package httpapi

import (
	"errors"
	"strings"
	"testing"

	"textmachine/platform/internal/pgstore"
)

// The door exists at all, and it answers the card the canon promises: a `Book`, with the new name on
// it. Before this the route was not mounted and the only name a reader ever had was the one the
// intake derived from their file (unified backlog row 274).
func TestRenamingABookAnswersTheCardWithTheNewName(t *testing.T) {
	lib := &fakeLibrary{book: pgstore.Book{ID: "bk_1", Title: "book_final2", Revision: 4}}
	h := v0Server(t, lib, &fakeRuns{})
	w := call(t, h, "PATCH", "/v0/books/bk_1", `{"title":"Мастер Гу"}`)
	if w.Code != 200 {
		t.Fatalf("PATCH answered %d: %s", w.Code, w.Body)
	}
	if lib.renamedTo != "Мастер Гу" {
		t.Errorf("the store was asked for %q", lib.renamedTo)
	}
	// The IDS the handler passed down, not just the fact that it called. A handler that read the
	// wrong path value, or the wrong principal, renames somebody else's book — and every other
	// assertion in this file would still pass.
	if lib.renamedBook != "bk_1" {
		t.Errorf("the handler renamed book %q, not the one in the path", lib.renamedBook)
	}
	if lib.renamedUser == "" {
		t.Errorf("the handler passed no principal down: ownership would be decided by nobody")
	}
	body := decode(t, w)
	if body["title"] != "Мастер Гу" {
		t.Errorf("the answer does not carry the new name: %v", body)
	}
	// `Book` and not `BookDetail`: the canon's 200 for this operation is the plain card, and it
	// carries a revision so a client can order this write against the frames it is watching.
	if _, ok := body["revision"]; !ok {
		t.Errorf("the answer carries no revision, so a client cannot order it: %v", body)
	}
	if _, ok := body["run"]; ok {
		t.Errorf("the answer carries a run, which the canon's Book does not: %v", body)
	}
}

// `title: null` is REFUSED, and that is a deliberate narrowing of RFC 7386 — where null means
// "remove this member" — written into the canon: a book without a title is not a state this surface
// has, and quietly restoring the derived name would be a rename nobody asked for.
//
// Mutation caught: decoding into a `*string`, which collapses `null` and "absent" into one value and
// turns the refusal into a silent no-op.
func TestRemovingATitleIsRefusedAndWritesNothing(t *testing.T) {
	lib := &fakeLibrary{book: pgstore.Book{ID: "bk_1", Title: "kept"}}
	h := v0Server(t, lib, &fakeRuns{})
	w := call(t, h, "PATCH", "/v0/books/bk_1", `{"title":null}`)
	if w.Code != 400 {
		t.Fatalf("null title answered %d: %s", w.Code, w.Body)
	}
	if lib.renames != 0 {
		t.Errorf("the store was written to on a refused patch (%d times)", lib.renames)
	}
	if !strings.Contains(w.Body.String(), "/title") {
		t.Errorf("the refusal does not point at the member: %s", w.Body)
	}
}

// A member absent from a merge patch is left alone — so an empty patch changes nothing, writes
// nothing and does not move the revision. Without this branch an empty body would either fail or
// store the zero value over the name.
func TestAPatchWithNoTitleChangesNothing(t *testing.T) {
	lib := &fakeLibrary{book: pgstore.Book{ID: "bk_1", Title: "unchanged", Revision: 9}}
	h := v0Server(t, lib, &fakeRuns{})
	w := call(t, h, "PATCH", "/v0/books/bk_1", `{}`)
	if w.Code != 200 {
		t.Fatalf("an empty patch answered %d: %s", w.Code, w.Body)
	}
	if lib.renames != 0 {
		t.Errorf("an empty patch wrote to the store %d times", lib.renames)
	}
	if decode(t, w)["title"] != "unchanged" {
		t.Errorf("an empty patch changed the card: %s", w.Body)
	}
}

// The canon's own bounds, enforced by REFUSING rather than by repairing. The intake truncates a name
// it derived from a file because the user did not choose it; here they typed it, and answering a
// card with something other than what they typed is a rename they did not make.
func TestATitleOutsideTheCanonsBoundsIsRefusedRatherThanTrimmed(t *testing.T) {
	lib := &fakeLibrary{book: pgstore.Book{ID: "bk_1", Title: "kept"}}
	h := v0Server(t, lib, &fakeRuns{})
	for name, body := range map[string]string{
		"too long":        `{"title":"` + strings.Repeat("ы", 201) + `"}`,
		"empty":           `{"title":""}`,
		"only whitespace": `{"title":"   "}`,
		"not a string":    `{"title":42}`,
	} {
		w := call(t, h, "PATCH", "/v0/books/bk_1", body)
		if w.Code != 400 {
			t.Errorf("%s: answered %d, want 400: %s", name, w.Code, w.Body)
		}
		if !strings.Contains(w.Body.String(), "/title") {
			t.Errorf("%s: the refusal does not point at the member: %s", name, w.Body)
		}
	}
	// Exactly at the bound is ACCEPTED: an off-by-one here refuses a name the canon allows.
	if w := call(t, h, "PATCH", "/v0/books/bk_1", `{"title":"`+strings.Repeat("ы", 200)+`"}`); w.Code != 200 {
		t.Errorf("a title of exactly 200 runes was refused: %d %s", w.Code, w.Body)
	}
	if lib.renames != 1 {
		t.Errorf("the store was written %d times, want only the accepted one", lib.renames)
	}
}

// A body of the bare literal `null` is a REFUSAL and not an empty patch. It decodes into a nil map
// without error, so every member reads as absent and the handler would have answered 200 with the
// card — measured live before the guard. The canon declares this body `required: true` with
// `schema: BookPatch` (`type: object`), and `null` is the one JSON value that means "no document".
//
// Mutation caught: dropping the nil-map check.
func TestABodyOfNullIsRefusedRatherThanReadAsAnEmptyPatch(t *testing.T) {
	lib := &fakeLibrary{book: pgstore.Book{ID: "bk_1", Title: "kept"}}
	h := v0Server(t, lib, &fakeRuns{})
	if w := call(t, h, "PATCH", "/v0/books/bk_1", `null`); w.Code != 400 {
		t.Errorf("a body of `null` answered %d, want 400: %s", w.Code, w.Body)
	}
	if lib.renames != 0 {
		t.Errorf("a body of `null` reached the store %d times", lib.renames)
	}
}

// ⛔ A TITLE THIS SURFACE ACCEPTS MUST NOT BE ONE THE DATABASE REFUSES. Measured live before the
// guard: a title carrying U+0000 reached Postgres, which cannot hold it in a `text` column, and the
// caller got `500 internal_error` — a code this operation's canon does not list, for a request that
// was simply wrong.
//
// ⚠ The second half of this test is the one that will matter later: bidi MARKS and the zero-width
// joiners are ordinary content in Hebrew, Arabic, Devanagari and Persian, and a guard that banned
// "everything invisible" would quietly refuse a legitimate title in a language pair this repository
// does not carry yet. The engine's own inbound fence draws the line in the same place, and its own
// session said so explicitly when it landed.
func TestAControlCharacterInATitleIsRefusedButBidiMarksAreNot(t *testing.T) {
	lib := &fakeLibrary{book: pgstore.Book{ID: "bk_1", Title: "kept"}}
	h := v0Server(t, lib, &fakeRuns{})
	for name, escape := range map[string]string{
		"NUL":                 `\u0000`,
		"newline":             `\u000a`,
		"escape":              `\u001b`,
		"line separator":      `\u2028`,
		"paragraph separator": `\u2029`,
	} {
		w := call(t, h, "PATCH", "/v0/books/bk_1", `{"title":"be`+escape+`fore"}`)
		if w.Code != 400 {
			t.Errorf("%s: answered %d, want 400: %s", name, w.Code, w.Body)
		}
		if !strings.Contains(w.Body.String(), "/title") {
			t.Errorf("%s: the refusal does not point at the member", name)
		}
	}
	// Legitimate content that must NOT be refused.
	for name, escape := range map[string]string{
		"right-to-left mark": `\u200f`,
		"left-to-right mark": `\u200e`,
		"zero-width joiner":  `\u200d`,
		"soft hyphen":        `\u00ad`,
	} {
		if w := call(t, h, "PATCH", "/v0/books/bk_1", `{"title":"ab`+escape+`cd"}`); w.Code != 200 {
			t.Errorf("%s: a legitimate title was refused with %d: %s", name, w.Code, w.Body)
		}
	}
}

// Somebody else's book is a 404, like every other book-scoped route: the store answers ErrNoBook for
// both "not there" and "not yours", and telling them apart would let anyone enumerate libraries.
func TestRenamingSomebodyElsesBookIsIndistinguishableFromAMissingOne(t *testing.T) {
	lib := &fakeLibrary{err: pgstore.ErrNoBook}
	h := v0Server(t, lib, &fakeRuns{})
	w := call(t, h, "PATCH", "/v0/books/bk_secret", `{"title":"mine now"}`)
	if w.Code != 404 {
		t.Fatalf("answered %d, want 404: %s", w.Code, w.Body)
	}
	if strings.Contains(strings.ToLower(w.Body.String()), "forbidden") {
		t.Errorf("the answer distinguishes ownership from existence: %s", w.Body)
	}
}

// A body that is not JSON is the ordinary 400 of this surface, never a 500.
func TestAMalformedPatchBodyIsTheOrdinaryRefusal(t *testing.T) {
	lib := &fakeLibrary{book: pgstore.Book{ID: "bk_1"}}
	h := v0Server(t, lib, &fakeRuns{})
	for _, body := range []string{`not json`, `[]`, `"just a string"`} {
		if w := call(t, h, "PATCH", "/v0/books/bk_1", body); w.Code != 400 {
			t.Errorf("%q answered %d, want 400: %s", body, w.Code, w.Body)
		}
	}
	if lib.renames != 0 {
		t.Errorf("a malformed patch reached the store %d times", lib.renames)
	}
}

// A store failure that is not ErrNoBook is not swallowed into a 200.
func TestAStoreFailureOnRenameIsNotAnswerAsSuccess(t *testing.T) {
	lib := &fakeLibrary{err: errors.New("the database is down")}
	h := v0Server(t, lib, &fakeRuns{})
	if w := call(t, h, "PATCH", "/v0/books/bk_1", `{"title":"x"}`); w.Code == 200 {
		t.Errorf("a failed write answered 200: %s", w.Body)
	}
}