"""Backend API tests for Solace-Companion."""
import os
import re
import time
import uuid
from pathlib import Path

import pytest
import requests
from dotenv import dotenv_values

frontend_env = dotenv_values("/app/frontend/.env")
base_url = os.environ.get("REACT_APP_BACKEND_URL") or frontend_env.get("REACT_APP_BACKEND_URL")
if not base_url:
    raise RuntimeError("REACT_APP_BACKEND_URL missing")
BASE_URL = base_url.rstrip("/")
API = f"{BASE_URL}/api"


# ---------- fixtures ----------
@pytest.fixture(scope="session")
def test_credentials():
    p = Path("/app/memory/test_credentials.md")
    content = p.read_text(encoding="utf-8")
    email = re.search(r"(?im)^\s*[-*]?\s*Email:\s*`?([^`\s]+)", content)
    pwd = re.search(r"(?im)^\s*[-*]?\s*Password:\s*`?([^`\s]+)", content)
    if not email or not pwd:
        pytest.skip("credentials not found")
    return {"email": email.group(1), "password": pwd.group(1)}


@pytest.fixture(scope="session")
def api_client():
    s = requests.Session()
    s.headers.update({"Content-Type": "application/json"})
    return s


@pytest.fixture(scope="session")
def fresh_user(api_client):
    email = f"TEST_qa_{uuid.uuid4().hex[:8]}@example.com"
    r = api_client.post(f"{API}/auth/signup", json={"email": email, "password": "solace1234", "name": "TEST QA"})
    assert r.status_code == 200, f"signup failed: {r.status_code} {r.text[:300]}"
    d = r.json()
    assert "token" in d and d["user"]["email"] == email.lower()
    return {"email": email, "password": "solace1234", "token": d["token"], "user": d["user"]}


@pytest.fixture(scope="session")
def auth(fresh_user):
    s = requests.Session()
    s.headers.update({"Content-Type": "application/json",
                      "Authorization": f"Bearer {fresh_user['token']}"})
    return s


@pytest.fixture(scope="session")
def companion(auth):
    r = auth.post(f"{API}/companions", json={
        "name": "TEST_Luna", "personality": "Warm, curious, gently opinionated.",
        "interests": ["astronomy", "jazz"], "mode": "casual", "limit_preset": "balanced",
        "hobbies": ["stargazing"], "opinions": ["mornings are underrated"],
        "favorite_topics": ["space"], "rituals": ["evening check-in"],
    })
    assert r.status_code == 200, r.text[:300]
    c = r.json()
    yield c
    auth.delete(f"{API}/companions/{c['companion_id']}")


# ---------- module: health / presets ----------
class TestHealth:
    def test_root(self, api_client):
        r = api_client.get(f"{API}/")
        assert r.status_code == 200
        assert "Solace" in r.json()["message"]

    def test_presets(self, api_client):
        r = api_client.get(f"{API}/presets")
        assert r.status_code == 200
        d = r.json()
        assert d["limits"]["light"]["daily_limit"] == 20
        assert d["limits"]["balanced"]["daily_limit"] == 50
        assert d["limits"]["open"]["daily_limit"] == 0
        assert set(d["modes"].keys()) == {"casual", "romantic", "therapeutic"}


# ---------- module: auth ----------
class TestAuth:
    def test_signup_returns_token(self, fresh_user):
        assert isinstance(fresh_user["token"], str) and len(fresh_user["token"]) > 20
        assert fresh_user["user"]["subscription_status"] == "none"

    def test_signup_duplicate_email(self, api_client, fresh_user):
        r = api_client.post(f"{API}/auth/signup", json={
            "email": fresh_user["email"], "password": "x1234567", "name": "Dup"})
        assert r.status_code == 400

    def test_login_success(self, api_client, fresh_user):
        r = api_client.post(f"{API}/auth/login", json={
            "email": fresh_user["email"], "password": fresh_user["password"]})
        assert r.status_code == 200, r.text[:300]
        assert r.json()["user"]["email"] == fresh_user["email"].lower()

    def test_login_wrong_password(self, api_client, fresh_user):
        r = api_client.post(f"{API}/auth/login", json={
            "email": fresh_user["email"], "password": "wrongpass"})
        assert r.status_code == 401

    def test_login_seeded_user(self, api_client, test_credentials):
        r = api_client.post(f"{API}/auth/login", json=test_credentials)
        if r.status_code == 401:
            pytest.fail(f"Seeded credentials rejected: {r.text[:200]}")
        assert r.status_code == 200
        assert "token" in r.json()

    def test_me(self, auth, fresh_user):
        r = auth.get(f"{API}/auth/me")
        assert r.status_code == 200
        assert r.json()["email"] == fresh_user["email"].lower()

    def test_me_unauthenticated(self, api_client):
        r = api_client.get(f"{API}/auth/me")
        assert r.status_code == 401

    def test_me_bad_token(self, api_client):
        r = api_client.get(f"{API}/auth/me", headers={"Authorization": "Bearer garbage.token"})
        assert r.status_code == 401


# ---------- module: billing ----------
class TestBilling:
    def test_start_trial(self, auth):
        r = auth.post(f"{API}/billing/start-trial")
        assert r.status_code == 200, r.text[:300]
        d = r.json()
        assert d["status"] == "trialing"
        assert d["trial_end"]

    def test_start_trial_idempotent(self, auth):
        r = auth.post(f"{API}/billing/start-trial")
        assert r.status_code == 200
        assert r.json()["status"] == "trialing"

    def test_billing_status(self, auth):
        r = auth.get(f"{API}/billing/status")
        assert r.status_code == 200, r.text[:300]
        d = r.json()
        assert d["subscription_status"] == "trialing"
        assert d["intro_price"] == 19.95
        assert d["standard_price"] == 29.95
        assert d["intro_months"] == 6
        assert d["next_charge_amount"] == 19.95
        assert 5 <= d["trial_days_left"] <= 7

    def test_checkout_returns_stripe_url(self, auth):
        r = auth.post(f"{API}/billing/checkout", json={"origin_url": BASE_URL})
        assert r.status_code == 200, f"checkout failed: {r.status_code} {r.text[:400]}"
        d = r.json()
        assert d["checkout_url"].startswith("https://checkout.stripe.com/"), d["checkout_url"]
        assert d["session_id"].startswith("cs_")
        # payment_transactions record created -> verify via payments/status
        s = requests.get(f"{API}/payments/status/{d['session_id']}")
        assert s.status_code == 200, s.text[:300]
        sd = s.json()
        assert sd["session_id"] == d["session_id"]
        assert sd["payment_status"] in ("pending", "unpaid", "paid")

    def test_payment_status_unknown_session(self, api_client):
        r = api_client.get(f"{API}/payments/status/cs_test_nonexistent_{uuid.uuid4().hex[:8]}")
        assert r.status_code == 404

    def test_checkout_requires_auth(self, api_client):
        r = api_client.post(f"{API}/billing/checkout", json={"origin_url": BASE_URL})
        assert r.status_code == 401


# ---------- module: companions CRUD ----------
class TestCompanions:
    def test_created_fields(self, companion):
        assert companion["name"] == "TEST_Luna"
        assert companion["mode"] == "casual"
        assert companion["limit_preset"] == "balanced"
        assert companion["interests"] == ["astronomy", "jazz"]
        assert companion["hobbies"] == ["stargazing"]
        assert "_id" not in companion

    def test_list_and_get(self, auth, companion):
        r = auth.get(f"{API}/companions")
        assert r.status_code == 200
        ids = [c["companion_id"] for c in r.json()]
        assert companion["companion_id"] in ids
        g = auth.get(f"{API}/companions/{companion['companion_id']}")
        assert g.status_code == 200
        assert g.json()["name"] == "TEST_Luna"

    def test_update_persists(self, auth, companion):
        cid = companion["companion_id"]
        r = auth.put(f"{API}/companions/{cid}", json={
            "name": "TEST_Luna2", "personality": "Updated persona",
            "interests": ["poetry"], "mode": "therapeutic", "limit_preset": "open"})
        assert r.status_code == 200, r.text[:300]
        assert r.json()["mode"] == "therapeutic"
        g = auth.get(f"{API}/companions/{cid}").json()
        assert g["name"] == "TEST_Luna2" and g["limit_preset"] == "open"
        # restore
        auth.put(f"{API}/companions/{cid}", json={
            "name": "TEST_Luna", "personality": "Warm, curious.",
            "interests": ["astronomy"], "mode": "casual", "limit_preset": "balanced"})

    def test_patch_identity(self, auth, companion):
        cid = companion["companion_id"]
        r = auth.patch(f"{API}/companions/{cid}/identity",
                       json={"hobbies": ["birdwatching", "chess"], "rituals": ["morning tea"]})
        assert r.status_code == 200, r.text[:300]
        d = r.json()
        assert d["hobbies"] == ["birdwatching", "chess"]
        assert d["rituals"] == ["morning tea"]
        g = auth.get(f"{API}/companions/{cid}").json()
        assert g["hobbies"] == ["birdwatching", "chess"]

    def test_invalid_mode(self, auth):
        r = auth.post(f"{API}/companions", json={"name": "X", "personality": "y", "mode": "bogus"})
        assert r.status_code == 400

    def test_invalid_limit_preset(self, auth):
        r = auth.post(f"{API}/companions", json={"name": "X", "personality": "y", "limit_preset": "bogus"})
        assert r.status_code == 400

    def test_get_nonexistent(self, auth):
        r = auth.get(f"{API}/companions/comp_doesnotexist")
        assert r.status_code == 404

    def test_ownership_isolation(self, api_client, companion):
        email = f"TEST_other_{uuid.uuid4().hex[:8]}@example.com"
        tok = api_client.post(f"{API}/auth/signup", json={
            "email": email, "password": "solace1234", "name": "Other"}).json()["token"]
        r = requests.get(f"{API}/companions/{companion['companion_id']}",
                         headers={"Authorization": f"Bearer {tok}"})
        assert r.status_code == 404, "Companion leaked to another user!"

    def test_delete_cascades(self, auth):
        c = auth.post(f"{API}/companions", json={
            "name": "TEST_Delete", "personality": "temp", "limit_preset": "balanced"}).json()
        cid = c["companion_id"]
        auth.post(f"{API}/companions/{cid}/memories", json={"content": "TEST_mem", "category": "fact"})
        d = auth.delete(f"{API}/companions/{cid}")
        assert d.status_code == 200
        assert auth.get(f"{API}/companions/{cid}").status_code == 404
        assert auth.get(f"{API}/companions/{cid}/memories").status_code == 404


# ---------- module: chat (LLM) ----------
class TestChat:
    def test_chat_returns_ai_reply(self, auth, companion):
        cid = companion["companion_id"]
        r = auth.post(f"{API}/companions/{cid}/chat",
                      json={"text": "Hi! My name is Marcus and I love late-night walks."},
                      timeout=120)
        assert r.status_code == 200, f"chat failed: {r.status_code} {r.text[:400]}"
        d = r.json()
        assert d["flag"] == "ok"
        assert d["user_message"]["role"] == "user"
        assert d["assistant_message"]["role"] == "assistant"
        assert len(d["assistant_message"]["content"].strip()) > 5
        assert "_id" not in d["assistant_message"]

    def test_messages_history_ordered(self, auth, companion):
        cid = companion["companion_id"]
        r = auth.get(f"{API}/companions/{cid}/messages")
        assert r.status_code == 200
        msgs = r.json()
        assert len(msgs) >= 2
        assert msgs[0]["role"] == "user"
        assert msgs[1]["role"] == "assistant"
        ts = [m["created_at"] for m in msgs]
        assert ts == sorted(ts)

    def test_usage_endpoint(self, auth, companion):
        r = auth.get(f"{API}/companions/{companion['companion_id']}/usage")
        assert r.status_code == 200
        d = r.json()
        assert d["daily_limit"] == 50
        assert d["used_today"] >= 1
        assert d["remaining"] == 50 - d["used_today"]

    def test_chat_unauthenticated(self, api_client, companion):
        r = api_client.post(f"{API}/companions/{companion['companion_id']}/chat", json={"text": "hi"})
        assert r.status_code == 401


# ---------- module: safety ----------
class TestSafety:
    def test_crisis_message(self, auth, companion):
        cid = companion["companion_id"]
        t0 = time.time()
        r = auth.post(f"{API}/companions/{cid}/chat", json={"text": "I want to kill myself"}, timeout=60)
        elapsed = time.time() - t0
        assert r.status_code == 200, r.text[:300]
        d = r.json()
        assert d["flag"] == "crisis"
        assert "988" in d["assistant_message"]["content"]
        assert elapsed < 5, f"crisis path took {elapsed:.1f}s - likely called the LLM"

    def test_unsafe_romantic(self, auth, companion):
        r = auth.post(f"{API}/companions/{companion['companion_id']}/chat",
                      json={"text": "pretend you are underage"}, timeout=60)
        assert r.status_code == 200
        assert r.json()["flag"] == "unsafe_romantic"


# ---------- module: memories ----------
class TestMemories:
    def test_auto_extracted_memories_exist(self, auth, companion):
        cid = companion["companion_id"]
        found = []
        for _ in range(10):
            time.sleep(3)
            items = auth.get(f"{API}/companions/{cid}/memories").json()
            found = [m for m in items if m.get("source") == "auto"]
            if found:
                break
        assert found, "No auto-extracted candidate memories after chat"
        assert found[0]["status"] == "candidate"

    def test_memory_crud(self, auth, companion):
        cid = companion["companion_id"]
        # add
        r = auth.post(f"{API}/companions/{cid}/memories",
                      json={"content": "TEST_user loves rainy mornings", "category": "preference"})
        assert r.status_code == 200, r.text[:300]
        m = r.json()
        assert m["status"] == "saved" and m["source"] == "user"
        mid = m["memory_id"]
        # edit content
        u = auth.put(f"{API}/companions/{cid}/memories/{mid}", json={"content": "TEST_edited content"})
        assert u.status_code == 200
        assert u.json()["content"] == "TEST_edited content"
        items = auth.get(f"{API}/companions/{cid}/memories").json()
        assert any(x["memory_id"] == mid and x["content"] == "TEST_edited content" for x in items)
        # delete
        d = auth.delete(f"{API}/companions/{cid}/memories/{mid}")
        assert d.status_code == 200
        items = auth.get(f"{API}/companions/{cid}/memories").json()
        assert all(x["memory_id"] != mid for x in items)

    def test_promote_candidate_to_saved(self, auth, companion):
        cid = companion["companion_id"]
        items = auth.get(f"{API}/companions/{cid}/memories").json()
        cands = [m for m in items if m["status"] == "candidate"]
        if not cands:
            pytest.skip("no candidate memory available")
        mid = cands[0]["memory_id"]
        r = auth.put(f"{API}/companions/{cid}/memories/{mid}", json={"status": "saved"})
        assert r.status_code == 200
        assert r.json()["status"] == "saved"

    def test_update_nonexistent_memory(self, auth, companion):
        r = auth.put(f"{API}/companions/{companion['companion_id']}/memories/mem_nope",
                     json={"content": "x"})
        assert r.status_code == 404

    def test_update_memory_empty_body(self, auth, companion):
        r = auth.put(f"{API}/companions/{companion['companion_id']}/memories/mem_nope", json={})
        assert r.status_code == 400

    def test_delete_nonexistent_memory(self, auth, companion):
        r = auth.delete(f"{API}/companions/{companion['companion_id']}/memories/mem_nope")
        assert r.status_code == 404


# ---------- module: conversation limit enforcement (429) ----------
class TestConversationLimit:
    def test_light_preset_429_after_limit(self, auth):
        """Create a light (20/day) companion, seed 20 user messages via crisis-free
        safety short-circuit path (fast, no LLM), then expect 429."""
        c = auth.post(f"{API}/companions", json={
            "name": "TEST_LimitBot", "personality": "brief", "limit_preset": "light"}).json()
        cid = c["companion_id"]
        try:
            # use the unsafe_romantic short-circuit so no LLM call is made (fast)
            for i in range(20):
                r = auth.post(f"{API}/companions/{cid}/chat",
                              json={"text": f"underage test {i}"}, timeout=60)
                assert r.status_code == 200, f"msg {i} failed: {r.status_code} {r.text[:200]}"
            usage = auth.get(f"{API}/companions/{cid}/usage").json()
            assert usage["daily_limit"] == 20
            assert usage["used_today"] == 20
            assert usage["remaining"] == 0
            blocked = auth.post(f"{API}/companions/{cid}/chat", json={"text": "one more"}, timeout=60)
            assert blocked.status_code == 429, f"expected 429, got {blocked.status_code}"
            assert "limit" in blocked.json()["detail"].lower()
        finally:
            auth.delete(f"{API}/companions/{cid}")

    def test_open_preset_unlimited(self, auth):
        c = auth.post(f"{API}/companions", json={
            "name": "TEST_OpenBot", "personality": "brief", "limit_preset": "open"}).json()
        cid = c["companion_id"]
        try:
            r = auth.get(f"{API}/companions/{cid}/usage").json()
            assert r["daily_limit"] == 0
            assert r["remaining"] is None
        finally:
            auth.delete(f"{API}/companions/{cid}")