"""
Tests for INDL-20 — Cemetery Profile Settings.

Covers:
  T-01  GET /settings/profile returns merged Account + BrandingConfig for staff
  T-02  GET /settings/profile returns established_year (new field)
  T-03  GET /settings/profile returns branding sub-object
  T-04  GET /settings/profile returns branding=null when no branding row exists
  T-05  GET /settings/profile 401 for unauthenticated request
  T-06  GET /settings/profile 403 for wrong tenant
  T-07  PATCH /settings/profile updates Account fields (organization_name, address, etc.)
  T-08  PATCH /settings/profile updates established_year
  T-09  PATCH /settings/profile creates BrandingConfig when none exists
  T-10  PATCH /settings/profile updates existing BrandingConfig
  T-11  PATCH /settings/profile 422 for invalid cemetery_type
  T-12  PATCH /settings/profile 422 for invalid accent_color
  T-13  PATCH /settings/profile 422 for established_year out of range (< 1600)
  T-14  PATCH /settings/profile 422 for established_year out of range (> current year)
  T-15  PATCH /settings/profile 422 for invalid email
  T-16  PATCH /settings/profile 403 for manager role
  T-17  PATCH /settings/profile 403 for staff role
  T-18  PUT  /settings/profile/logo 400 for unsupported MIME type
  T-19  PUT  /settings/profile/logo 400 for file too large
  T-20  PUT  /settings/profile/logo 403 for manager role
  T-21  PATCH /settings/profile partial update (only organization_name) preserves other fields
  T-22  GET  /settings/profile reflects changes made by PATCH
"""
import io
import pytest
from unittest.mock import MagicMock, patch
from uuid import uuid4

from httpx import AsyncClient
from sqlalchemy.ext.asyncio import AsyncSession

from src.apps.tenants.models.account import Account
from src.apps.tenants.models.branding_config import BrandingConfig
from src.apps.auth.models.user import User
from src.core.security import hash_password, create_access_token, build_token_payload


# ── helpers ───────────────────────────────────────────────────────────────────

async def _make_account(
    db: AsyncSession,
    *,
    org_name: str = None,
    established_year: int = None,
) -> Account:
    uid = str(uuid4())[-8:]
    acc = Account(
        organization_name=org_name or f"Profile Cemetery {uid}",
        subdomain=f"profile-{uid}",
        contact_email=f"admin-{uid}@test.ca",
        address="123 Memorial Dr, Ottawa, ON",
        cemetery_type="municipal",
        plan="professional",
        status="active",
        established_year=established_year,
    )
    db.add(acc)
    await db.flush()
    return acc


async def _make_branding(db: AsyncSession, account: Account, **kwargs) -> BrandingConfig:
    defaults = {
        "public_site_name": "Test Memorial Park",
        "location_tagline": "Ottawa, Ontario · Est. 1887",
        "accent_color": "#1E4A6E",
        "logo_url": None,
    }
    defaults.update(kwargs)
    branding = BrandingConfig(account_id=account.id, **defaults)
    db.add(branding)
    await db.flush()
    return branding


async def _make_user(
    db: AsyncSession,
    account: Account,
    *,
    role: str = "administrator",
) -> str:
    user = User(
        tenant_id=account.id,
        email=f"user-{role}-{uuid4().hex[:6]}@test.ca",
        password_hash=hash_password("Test1234!"),
        first_name="Test",
        last_name="User",
        role=role,
        status="active",
    )
    db.add(user)
    await db.flush()
    return create_access_token(build_token_payload(user, account))


def _headers(token: str, account: Account) -> dict:
    return {
        "Authorization": f"Bearer {token}",
        "X-Tenant-ID": str(account.id),
    }


# ── T-01 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_get_profile_ok_for_staff(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    await _make_branding(db_session, acc)
    token = await _make_user(db_session, acc, role="staff")

    resp = await client.get("/api/v1/settings/profile", headers=_headers(token, acc))
    assert resp.status_code == 200
    body = resp.json()
    assert body["success"] is True
    assert body["data"]["id"] == str(acc.id)
    assert body["data"]["organization_name"] == acc.organization_name


# ── T-02 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_get_profile_includes_established_year(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session, established_year=1887)
    await _make_branding(db_session, acc)
    token = await _make_user(db_session, acc, role="staff")

    resp = await client.get("/api/v1/settings/profile", headers=_headers(token, acc))
    assert resp.status_code == 200
    assert resp.json()["data"]["established_year"] == 1887


# ── T-03 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_get_profile_includes_branding_object(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    await _make_branding(db_session, acc, public_site_name="River Park", accent_color="#7BB069")
    token = await _make_user(db_session, acc, role="view_only")

    resp = await client.get("/api/v1/settings/profile", headers=_headers(token, acc))
    data = resp.json()["data"]
    assert data["branding"] is not None
    assert data["branding"]["public_site_name"] == "River Park"
    assert data["branding"]["accent_color"] == "#7BB069"


# ── T-04 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_get_profile_branding_null_when_missing(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="staff")

    resp = await client.get("/api/v1/settings/profile", headers=_headers(token, acc))
    assert resp.status_code == 200
    assert resp.json()["data"]["branding"] is None


# ── T-05 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_get_profile_401_unauthenticated(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    resp = await client.get(
        "/api/v1/settings/profile",
        headers={"X-Tenant-ID": str(acc.id)},
    )
    assert resp.status_code == 401


# ── T-06 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_get_profile_unauthenticated_with_tenant_header(client: AsyncClient, db_session: AsyncSession):
    # No bearer token, valid tenant header — should get 401
    acc = await _make_account(db_session)

    resp = await client.get(
        "/api/v1/settings/profile",
        headers={"X-Tenant-ID": str(acc.id)},
    )
    assert resp.status_code == 401


# ── T-07 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_updates_account_fields(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    await _make_branding(db_session, acc)
    token = await _make_user(db_session, acc, role="administrator")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={
            "organization_name": "Updated Cemetery",
            "cemetery_type": "Private operator",
            "contact_email": "new@cemetery.org",
            "address": "456 New Ave, Toronto, ON",
        },
        headers=_headers(token, acc),
    )
    assert resp.status_code == 200
    data = resp.json()["data"]
    assert data["organization_name"] == "Updated Cemetery"
    assert data["cemetery_type"] == "Private operator"
    assert data["contact_email"] == "new@cemetery.org"
    assert data["address"] == "456 New Ave, Toronto, ON"


# ── T-08 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_updates_established_year(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    await _make_branding(db_session, acc)
    token = await _make_user(db_session, acc, role="administrator")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={"established_year": 1922},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 200
    assert resp.json()["data"]["established_year"] == 1922


# ── T-09 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_creates_branding_when_missing(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="administrator")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={
            "public_site_name": "Maple Gardens",
            "location_tagline": "Toronto, ON · Est. 1900",
            "accent_color": "#7BB069",
        },
        headers=_headers(token, acc),
    )
    assert resp.status_code == 200
    branding = resp.json()["data"]["branding"]
    assert branding is not None
    assert branding["public_site_name"] == "Maple Gardens"
    assert branding["accent_color"] == "#7BB069"


# ── T-10 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_updates_existing_branding(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    await _make_branding(db_session, acc, public_site_name="Old Name", accent_color="#1E4A6E")
    token = await _make_user(db_session, acc, role="administrator")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={"public_site_name": "New Name", "accent_color": "#6B4E8E"},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 200
    branding = resp.json()["data"]["branding"]
    assert branding["public_site_name"] == "New Name"
    assert branding["accent_color"] == "#6B4E8E"


# ── T-11 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_422_invalid_cemetery_type(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="administrator")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={"cemetery_type": "underwater"},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 422


# ── T-12 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_422_invalid_accent_color(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="administrator")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={"accent_color": "#FFFFFF"},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 422


# ── T-13 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_422_year_too_old(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="administrator")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={"established_year": 1599},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 422


# ── T-14 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_422_year_future(client: AsyncClient, db_session: AsyncSession):
    import datetime
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="administrator")

    future_year = datetime.date.today().year + 1
    resp = await client.patch(
        "/api/v1/settings/profile",
        json={"established_year": future_year},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 422


# ── T-15 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_422_invalid_email(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="administrator")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={"contact_email": "not-an-email"},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 422


# ── T-16 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_403_for_manager(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="manager")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={"organization_name": "Hacked"},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 403


# ── T-17 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_403_for_staff(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="staff")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={"organization_name": "Hacked"},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 403


# ── T-18 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_put_logo_400_wrong_mime(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="administrator")

    resp = await client.put(
        "/api/v1/settings/profile/logo",
        files={"logo": ("logo.gif", b"GIF89a", "image/gif")},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 400
    body = resp.json()
    assert "PNG or SVG" in body.get("detail", body.get("message", ""))


# ── T-19 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_put_logo_400_file_too_large(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="administrator")

    big_content = b"x" * (2 * 1024 * 1024 + 1)
    resp = await client.put(
        "/api/v1/settings/profile/logo",
        files={"logo": ("logo.png", big_content, "image/png")},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 400
    body = resp.json()
    assert "2 MB" in body.get("detail", body.get("message", ""))


# ── T-20 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_put_logo_403_for_manager(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    token = await _make_user(db_session, acc, role="manager")

    resp = await client.put(
        "/api/v1/settings/profile/logo",
        files={"logo": ("logo.png", b"\x89PNG\r\n\x1a\n", "image/png")},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 403


# ── T-21 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_patch_profile_partial_update_preserves_existing(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session, org_name="Original Name", established_year=1900)
    await _make_branding(db_session, acc, accent_color="#7BB069")
    token = await _make_user(db_session, acc, role="administrator")

    resp = await client.patch(
        "/api/v1/settings/profile",
        json={"contact_email": "new@cemetery.org"},
        headers=_headers(token, acc),
    )
    assert resp.status_code == 200
    data = resp.json()["data"]
    assert data["organization_name"] == "Original Name"
    assert data["established_year"] == 1900
    assert data["branding"]["accent_color"] == "#7BB069"
    assert data["contact_email"] == "new@cemetery.org"


# ── T-22 ──────────────────────────────────────────────────────────────────────

@pytest.mark.asyncio
async def test_get_profile_reflects_patch_changes(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    await _make_branding(db_session, acc)
    token = await _make_user(db_session, acc, role="administrator")
    headers = _headers(token, acc)

    await client.patch(
        "/api/v1/settings/profile",
        json={"organization_name": "Persisted Name", "established_year": 1975},
        headers=headers,
    )

    resp = await client.get("/api/v1/settings/profile", headers=headers)
    assert resp.status_code == 200
    data = resp.json()["data"]
    assert data["organization_name"] == "Persisted Name"
    assert data["established_year"] == 1975


# ── T-23: logo upload mocked (S3 call skipped) ────────────────────────────────

@pytest.mark.asyncio
async def test_put_logo_ok_mocked_s3(client: AsyncClient, db_session: AsyncSession):
    acc = await _make_account(db_session)
    await _make_branding(db_session, acc)
    token = await _make_user(db_session, acc, role="administrator")

    fake_url = f"https://s3.ca-central-1.amazonaws.com/indelis-dev/tenants/{acc.id}/logo/logo.png"

    mock_s3 = MagicMock()
    mock_s3.put_object = MagicMock(return_value={})

    with patch("src.apps.settings.router.boto3.client", return_value=mock_s3):
        resp = await client.put(
            "/api/v1/settings/profile/logo",
            files={"logo": ("logo.png", b"\x89PNG\r\n\x1a\n", "image/png")},
            headers=_headers(token, acc),
        )

    assert resp.status_code == 200
    data = resp.json()["data"]
    assert "logo_url" in data
    assert data["logo_url"].endswith("logo.png")