepath.Glob(filepath.Join(cfg.Paths.Backup, "scert-postgres-before-restore-*", "scert.pgdump"))
			if err != nil || len(snapshots) != 1 {
				t.Fatal("必须保留恢复前真实快照")
			}
			t.Log("真实 CLI、迁移、业务数据、序列、所有者、授权及恢复保护检查通过")
		})
	}
}

func assertRealPostgresFile(t *testing.T, actual, expected string) {
	t.Helper()
	left, leftErr := os.ReadFile(actual)
	right, rightErr := os.ReadFile(expected)
	if leftErr != nil || rightErr != nil || !bytes.Equal(left, right) {
		t.Fatal("真实恢复后的文件与备份不一致")
	}
}

// 保持测试辅助函数与运行时连接校验使用相同的结构化 URL 语义。
func postgresIntegrationCA(t *testing.T, dsn, ca string) string {
	t.Helper()
	parsed, err := url.Parse(dsn)
	if err != nil {
		t.Fatal("测试连接解析失败")
	}
	query := parsed.Query()
	query.Set("sslrootcert", ca)
	parsed.RawQuery = query.Encode()
	return parsed.String()
}