use std::{
    fs,
    io::Read,
    os::unix::fs::PermissionsExt,
    process::{Command, Stdio},
    sync::atomic::{AtomicU64, Ordering},
    time::{SystemTime, UNIX_EPOCH},
};

use crank_registry::{MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, PostgresRegistry};
use crank_runtime::SecretCrypto;
use time::{OffsetDateTime, format_description::well_known::Rfc3339};

const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
const REGISTERED_MASTER_KEY: &str = "registered-master-key-CANARY_SECRET_VALUE-00000000";
const WRONG_MASTER_KEY: &str = "wrong-master-key-CANARY_SECRET_VALUE-0000000000000";
static NEXT_STORAGE_ROOT: AtomicU64 = AtomicU64::new(0);

fn run_with(entries: &[(&str, &str)]) -> String {
    let mut command = Command::new(env!("CARGO_BIN_EXE_admin-api"));
    for field in crank_config::field_registry() {
        command.env_remove(field.env_name);
    }
    command.envs([
        ("CRANK_MASTER_KEY", TEST_MASTER_KEY),
        ("CRANK_SESSION_SECRET", "session"),
        ("CRANK_PASSWORD_PEPPER", "pepper"),
        ("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),
        ("CRANK_BOOTSTRAP_ADMIN_PASSWORD", "password"),
    ]);
    for (name, value) in entries {
        command.env(name, value);
    }
    let output = command.output().expect("admin binary executes");
    assert!(!output.status.success());
    let stderr = String::from_utf8(output.stderr).expect("stderr is UTF-8");
    assert!(!stderr.contains("CANARY_SECRET_VALUE"));
    assert!(!stderr.contains("connection refused"));
    assert!(stderr.len() <= 65_536);
    stderr
}

#[test]
fn invalid_config_fails_before_database_or_listener_side_effects() {
    for (entries, code) in [
        (
            vec![("CRANK_CONFIG_CANARY_UNKNOWN", "CANARY_SECRET_VALUE")],
            "config.unknown_field",
        ),
        (vec![("POSTGRES_PORT", "bad")], "config.invalid_type"),
        (
            vec![
                ("CRANK_DATABASE_URL", "postgres://db/crank"),
                ("POSTGRES_HOST", "other"),
            ],
            "config.conflict",
        ),
        (vec![("CRANK_LOG_LEVEL", "[")], "config.invalid_type"),
    ] {
        let stderr = run_with(&entries);
        assert!(stderr.contains(code), "{stderr}");
    }
}

#[test]
fn database_driver_failures_are_normalized_and_redacted() {
    let stderr = run_with(&[(
        "CRANK_DATABASE_URL",
        "postgres://CANARY_SECRET_VALUE:CANARY_SECRET_VALUE@127.0.0.1:1/crank",
    )]);
    assert!(stderr.contains("startup_failed"), "{stderr}");
}

#[tokio::test]
async fn fresh_database_startup_is_read_only() {
    let database_url = crank_test_support::postgres_schema_url("admin_startup_read_only").await;
    let stderr = run_with(&[("CRANK_DATABASE_URL", &database_url)]);
    assert!(stderr.contains("schema_missing"), "{stderr}");
    let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
    let present: bool = sqlx::query_scalar(
        "select to_regclass(format('%I.%I', current_schema(), '__crank_core_migrations')) is not null",
    )
    .fetch_one(&pool)
    .await
    .unwrap();
    assert!(!present);
}

#[tokio::test]
async fn real_admin_startup_runs_immediate_import_maintenance() {
    let unique = NEXT_STORAGE_ROOT.fetch_add(1, Ordering::Relaxed);
    let epoch = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_nanos();
    let database_url =
        crank_test_support::postgres_schema_url(&format!("startup_maint_{epoch}_{unique}")).await;
    let applied = Command::new(env!("CARGO_BIN_EXE_crank-migrate"))
        .arg("apply")
        .env("CRANK_DATABASE_URL", &database_url)
        .output()
        .expect("migration command executes");
    assert!(
        applied.status.success(),
        "{}",
        String::from_utf8_lossy(&applied.stderr)
    );
    let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
    assert_eq!(
        sqlx::query_scalar::<_, Option<i64>>("select max(version) from __crank_migrations")
            .fetch_one(&pool)
            .await
            .unwrap(),
        Some(13),
        "migration binary must install the current canonical ledger",
    );
    sqlx::query(
        "insert into import_jobs (
            id, workspace_id, kind, source_format, source_version, status,
            preview_payload, created_operation_ids, error_text, created_at, expires_at, finished_at
         ) values (
            'imp_startup_expired', 'ws_default', 'openapi', 'openapi', null, 'pending',
            '{\"source\": {\"source_id\": 1}}'::jsonb, '[]'::jsonb, null,
            now() - interval '2 hours', now() - interval '1 hour', null
         )",
    )
    .execute(&pool)
    .await
    .unwrap();

    let storage_root = std::env::temp_dir().join(format!(
        "crank-admin-startup-maintenance-{}-{epoch}-{unique}",
        std::process::id()
    ));
    fs::create_dir(&storage_root).unwrap();
    fs::set_permissions(&storage_root, fs::Permissions::from_mode(0o700)).unwrap();
    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
    let bind_addr = listener.local_addr().unwrap().to_string();
    drop(listener);

    let mut command = Command::new(env!("CARGO_BIN_EXE_admin-api"));
    for field in crank_config::field_registry() {
        command.env_remove(field.env_name);
    }
    let mut child = command
        .envs([
            ("CRANK_DATABASE_URL", database_url.as_str()),
            ("CRANK_MASTER_KEY", TEST_MASTER_KEY),
            ("CRANK_SESSION_SECRET", "session"),
            ("CRANK_PASSWORD_PEPPER", "pepper"),
            ("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),
            ("CRANK_BOOTSTRAP_ADMIN_PASSWORD", "password"),
            ("CRANK_ADMIN_BIND", bind_addr.as_str()),
            ("CRANK_STORAGE_ROOT", storage_root.to_str().unwrap()),
        ])
        .stdout(Stdio::null())
        .stderr(Stdio::piped())
        .spawn()
        .expect("admin binary starts");

    let mut cleaned = false;
    for _ in 0..200 {
        if let Some(status) = child.try_wait().unwrap() {
            let mut stderr = String::new();
            if let Some(mut stream) = child.stderr.take() {
                stream.read_to_string(&mut stderr).unwrap();
            }
            panic!("admin binary exited before startup maintenance: {status}: {stderr}");
        }
        let remaining: i64 =
            sqlx::query_scalar("select count(*) from import_jobs where id = 'imp_startup_expired'")
                .fetch_one(&pool)
                .await
                .unwrap();
        if remaining == 0 {
            cleaned = true;
            break;
        }
        tokio::time::sleep(std::time::Duration::from_millis(25)).await;
    }

    child.kill().expect("admin binary can be stopped");
    child.wait().expect("admin binary can be reaped");
    fs::remove_dir_all(&storage_root).unwrap();
    assert!(cleaned, "real startup did not clean the expired import job");
}

#[tokio::test]
async fn master_key_mismatch_blocks_startup_with_safe_diagnostic() {
    let database_url = crank_test_support::postgres_schema_url("admin_master_key_mismatch").await;
    let applied = Command::new(env!("CARGO_BIN_EXE_crank-migrate"))
        .arg("apply")
        .env("CRANK_DATABASE_URL", &database_url)
        .output()
        .expect("migration command executes");
    assert!(
        applied.status.success(),
        "{}",
        String::from_utf8_lossy(&applied.stderr)
    );
    let registry = PostgresRegistry::connect(&database_url).await.unwrap();
    let crypto = SecretCrypto::new(REGISTERED_MASTER_KEY).unwrap();
    registry
        .verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
            epoch: 1,
            fingerprint: crypto.master_key_fingerprint(),
            cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
            observed_at: &OffsetDateTime::parse("2026-08-21T00:00:00Z", &Rfc3339).unwrap(),
        })
        .await
        .unwrap();

    let stderr = run_with(&[
        ("CRANK_DATABASE_URL", &database_url),
        ("CRANK_MASTER_KEY", WRONG_MASTER_KEY),
    ]);
    assert!(stderr.contains("master_key_identity_mismatch"), "{stderr}");
    assert!(!stderr.contains("registered-master-key"));
    assert!(!stderr.contains("wrong-master-key"));
}

#[tokio::test]
async fn populated_database_without_identity_rejects_wrong_first_key() {
    let database_url =
        crank_test_support::postgres_schema_url("admin_master_key_first_registration_wrong").await;
    let applied = Command::new(env!("CARGO_BIN_EXE_crank-migrate"))
        .arg("apply")
        .env("CRANK_DATABASE_URL", &database_url)
        .output()
        .expect("migration command executes");
    assert!(
        applied.status.success(),
        "{}",
        String::from_utf8_lossy(&applied.stderr)
    );
    let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
    let old_crypto = SecretCrypto::new(REGISTERED_MASTER_KEY).unwrap();
    let ciphertext = old_crypto
        .encrypt(&serde_json::json!({"token": "CANARY_SECRET_VALUE"}))
        .unwrap();
    sqlx::query(
        "insert into secrets (
            id, workspace_id, name, kind, status, current_version, created_at, updated_at
         ) values (
            'legacy_secret', 'ws_default', 'legacy secret', 'token', 'active', 1, now(), now()
         )",
    )
    .execute(&pool)
    .await
    .unwrap();
    sqlx::query(
        "insert into secret_versions (
            secret_id, version, ciphertext, key_version, master_key_epoch, created_at, created_by
         ) values (
            'legacy_secret', 1, $1, $2, 1, now(), null
         )",
    )
    .bind(ciphertext)
    .bind(old_crypto.key_version())
    .execute(&pool)
    .await
    .unwrap();

    let stderr = run_with(&[
        ("CRANK_DATABASE_URL", &database_url),
        ("CRANK_MASTER_KEY", WRONG_MASTER_KEY),
    ]);
    assert!(stderr.contains("startup_failed"), "{stderr}");
    assert!(!stderr.contains("CANARY_SECRET_VALUE"));
    let identities: i64 = sqlx::query_scalar("select count(*) from master_key_identities")
        .fetch_one(&pool)
        .await
        .unwrap();
    assert_eq!(identities, 0);
}