"""HTTP tests for company intercompany events list + CSV export (HEL-176).

Covers combined filters, keyset pagination, empty state, lateral access,
forged company_id, ID guessing, export isolation and audit logging.
"""

from __future__ import annotations

import io
import json
import os
from pathlib import Path
import tempfile
import threading
import unittest

from openpyxl import Workbook

from bank_importer.db import connect, migrate

import server
from test_server_auth import Client, as_json

BOOTSTRAP_PASSWORD = "BootAdmin123"
ADMIN_PASSWORD = "AdminPass123"
CASHIER_PASSWORD = "Cashier123"

CCB_HEADER = [
    "客户账号", "账户名称", "交易时间", "借方发生额（支取）", "贷方发生额（收入）",
    "余额", "币种", "对方户名", "对方账号", "对方开户机构", "摘要", "备注",
]

ACCOUNT_A = "6222000000000001"
ACCOUNT_B = "6222000000000002"
ACCOUNT_C = "6222000000000003"


def workbook_bytes(rows) -> bytes:
    workbook = Workbook()
    sheet = workbook.active
    sheet.title = "正常流水"
    sheet.append(CCB_HEADER)
    for row in rows:
        sheet.append(row)
    buffer = io.BytesIO()
    workbook.save(buffer)
    return buffer.getvalue()


def outgoing(own: str, cp: str, amount: str, at: str = "2026-01-05 10:00:00"):
    return [own, "测试公司", at, amount, "", "50000.00", "RMB", "对方", cp, "某银行", "货款", ""]


def incoming(own: str, cp: str, amount: str, at: str = "2026-01-05 11:00:00"):
    return [own, "测试公司", at, "", amount, "50000.00", "RMB", "对方", cp, "某银行", "收款", ""]


class CompanyIntercompanyEventsTests(unittest.TestCase):
    def setUp(self) -> None:
        self.temp_dir = tempfile.TemporaryDirectory()
        self.addCleanup(self.temp_dir.cleanup)
        root = Path(self.temp_dir.name)
        self.db_path = root / "app.db"
        self.storage = root / "files"

        self._old_db_path = server.DB_PATH
        self._old_storage = server.STORAGE_DIR
        server.DB_PATH = self.db_path
        server.STORAGE_DIR = self.storage

        os.environ["APP_BOOTSTRAP_ADMIN_PASSWORD"] = BOOTSTRAP_PASSWORD
        connection = connect(self.db_path)
        migrate(connection)
        assert server.ensure_bootstrap_admin(connection) is None
        connection.close()

        class QuietHandler(server.AppHandler):
            def log_message(self, *args) -> None:
                pass

        self.httpd = server.ThreadingHTTPServer(("127.0.0.1", 0), QuietHandler)
        self.port = self.httpd.server_address[1]
        self.thread = threading.Thread(target=self.httpd.serve_forever, daemon=True)
        self.thread.start()

        self.admin = Client("127.0.0.1", self.port)
        status, _, data = self.admin.post_json(
            "/api/login",
            {"username": "group-admin", "password": BOOTSTRAP_PASSWORD, "portal": "admin"},
        )
        assert status == 200, data
        status, _, data = self.admin.post_json(
            "/api/password/change",
            {"old_password": BOOTSTRAP_PASSWORD, "new_password": ADMIN_PASSWORD},
        )
        assert status == 200, data

        self.initial_passwords: dict[str, str] = {}
        self.company_a = self._create_company("甲公司", "cashier-a")
        self.company_b = self._create_company("乙公司", "cashier-b")
        self.company_c = self._create_company("丙公司", "cashier-c")
        self.cashier_a = self._login_company("cashier-a")
        self.cashier_b = self._login_company("cashier-b")
        self.cashier_c = self._login_company("cashier-c")

        self._approve_account(self.company_a, ACCOUNT_A, self.cashier_a)
        self._approve_account(self.company_b, ACCOUNT_B, self.cashier_b)
        self._approve_account(self.company_c, ACCOUNT_C, self.cashier_c)

    def tearDown(self) -> None:
        self.httpd.shutdown()
        self.httpd.server_close()
        server.DB_PATH = self._old_db_path
        server.STORAGE_DIR = self._old_storage
        os.environ.pop("APP_BOOTSTRAP_ADMIN_PASSWORD", None)

    def _create_company(self, name: str, username: str) -> int:
        status, _, data = self.admin.post_json(
            "/api/admin/companies", {"name": name, "username": username}
        )
        assert status == 200, data
        self.initial_passwords[username] = as_json(data)["initial_password"]
        return as_json(data)["company_id"]

    def _login_company(self, username: str) -> Client:
        client = Client("127.0.0.1", self.port)
        initial = self.initial_passwords[username]
        status, _, data = client.post_json(
            "/api/login", {"username": username, "password": initial, "portal": "company"}
        )
        assert status == 200, data
        status, _, data = client.post_json(
            "/api/password/change",
            {"old_password": initial, "new_password": CASHIER_PASSWORD},
        )
        assert status == 200, data
        return client

    def _approve_account(self, company_id: int, number: str, client: Client) -> int:
        status, _, data = client.post_json(
            "/api/company/accounts",
            {
                "bank_name": "中信银行",
                "account_type": "基本户",
                "account_number": number,
                "start_date": "2026-01-01",
            },
        )
        assert status == 200, data
        account_id = as_json(data)["account"]["id"]
        status, _, data = self.admin.post_json(
            f"/api/admin/accounts/{account_id}/review",
            {
                "decision": "approve",
                "reason": "测试启用",
                "effective_from": "2026-01-01",
            },
        )
        assert status == 200, data
        return account_id

    def _upload_and_confirm(self, client: Client, company_id: int, rows) -> int:
        content = workbook_bytes(rows)
        status, _, data = self.admin.post_multipart(
            "/api/parse", {"company_id": str(company_id)}, "账单.xlsx", content
        )
        assert status == 200, data
        batch_id = as_json(data)["batch_id"]
        status, _, data = client.get(f"/api/batches/{batch_id}/sheets")
        names = [s["sheet_name"] for s in as_json(data)["sheets"] if s["outcome"] == "parsed"]
        status, _, data = client.post_json(
            f"/api/batches/{batch_id}/confirm", {"sheets": names}
        )
        assert status == 200, data
        return batch_id

    def _lock_single(self, amount: str, at: str = "2026-03-01 10:00:00") -> dict:
        self._upload_and_confirm(
            self.cashier_a,
            self.company_a,
            [outgoing(ACCOUNT_A, ACCOUNT_B, amount, at)],
        )
        status, _, data = self.admin.get("/api/admin/transfer-events")
        self.assertEqual(200, status, data)
        single = next(
            e
            for e in as_json(data)["events"]
            if e["status"] == "internal_single" and e["amount"] == amount
        )
        status, _, data = self.admin.get(f"/api/admin/transfer-events/{single['event_id']}")
        self.assertEqual(200, status, data)
        revision = as_json(data)["event"]["revision"]
        status, _, data = self.admin.post_json(
            f"/api/admin/transfer-events/{single['event_id']}/decisions",
            {
                "action": "assign_participant",
                "reason": "函证确认",
                "expected_revision": revision,
                "request_key": f"lock-{amount}-{at}",
                "participant": {"role": "payee", "company_id": self.company_b},
            },
        )
        self.assertEqual(200, status, data)
        return as_json(data)["decision"]

    def _seed_mixed(self) -> None:
        """Paired A→B 100, B→A 40, locked A→B 25, pending A→B 7, B→C 200."""
        self._upload_and_confirm(
            self.cashier_a, self.company_a,
            [outgoing(ACCOUNT_A, ACCOUNT_B, "100.00", "2026-01-05 10:00:00")],
        )
        self._upload_and_confirm(
            self.cashier_b, self.company_b,
            [incoming(ACCOUNT_B, ACCOUNT_A, "100.00", "2026-01-05 11:00:00")],
        )
        self._upload_and_confirm(
            self.cashier_b, self.company_b,
            [outgoing(ACCOUNT_B, ACCOUNT_A, "40.00", "2026-01-10 10:00:00")],
        )
        self._upload_and_confirm(
            self.cashier_a, self.company_a,
            [incoming(ACCOUNT_A, ACCOUNT_B, "40.00", "2026-01-10 11:00:00")],
        )
        self._lock_single("25.00", "2026-02-01 10:00:00")
        self._upload_and_confirm(
            self.cashier_a, self.company_a,
            [outgoing(ACCOUNT_A, ACCOUNT_B, "7.00", "2026-02-15 10:00:00")],
        )
        self._upload_and_confirm(
            self.cashier_b, self.company_b,
            [outgoing(ACCOUNT_B, ACCOUNT_C, "200.00", "2026-01-20 10:00:00")],
        )
        self._upload_and_confirm(
            self.cashier_c, self.company_c,
            [incoming(ACCOUNT_C, ACCOUNT_B, "200.00", "2026-01-20 11:00:00")],
        )

    def _events(self, client: Client, query: str = "from=2026-01-01&to=2026-12-31"):
        status, _, data = client.get(f"/api/company/intercompany/events?{query}")
        return status, as_json(data) if data else {}

    def _export(self, client: Client, query: str = "from=2026-01-01&to=2026-12-31"):
        return client.get(f"/api/company/intercompany/export.csv?{query}")

    # ------------------------------------------------------------------
    # Auth / parameter guards
    # ------------------------------------------------------------------

    def test_requires_company_role(self) -> None:
        status, payload = self._events(self.admin)
        self.assertEqual(403, status, payload)

    def test_rejects_forged_company_id_on_events_and_export(self) -> None:
        status, payload = self._events(
            self.cashier_a,
            f"from=2026-01-01&to=2026-12-31&company_id={self.company_b}",
        )
        self.assertEqual(400, status, payload)

        status, _, data = self._export(
            self.cashier_a,
            f"from=2026-01-01&to=2026-12-31&company_id={self.company_a}",
        )
        self.assertEqual(400, status, data)

    def test_rejects_bad_filters(self) -> None:
        status, payload = self._events(
            self.cashier_a, "from=2026-01-01&to=2026-12-31&direction=sideways"
        )
        self.assertEqual(400, status, payload)
        status, payload = self._events(
            self.cashier_a, "from=2026-01-01&to=2026-12-31&state=maybe"
        )
        self.assertEqual(400, status, payload)
        status, payload = self._events(
            self.cashier_a, "from=2026-13-40&to=2026-12-31"
        )
        self.assertEqual(400, status, payload)

    def test_empty_window(self) -> None:
        status, payload = self._events(self.cashier_a)
        self.assertEqual(200, status, payload)
        self.assertEqual([], payload["events"])
        self.assertFalse(payload["has_more"])
        self.assertIsNone(payload["next_cursor"])

    # ------------------------------------------------------------------
    # Combined filters + confirmed/pending separation
    # ------------------------------------------------------------------

    def test_combined_filters_and_state_split(self) -> None:
        self._seed_mixed()

        status, payload = self._events(self.cashier_a)
        self.assertEqual(200, status, payload)
        events = payload["events"]
        # A sees: out 100, in 40, locked out 25, pending out 7 — not B↔C 200
        self.assertEqual(4, len(events))
        amounts = {e["amount"] for e in events}
        self.assertEqual({"100.00", "40.00", "25.00", "7.00"}, amounts)
        for event in events:
            self.assertNotEqual(self.company_c, event["counterparty_company_id"])
            self.assertIn(event["state"], ("confirmed", "pending"))
            self.assertIn(event["direction"], ("out", "in"))

        status, confirmed = self._events(
            self.cashier_a, "from=2026-01-01&to=2026-12-31&state=confirmed"
        )
        self.assertEqual(200, status, confirmed)
        self.assertEqual(3, len(confirmed["events"]))
        self.assertTrue(all(e["state"] == "confirmed" for e in confirmed["events"]))
        self.assertNotIn("7.00", {e["amount"] for e in confirmed["events"]})

        status, pending = self._events(
            self.cashier_a, "from=2026-01-01&to=2026-12-31&state=pending"
        )
        self.assertEqual(200, status, pending)
        self.assertEqual(1, len(pending["events"]))
        self.assertEqual("7.00", pending["events"][0]["amount"])
        self.assertEqual("pending", pending["events"][0]["state"])

        status, outs = self._events(
            self.cashier_a, "from=2026-01-01&to=2026-12-31&direction=out&state=confirmed"
        )
        self.assertEqual(200, status, outs)
        self.assertEqual({"100.00", "25.00"}, {e["amount"] for e in outs["events"]})
        self.assertTrue(all(e["direction"] == "out" for e in outs["events"]))

        status, by_cp = self._events(
            self.cashier_a,
            f"from=2026-01-01&to=2026-12-31&counterparty_id={self.company_b}&state=confirmed",
        )
        self.assertEqual(200, status, by_cp)
        self.assertEqual(3, len(by_cp["events"]))

        # Date window excludes Feb locked/pending
        status, jan = self._events(
            self.cashier_a, "from=2026-01-01&to=2026-01-31&state=confirmed"
        )
        self.assertEqual(200, status, jan)
        self.assertEqual({"100.00", "40.00"}, {e["amount"] for e in jan["events"]})

    def test_keyset_pagination_no_dup_no_gap(self) -> None:
        # Three confirmed A→B outs on distinct days
        for i, amount in enumerate(("11.00", "12.00", "13.00", "14.00", "15.00")):
            day = 5 + i
            self._upload_and_confirm(
                self.cashier_a, self.company_a,
                [outgoing(ACCOUNT_A, ACCOUNT_B, amount, f"2026-01-{day:02d} 10:00:00")],
            )
            self._upload_and_confirm(
                self.cashier_b, self.company_b,
                [incoming(ACCOUNT_B, ACCOUNT_A, amount, f"2026-01-{day:02d} 11:00:00")],
            )

        status, page1 = self._events(
            self.cashier_a,
            "from=2026-01-01&to=2026-12-31&state=confirmed&direction=out&limit=2",
        )
        self.assertEqual(200, status, page1)
        self.assertEqual(2, len(page1["events"]))
        self.assertTrue(page1["has_more"])
        self.assertIsNotNone(page1["next_cursor"])

        status, page2 = self._events(
            self.cashier_a,
            "from=2026-01-01&to=2026-12-31&state=confirmed&direction=out"
            f"&limit=2&cursor={page1['next_cursor']}",
        )
        self.assertEqual(200, status, page2)
        self.assertEqual(2, len(page2["events"]))
        self.assertTrue(page2["has_more"])

        status, page3 = self._events(
            self.cashier_a,
            "from=2026-01-01&to=2026-12-31&state=confirmed&direction=out"
            f"&limit=2&cursor={page2['next_cursor']}",
        )
        self.assertEqual(200, status, page3)
        self.assertEqual(1, len(page3["events"]))
        self.assertFalse(page3["has_more"])
        self.assertIsNone(page3["next_cursor"])

        ids = [e["event_id"] for e in page1["events"] + page2["events"] + page3["events"]]
        self.assertEqual(5, len(ids))
        self.assertEqual(len(ids), len(set(ids)))
        # Descending by effective_at then event_id
        amounts = [e["amount"] for e in page1["events"] + page2["events"] + page3["events"]]
        self.assertEqual(["15.00", "14.00", "13.00", "12.00", "11.00"], amounts)

    # ------------------------------------------------------------------
    # Isolation / ID guess / detail reuse
    # ------------------------------------------------------------------

    def test_lateral_isolation_and_id_guess_404(self) -> None:
        self._seed_mixed()

        status, payload_a = self._events(self.cashier_a)
        self.assertEqual(200, status, payload_a)
        a_ids = {e["event_id"] for e in payload_a["events"]}

        status, payload_c = self._events(self.cashier_c)
        self.assertEqual(200, status, payload_c)
        # C only participates in B↔C 200
        self.assertTrue(payload_c["events"])
        for event in payload_c["events"]:
            self.assertEqual("200.00", event["amount"])
            self.assertNotIn(event["event_id"], a_ids)

        # C guessing A's event id via transfer-events detail → 404
        a_event_id = next(iter(a_ids))
        status, _, data = self.cashier_c.get(
            f"/api/company/transfer-events/{a_event_id}"
        )
        self.assertEqual(404, status, data)

        # A can open own event; counterparty account masked; only own observations
        status, _, data = self.cashier_a.get(
            f"/api/company/transfer-events/{a_event_id}"
        )
        self.assertEqual(200, status, data)
        detail = as_json(data)["event"]
        if detail.get("counterparty") and "account_number_masked" in detail["counterparty"]:
            masked = detail["counterparty"]["account_number_masked"]
            self.assertTrue(str(masked).startswith("****"))
            self.assertNotIn(ACCOUNT_B, masked)
        for obs in detail["observations"]:
            self.assertEqual(self.company_a, obs["batch_company_id"])
            self.assertNotIn(ACCOUNT_B, json.dumps(obs, ensure_ascii=False))

        # Filtering by counterparty C still cannot leak B↔C into A's list
        status, filtered = self._events(
            self.cashier_a,
            f"from=2026-01-01&to=2026-12-31&counterparty_id={self.company_c}",
        )
        self.assertEqual(200, status, filtered)
        self.assertEqual([], filtered["events"])

    def test_b44_events_path_still_works_with_cutoff(self) -> None:
        # Without HEL-176 discriminators, /events stays on B-44 ledger list.
        status, _, data = self.cashier_a.get(
            "/api/company/intercompany/events?from=2026-01-01&cutoff=2026-12-31"
        )
        self.assertEqual(200, status, data)
        payload = as_json(data)
        self.assertIn("items", payload)
        self.assertNotIn("events", payload)

    # ------------------------------------------------------------------
    # Export: confirmed only + audit + isolation
    # ------------------------------------------------------------------

    def test_export_confirmed_only_isolated_and_audited(self) -> None:
        self._seed_mixed()

        status, headers, data = self._export(self.cashier_a)
        self.assertEqual(200, status, data)
        self.assertEqual("text/csv; charset=utf-8", headers.get("content-type"))
        text = data.decode("utf-8-sig")
        lines = [line for line in text.splitlines() if line]
        self.assertGreaterEqual(len(lines), 2)
        body = "\n".join(lines[1:])
        self.assertIn("100.00", body)
        self.assertIn("40.00", body)
        self.assertIn("25.00", body)
        self.assertNotIn("7.00", body)  # pending excluded
        self.assertNotIn("200.00", body)  # B↔C excluded

        # Explicit pending state rejected
        status, _, data = self._export(
            self.cashier_a, "from=2026-01-01&to=2026-12-31&state=pending"
        )
        self.assertEqual(400, status, data)

        # C export must not contain A's amounts
        status, _, data = self._export(self.cashier_c)
        self.assertEqual(200, status, data)
        text_c = data.decode("utf-8-sig")
        self.assertNotIn("100.00", text_c)
        self.assertNotIn("25.00", text_c)
        self.assertIn("200.00", text_c)

        status, _, data = self.admin.get("/api/admin/audit-log?limit=50")
        self.assertEqual(200, status, data)
        actions = [row["action"] for row in as_json(data)["entries"]]
        self.assertIn("export_intercompany_csv", actions)
        export_rows = [
            row
            for row in as_json(data)["entries"]
            if row["action"] == "export_intercompany_csv"
        ]
        self.assertTrue(export_rows)
        self.assertTrue(
            any(f"company:{self.company_a}" == row.get("target") for row in export_rows)
        )
        self.assertTrue(any("state:confirmed" in (row.get("detail") or "") for row in export_rows))


if __name__ == "__main__":
    unittest.main()
