package openrouter

import (
	"bytes"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"io/fs"
	"strings"
	"testing"

	"gopkg.in/yaml.v3"
)

func TestCatalogLayoutAndContents(t *testing.T) {
	fsys := FS()
	if fsys == nil {
		t.Fatal("FS returned nil")
	}

	manifestPath := Root + "/backend.json"
	manifestData, err := fs.ReadFile(fsys, manifestPath)
	if err != nil {
		t.Fatalf("read manifest: %v", err)
	}
	assertOpenRouterManifest(t, manifestData)

	profilesRoot := Root + "/profiles"
	profileCount := 0
	ids := map[string]string{}
	err = fs.WalkDir(fsys, Root, func(path string, entry fs.DirEntry, walkErr error) error {
		if walkErr != nil {
			return walkErr
		}
		if path == Root || path == profilesRoot || entry.IsDir() {
			return nil
		}
		if path == manifestPath {
			if !entry.Type().IsRegular() {
				return fmt.Errorf("manifest is not a regular file")
			}
			return nil
		}
		if !strings.HasPrefix(path, profilesRoot+"/") {
			return fmt.Errorf("unexpected catalog entry %q", path)
		}
		if !entry.Type().IsRegular() || !strings.HasSuffix(path, ".yml") {
			return fmt.Errorf("profile asset %q is not a regular .yml file", path)
		}

		data, err := fs.ReadFile(fsys, path)
		if err != nil {
			return err
		}
		id := assertOpenRouterProfile(t, path, data)
		if previous, found := ids[id]; found {
			return fmt.Errorf("duplicate profile ID %q in %s and %s", id, previous, path)
		}
		ids[id] = path
		profileCount++
		return nil
	})
	if err != nil {
		t.Fatalf("validate catalog layout: %v", err)
	}
	if profileCount == 0 {
		t.Fatal("catalog contains no profiles")
	}
}

func assertOpenRouterManifest(t *testing.T, data []byte) {
	t.Helper()

	type manifest struct {
		SchemaVersion    int             `json:"schema_version"`
		ID               string          `json:"id"`
		Endpoint         string          `json:"endpoint"`
		APIKeyEnv        string          `json:"api_key_env"`
		ConcurrencyLimit int             `json:"concurrency_limit"`
		QueueCapacity    int             `json:"queue_capacity"`
		ExtraParams      json.RawMessage `json:"extra_params"`
	}

	decoder := json.NewDecoder(bytes.NewReader(data))
	decoder.DisallowUnknownFields()
	var value manifest
	if err := decoder.Decode(&value); err != nil {
		t.Fatalf("decode manifest: %v", err)
	}
	if err := requireJSONEnd(decoder); err != nil {
		t.Fatalf("decode manifest: %v", err)
	}
	if value.SchemaVersion != 1 ||
		value.ID != "openrouter" ||
		value.Endpoint != "https://openrouter.ai/api/v1" ||
		value.APIKeyEnv != "OPENROUTER_API_KEY" ||
		value.ConcurrencyLimit != 16 ||
		value.QueueCapacity != 1024 ||
		string(value.ExtraParams) != "null" {
		t.Fatalf("unexpected manifest: %#v", value)
	}
}

func requireJSONEnd(decoder *json.Decoder) error {
	var trailing any
	if err := decoder.Decode(&trailing); errors.Is(err, io.EOF) {
		return nil
	} else if err != nil {
		return err
	}
	return errors.New("catalog manifest must contain exactly one JSON value")
}

func assertOpenRouterProfile(t *testing.T, path string, data []byte) string {
	t.Helper()

	var document yaml.Node
	decoder := yaml.NewDecoder(bytes.NewReader(data))
	if err := decoder.Decode(&document); err != nil {
		t.Fatalf("decode profile %s: %v", path, err)
	}
	if err := requireYAMLEnd(decoder); err != nil {
		t.Fatalf("decode profile %s: %v", path, err)
	}
	if document.Kind != yaml.DocumentNode || len(document.Content) != 1 || document.Content[0].Kind != yaml.MappingNode {
		t.Fatalf("profile %s must contain one mapping document", path)
	}

	fields := yamlFields(document.Content[0])
	idField := fields["id"]
	if idField == nil {
		t.Fatalf("profile %s has no ID", path)
	}
	id := strings.TrimSpace(idField.Value)
	if id == "" {
		t.Fatalf("profile %s has a blank ID", path)
	}
	if fields["backend"] == nil || fields["backend"].Value != "openrouter" {
		t.Fatalf("profile %s does not select openrouter", path)
	}
	for _, field := range []string{"endpoint", "api_key_env", "api_key"} {
		if fields[field] != nil {
			t.Fatalf("profile %s contains prohibited %s field", path, field)
		}
	}
	if extraParams := fields["extra_params"]; extraParams != nil {
		assertNoSecretKeys(t, path, extraParams)
	}
	return id
}

func requireYAMLEnd(decoder *yaml.Decoder) error {
	var trailing yaml.Node
	if err := decoder.Decode(&trailing); errors.Is(err, io.EOF) {
		return nil
	} else if err != nil {
		return err
	}
	return errors.New("profile must contain exactly one YAML document")
}

func yamlFields(mapping *yaml.Node) map[string]*yaml.Node {
	fields := make(map[string]*yaml.Node, len(mapping.Content)/2)
	for index := 0; index+1 < len(mapping.Content); index += 2 {
		fields[mapping.Content[index].Value] = mapping.Content[index+1]
	}
	return fields
}

func assertNoSecretKeys(t *testing.T, path string, node *yaml.Node) {
	t.Helper()

	forbidden := map[string]bool{
		"api_key":       true,
		"apikey":        true,
		"authorization": true,
		"credential":    true,
		"credentials":   true,
		"password":      true,
		"secret":        true,
		"token":         true,
		"access_token":  true,
	}
	var visit func(*yaml.Node)
	visit = func(current *yaml.Node) {
		if current.Kind == yaml.MappingNode {
			for index := 0; index+1 < len(current.Content); index += 2 {
				if forbidden[strings.ToLower(current.Content[index].Value)] {
					t.Fatalf("profile %s contains a prohibited extra_params key", path)
				}
				visit(current.Content[index+1])
			}
			return
		}
		for _, child := range current.Content {
			visit(child)
		}
	}
	visit(node)
}