/* eslint-disable no-console */
/**
 * Wave 8 E2E QA — agents config UI/API
 * Run: npx tsx scripts/qa-wave-08.ts
 */
import { chromium, type BrowserContext, type APIRequestContext } from "@playwright/test";
import { createClient } from "@supabase/supabase-js";
import * as fs from "fs";
import * as path from "path";
import { carregarEnvLocal } from "../scripts/lib/env-de-teste";
// `process.env` vence o `.env.local` (scripts/lib/env-de-teste.ts).
carregarEnvLocal();

const BASE_URL = "http://localhost:3000";
const ARTIFACTS_DIR = path.resolve(process.cwd(), "test-results/wave-08");
fs.mkdirSync(ARTIFACTS_DIR, { recursive: true });

const creds = JSON.parse(
  fs.readFileSync(path.resolve(process.cwd(), ".e2e-creds.json"), "utf8"),
);
const PASSWORD: string = creds.password;
const ADMIN_EMAIL: string = creds.users.admin.email;
const MANAGER_EMAIL: string = creds.users.manager.email;
const AGENT_EMAIL: string = creds.users.agent.email;
const DEFAULT_AGENT_ID: string = creds.default_agent_id;
const ORG_ID: string = creds.org_id;

const SUPABASE_URL = process.env.NEXT_PUBLIC_SUPABASE_URL!;
const SERVICE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;

type Result = { ac: string; pass: boolean; evidence: string };
const results: Result[] = [];
const record = (ac: string, pass: boolean, evidence: string) => {
  results.push({ ac, pass, evidence });
  console.log(`[${pass ? "PASS" : "FAIL"}] ${ac} — ${evidence}`);
};

async function login(context: BrowserContext, email: string): Promise<void> {
  const page = await context.newPage();
  await page.goto(`${BASE_URL}/login`, { waitUntil: "domcontentloaded" });
  // Use pressSequentially with focus wait — .fill() bypasses RHF; type() drops chars during hydration
  await page.locator("#email").focus();
  await page.waitForTimeout(300);
  await page.locator("#email").pressSequentially(email, { delay: 25 });
  await page.locator("#password").focus();
  await page.waitForTimeout(200);
  await page.locator("#password").pressSequentially(PASSWORD, { delay: 25 });
  await page.getByRole("button", { name: "Entrar", exact: true }).click();
  // Wait for navigation away from /login (router.replace after server action)
  try {
    // Allow either /app/* or /login/mfa* — both indicate successful auth
    await page.waitForURL(
      (url) => /\/app\b|\/login\/mfa/.test(url.toString()),
      { timeout: 20_000 },
    );
  } catch {
    // tolerate — caller may verify by other means
  }
  await page.waitForTimeout(1200);
  const cookies = await context.cookies();
  const sbCookies = cookies.filter((c) => c.name.includes("sb-") || c.name.includes("supabase"));
  console.log(`[login ${email}] final URL: ${page.url()} | sb cookies: ${sbCookies.length}`);
  await page.close();
}

async function main() {
  const browser = await chromium.launch({ headless: true });

  // ---------- Manager UI flow (AC1, AC3 frontend, view-only) ----------
  const mgrCtx = await browser.newContext({ baseURL: BASE_URL });
  await login(mgrCtx, MANAGER_EMAIL);
  const mgrPage = await mgrCtx.newPage();

  // AC1 - list page, click row, verify 4 tabs
  try {
    await mgrPage.goto(`${BASE_URL}/app/ai/agents`, { waitUntil: "domcontentloaded" });
    await mgrPage.waitForTimeout(1500);
    const listScreenshot = path.join(ARTIFACTS_DIR, "ac1-list.png");
    await mgrPage.screenshot({ path: listScreenshot, fullPage: true });

    // Navigate directly to editor (avoid row-selector ambiguity)
    await mgrPage.goto(`${BASE_URL}/app/ai/agents/${DEFAULT_AGENT_ID}`, {
      waitUntil: "domcontentloaded",
    });
    await mgrPage.waitForTimeout(1500);

    const tabs = ["Geral", "Modelo", "RAG", "Guardrails"];
    let allFound = true;
    for (const t of tabs) {
      const found = await mgrPage.getByRole("tab", { name: t }).count();
      if (found === 0) {
        const fallback = await mgrPage.locator(`text="${t}"`).count();
        if (fallback === 0) {
          allFound = false;
          break;
        }
      }
    }
    const ac1Screenshot = path.join(ARTIFACTS_DIR, "ac1-editor-tabs.png");
    await mgrPage.screenshot({ path: ac1Screenshot, fullPage: true });
    record(
      "AC1 (list + 4 tabs)",
      allFound,
      `tabs found=${allFound}; screenshot: ${ac1Screenshot}`,
    );
  } catch (e) {
    record("AC1 (list + 4 tabs)", false, `error: ${(e as Error).message}`);
  }

  // Manager view-only: check that save button is disabled or absent
  try {
    // Look for any "Salvar" button; check disabled state
    const saveBtns = mgrPage.getByRole("button", { name: /salvar/i });
    const count = await saveBtns.count();
    let disabled = true;
    if (count > 0) {
      for (let i = 0; i < count; i++) {
        const isDisabled = await saveBtns.nth(i).isDisabled().catch(() => false);
        if (!isDisabled) {
          disabled = false;
          break;
        }
      }
    }
    // Also check if any text input is readonly (textarea for system_prompt)
    const inputs = await mgrPage.locator("textarea, input[type=text]").all();
    let anyEditable = false;
    for (const inp of inputs.slice(0, 5)) {
      const ro = await inp.getAttribute("readonly");
      const dis = await inp.isDisabled().catch(() => true);
      if (ro === null && !dis) anyEditable = true;
    }
    const passView = disabled || !anyEditable;
    record(
      "Manager view-only",
      passView,
      `save buttons disabled=${disabled}; inputs editable=${anyEditable}`,
    );
  } catch (e) {
    record("Manager view-only", false, `error: ${(e as Error).message}`);
  }

  await mgrPage.close();

  // ---------- Agent role: AC4 redirect to /403 ----------
  const agentCtx = await browser.newContext({ baseURL: BASE_URL });
  await login(agentCtx, AGENT_EMAIL);
  const agentPage = await agentCtx.newPage();
  try {
    await agentPage.goto(`${BASE_URL}/app/ai/agents/${DEFAULT_AGENT_ID}`, {
      waitUntil: "networkidle",
    });
    // Allow up to 5s for any client-side redirect to settle
    try {
      await agentPage.waitForURL(/\/403/, { timeout: 5000 });
    } catch {
      /* may have already redirected */
    }
    const finalUrl = agentPage.url();
    const ac4Shot = path.join(ARTIFACTS_DIR, "ac4-agent-403.png");
    await agentPage.screenshot({ path: ac4Shot, fullPage: true });
    record(
      "AC4 (agent → /403)",
      /\/403/.test(finalUrl),
      `final URL: ${finalUrl}; screenshot: ${ac4Shot}`,
    );
  } catch (e) {
    record("AC4 (agent → /403)", false, `error: ${(e as Error).message}`);
  }
  await agentPage.close();
  await agentCtx.close();

  // ---------- API tests ----------
  // Manager API test for cross-tenant 404 + role gate POST
  const mgrApi: APIRequestContext = mgrCtx.request;
  try {
    const resp = await mgrApi.get(
      `${BASE_URL}/api/v1/ai/agents/00000000-0000-0000-0000-000000000000`,
    );
    record(
      "AC6 (RLS cross-tenant → 404)",
      resp.status() === 404,
      `HTTP ${resp.status()} body=${(await resp.text()).slice(0, 160)}`,
    );
  } catch (e) {
    record("AC6 (RLS cross-tenant → 404)", false, `error: ${(e as Error).message}`);
  }

  try {
    const resp = await mgrApi.post(`${BASE_URL}/api/v1/ai/agents`, {
      data: {
        name: "should-be-rejected",
        model: "anthropic/claude-sonnet-4-6",
        system_prompt: "x",
      },
    });
    const body = await resp.text();
    record(
      "Role gate POST manager → 403",
      resp.status() === 403 && /forbidden_role/.test(body),
      `HTTP ${resp.status()} body=${body.slice(0, 200)}`,
    );
  } catch (e) {
    record("Role gate POST manager → 403", false, `error: ${(e as Error).message}`);
  }

  await mgrCtx.close();

  // Admin context (admin login redirects to MFA enroll, but cookie session is valid for API)
  const adminCtx = await browser.newContext({ baseURL: BASE_URL });
  await login(adminCtx, ADMIN_EMAIL);
  const adminApi: APIRequestContext = adminCtx.request;

  // AC2 — PATCH save + audit log
  let patchOk = false;
  let newPrompt = "";
  try {
    newPrompt = `E2E wave-8 patched at ${new Date().toISOString()}`;
    const resp = await adminApi.patch(`${BASE_URL}/api/v1/ai/agents/${DEFAULT_AGENT_ID}`, {
      data: { system_prompt: newPrompt },
    });
    const body = await resp.json().catch(() => null);
    // Route wraps: ok({ data: row }) → { data: { data: row } }
    const returned = body?.data?.data?.system_prompt ?? body?.data?.system_prompt;
    patchOk = resp.status() === 200 && returned === newPrompt;
    record(
      "AC2 PATCH save",
      patchOk,
      `HTTP ${resp.status()} returned=${JSON.stringify(returned).slice(0, 120)} expected=${JSON.stringify(newPrompt)}`,
    );
  } catch (e) {
    record("AC2 PATCH save", false, `error: ${(e as Error).message}`);
  }

  // Verify audit_log row via service role
  try {
    const sb = createClient(SUPABASE_URL, SERVICE_KEY, {
      auth: { persistSession: false },
    });
    // Try common table names
    const candidates = ["audit_log", "api_audit_log"];
    let found: { table: string; row: Record<string, unknown> } | null = null;
    for (const tbl of candidates) {
      const { data, error } = await sb
        .from(tbl)
        .select("*")
        .eq("organization_id", ORG_ID)
        .order("created_at", { ascending: false })
        .limit(20);
      if (!error && data && data.length > 0) {
        const match = data.find((r: Record<string, unknown>) => {
          const blob = JSON.stringify(r).toLowerCase();
          return (
            blob.includes(DEFAULT_AGENT_ID) ||
            blob.includes("ai_agent") ||
            blob.includes("agent")
          );
        });
        if (match) {
          found = { table: tbl, row: match };
          break;
        }
      }
    }
    record(
      "AC2 audit_log row",
      !!found,
      found
        ? `found in ${found.table}: ${JSON.stringify(found.row).slice(0, 240)}`
        : "no audit row found in audit_log/api_audit_log for this agent",
    );
  } catch (e) {
    record("AC2 audit_log row", false, `error: ${(e as Error).message}`);
  }

  // AC3 — backend Zod validation: invalid guardrail kind → 422
  try {
    const resp = await adminApi.patch(`${BASE_URL}/api/v1/ai/agents/${DEFAULT_AGENT_ID}`, {
      data: {
        guardrails: [{ kind: "unknown_kind", pattern: "x", reason: "x" }],
      },
    });
    const body = await resp.text();
    const json = (() => {
      try {
        return JSON.parse(body);
      } catch {
        return null;
      }
    })();
    const ok =
      resp.status() === 422 &&
      json?.error?.code === "validation_failed" &&
      !!json?.error?.details;
    record(
      "AC3 backend Zod 422",
      ok,
      `HTTP ${resp.status()} code=${json?.error?.code} details_keys=${
        json?.error?.details ? Object.keys(json.error.details).join(",") : "none"
      }`,
    );
  } catch (e) {
    record("AC3 backend Zod 422", false, `error: ${(e as Error).message}`);
  }

  // AC5 — DELETE is_default → 409
  try {
    const resp = await adminApi.delete(`${BASE_URL}/api/v1/ai/agents/${DEFAULT_AGENT_ID}`);
    const body = await resp.text();
    const json = (() => {
      try {
        return JSON.parse(body);
      } catch {
        return null;
      }
    })();
    const ok = resp.status() === 409 && /state_conflict|conflict|default/i.test(body);
    record(
      "AC5 DELETE is_default → 409",
      ok,
      `HTTP ${resp.status()} code=${json?.error?.code} msg=${json?.error?.message}`,
    );
  } catch (e) {
    record("AC5 DELETE is_default → 409", false, `error: ${(e as Error).message}`);
  }

  // AC3 frontend Zod (best-effort) — login as admin in UI, modify guardrail to invalid, click save, expect toast/error
  // Only attempt if MFA gate doesn't block; admin layout will redirect to /app/auth/mfa/setup or similar
  try {
    const adminPage = await adminCtx.newPage();
    await adminPage.goto(`${BASE_URL}/app/ai/agents/${DEFAULT_AGENT_ID}`, {
      waitUntil: "domcontentloaded",
    });
    await adminPage.waitForTimeout(1500);
    const finalUrl = adminPage.url();
    const blockedByMfa = /\/mfa|\/auth\/mfa/.test(finalUrl);
    const fePath = path.join(ARTIFACTS_DIR, "ac3-frontend-admin-editor.png");
    await adminPage.screenshot({ path: fePath, fullPage: true });
    record(
      "AC3 frontend Zod (admin UI accessible)",
      !blockedByMfa,
      `final URL: ${finalUrl}${
        blockedByMfa ? " (admin MFA gate active — frontend Zod validated via backend test instead)" : ""
      }; screenshot: ${fePath}`,
    );
    await adminPage.close();
  } catch (e) {
    record("AC3 frontend Zod (admin UI accessible)", false, `error: ${(e as Error).message}`);
  }

  await adminCtx.close();
  await browser.close();

  // ---------- Restore original system_prompt ----------
  if (patchOk) {
    try {
      const sb = createClient(SUPABASE_URL, SERVICE_KEY, { auth: { persistSession: false } });
      await sb
        .from("ai_agents")
        .update({ system_prompt: "Default seeded prompt (restored by E2E wave-8 cleanup)" })
        .eq("id", DEFAULT_AGENT_ID);
      console.log("[cleanup] system_prompt restored");
    } catch (e) {
      console.log("[cleanup] failed:", (e as Error).message);
    }
  }

  // ---------- Final report ----------
  const report = {
    timestamp: new Date().toISOString(),
    base_url: BASE_URL,
    results,
    summary: {
      total: results.length,
      passed: results.filter((r) => r.pass).length,
      failed: results.filter((r) => !r.pass).length,
    },
  };
  fs.writeFileSync(
    path.join(ARTIFACTS_DIR, "report.json"),
    JSON.stringify(report, null, 2),
  );
  console.log("\n=== SUMMARY ===");
  console.log(JSON.stringify(report.summary, null, 2));
  process.exit(report.summary.failed > 0 ? 1 : 0);
}

main().catch((e) => {
  console.error("FATAL:", e);
  process.exit(2);
});