"""审批流程管理 API 测试 — 覆盖 CRUD + 设默认 + 克隆功能。"""
import pytest
from httpx import AsyncClient

from tests.conftest import auth_header

BASE = "/api/v1/workflows"

SAMPLE_WORKFLOW = {
    "name": "标准审批流",
    "description": "DBA初审 + 管理员终审",
    "is_default": True,
    "steps": [
        {
            "step_number": 1,
            "name": "DBA审核",
            "step_type": "serial",
            "approver_role": "dba",
            "is_required": True,
            "timeout_hours": 24,
            "auto_approve_on_timeout": False,
        },
        {
            "step_number": 2,
            "name": "管理员审核",
            "step_type": "serial",
            "approver_role": "admin",
            "is_required": True,
            "timeout_hours": 48,
            "auto_approve_on_timeout": False,
        },
    ],
}


async def _create_workflow(client: AsyncClient, token: str, overrides: dict = None) -> dict:
    payload = {**SAMPLE_WORKFLOW}
    if overrides:
        payload.update(overrides)
    resp = await client.post(BASE, json=payload, headers=auth_header(token))
    return resp


# ────────────────────────── Permission Tests ──────────────────────────


class TestWorkflowPermissions:
    """权限检查 — workflow 管理 admin/dba 可读，仅 admin 可写。"""

    @pytest.mark.asyncio
    async def test_list_dba_allowed(self, client, dba_token):
        resp = await client.get(BASE, headers=auth_header(dba_token))
        assert resp.status_code == 200

    @pytest.mark.asyncio
    async def test_list_developer_forbidden(self, client, developer_token):
        resp = await client.get(BASE, headers=auth_header(developer_token))
        assert resp.status_code == 403

    @pytest.mark.asyncio
    async def test_list_guest_forbidden(self, client, guest_token):
        resp = await client.get(BASE, headers=auth_header(guest_token))
        assert resp.status_code == 403

    @pytest.mark.asyncio
    async def test_create_dba_forbidden(self, client, dba_token):
        resp = await _create_workflow(client, dba_token)
        assert resp.status_code == 403

    @pytest.mark.asyncio
    async def test_create_developer_forbidden(self, client, developer_token):
        resp = await _create_workflow(client, developer_token)
        assert resp.status_code == 403

    @pytest.mark.asyncio
    async def test_no_auth_returns_401(self, client):
        resp = await client.get(BASE)
        assert resp.status_code == 401
        resp2 = await client.post(BASE, json=SAMPLE_WORKFLOW)
        assert resp2.status_code == 401


# ────────────────────────── Create Tests ──────────────────────────


class TestCreateWorkflow:
    """创建审批流程。"""

    @pytest.mark.asyncio
    async def test_create_success(self, client, admin_token):
        resp = await _create_workflow(client, admin_token)
        assert resp.status_code == 201
        body = resp.json()
        assert body["name"] == "标准审批流"
        assert body["is_default"] is True
        assert len(body["steps"]) == 2
        assert body["steps"][0]["name"] == "DBA审核"
        assert body["steps"][1]["name"] == "管理员审核"

    @pytest.mark.asyncio
    async def test_create_non_default(self, client, admin_token):
        resp = await _create_workflow(client, admin_token, {"is_default": False})
        assert resp.status_code == 201
        assert resp.json()["is_default"] is False

    @pytest.mark.asyncio
    async def test_create_only_default_one(self, client, admin_token):
        """设为默认时，取消其他默认。"""
        r1 = await _create_workflow(client, admin_token, {"name": "WF1", "is_default": True})
        assert r1.status_code == 201
        r2 = await _create_workflow(client, admin_token, {"name": "WF2", "is_default": True})
        assert r2.status_code == 201
        # r2 should be default now
        assert r2.json()["is_default"] is True
        # list and verify only one default
        resp = await client.get(BASE, headers=auth_header(admin_token))
        workflows = resp.json()
        defaults = [w for w in workflows if w["is_default"]]
        assert len(defaults) == 1
        assert defaults[0]["name"] == "WF2"


# ────────────────────────── List Tests ──────────────────────────


class TestListWorkflows:

    @pytest.mark.asyncio
    async def test_list_empty(self, client, admin_token):
        resp = await client.get(BASE, headers=auth_header(admin_token))
        assert resp.status_code == 200
        assert resp.json() == []

    @pytest.mark.asyncio
    async def test_list_returns_created(self, client, admin_token):
        await _create_workflow(client, admin_token, {"name": "WF-A"})
        await _create_workflow(client, admin_token, {"name": "WF-B", "is_default": False})
        resp = await client.get(BASE, headers=auth_header(admin_token))
        assert resp.status_code == 200
        names = [w["name"] for w in resp.json()]
        assert "WF-A" in names
        assert "WF-B" in names


# ────────────────────────── Get Detail Tests ──────────────────────────


class TestGetWorkflow:

    @pytest.mark.asyncio
    async def test_get_success(self, client, admin_token):
        created = (await _create_workflow(client, admin_token)).json()
        resp = await client.get(
            f"{BASE}/{created['id']}", headers=auth_header(admin_token)
        )
        assert resp.status_code == 200
        assert resp.json()["name"] == created["name"]

    @pytest.mark.asyncio
    async def test_get_not_found(self, client, admin_token):
        resp = await client.get(f"{BASE}/9999", headers=auth_header(admin_token))
        assert resp.status_code == 404

    @pytest.mark.asyncio
    async def test_get_dba_allowed(self, client, admin_token, dba_token):
        created = (await _create_workflow(client, admin_token)).json()
        resp = await client.get(
            f"{BASE}/{created['id']}", headers=auth_header(dba_token)
        )
        assert resp.status_code == 200


# ────────────────────────── Update Tests ──────────────────────────


class TestUpdateWorkflow:

    @pytest.mark.asyncio
    async def test_update_name(self, client, admin_token):
        created = (await _create_workflow(client, admin_token)).json()
        resp = await client.put(
            f"{BASE}/{created['id']}",
            json={"name": "新名称"},
            headers=auth_header(admin_token),
        )
        assert resp.status_code == 200
        assert resp.json()["name"] == "新名称"

    @pytest.mark.asyncio
    async def test_update_description(self, client, admin_token):
        created = (await _create_workflow(client, admin_token)).json()
        resp = await client.put(
            f"{BASE}/{created['id']}",
            json={"description": "新描述"},
            headers=auth_header(admin_token),
        )
        assert resp.status_code == 200
        assert resp.json()["description"] == "新描述"

    @pytest.mark.asyncio
    async def test_deactivate(self, client, admin_token):
        created = (await _create_workflow(client, admin_token)).json()
        resp = await client.put(
            f"{BASE}/{created['id']}",
            json={"is_active": False},
            headers=auth_header(admin_token),
        )
        assert resp.status_code == 200
        assert resp.json()["is_active"] is False

    @pytest.mark.asyncio
    async def test_update_not_found(self, client, admin_token):
        resp = await client.put(
            f"{BASE}/9999", json={"name": "x"}, headers=auth_header(admin_token)
        )
        assert resp.status_code == 404

    @pytest.mark.asyncio
    async def test_update_dba_forbidden(self, client, admin_token, dba_token):
        created = (await _create_workflow(client, admin_token)).json()
        resp = await client.put(
            f"{BASE}/{created['id']}",
            json={"name": "x"},
            headers=auth_header(dba_token),
        )
        assert resp.status_code == 403


# ────────────────────────── Delete Tests ──────────────────────────


class TestDeleteWorkflow:
    """删除 = 软删除 (is_active=False)。"""

    @pytest.mark.asyncio
    async def test_delete_success(self, client, admin_token):
        created = (await _create_workflow(client, admin_token)).json()
        resp = await client.delete(
            f"{BASE}/{created['id']}", headers=auth_header(admin_token)
        )
        assert resp.status_code == 200
        # should not appear in list (only active)
        resp2 = await client.get(BASE, headers=auth_header(admin_token))
        ids = [w["id"] for w in resp2.json()]
        assert created["id"] not in ids

    @pytest.mark.asyncio
    async def test_delete_not_found(self, client, admin_token):
        resp = await client.delete(f"{BASE}/9999", headers=auth_header(admin_token))
        assert resp.status_code == 404

    @pytest.mark.asyncio
    async def test_delete_dba_forbidden(self, client, admin_token, dba_token):
        created = (await _create_workflow(client, admin_token)).json()
        resp = await client.delete(
            f"{BASE}/{created['id']}", headers=auth_header(dba_token)
        )
        assert resp.status_code == 403


# ────────────────────────── Set Default Tests ──────────────────────────


class TestSetDefaultWorkflow:

    @pytest.mark.asyncio
    async def test_set_default(self, client, admin_token):
        r1 = await _create_workflow(client, admin_token, {"name": "WF1", "is_default": True})
        r2 = await _create_workflow(client, admin_token, {"name": "WF2", "is_default": False})
        wf1_id = r1.json()["id"]
        wf2_id = r2.json()["id"]

        # Set WF2 as default
        resp = await client.post(
            f"{BASE}/{wf2_id}/set-default", headers=auth_header(admin_token)
        )
        assert resp.status_code == 200
        assert "已设为默认" in resp.json()["message"]

        # Verify WF2 is default
        resp2 = await client.get(BASE, headers=auth_header(admin_token))
        workflows = resp2.json()
        defaults = [w for w in workflows if w["is_default"]]
        assert len(defaults) == 1
        assert defaults[0]["id"] == wf2_id

    @pytest.mark.asyncio
    async def test_set_default_not_found(self, client, admin_token):
        resp = await client.post(f"{BASE}/9999/set-default", headers=auth_header(admin_token))
        assert resp.status_code == 404


# ────────────────────────── Clone Tests ──────────────────────────


class TestCloneWorkflow:

    @pytest.mark.asyncio
    async def test_clone_success(self, client, admin_token):
        created = (await _create_workflow(client, admin_token)).json()
        resp = await client.post(
            f"{BASE}/{created['id']}/clone", headers=auth_header(admin_token)
        )
        assert resp.status_code == 200
        cloned = resp.json()
        assert cloned["name"] == "标准审批流 (副本)"
        assert cloned["is_default"] is False
        assert cloned["id"] != created["id"]
        # Steps cloned
        assert len(cloned["steps"]) == 2
        assert cloned["steps"][0]["workflow_id"] == cloned["id"]

    @pytest.mark.asyncio
    async def test_clone_not_found(self, client, admin_token):
        resp = await client.post(f"{BASE}/9999/clone", headers=auth_header(admin_token))
        assert resp.status_code in (404, 422)

    @pytest.mark.asyncio
    async def test_clone_dba_forbidden(self, client, admin_token, dba_token):
        created = (await _create_workflow(client, admin_token)).json()
        resp = await client.post(
            f"{BASE}/{created['id']}/clone", headers=auth_header(dba_token)
        )
        assert resp.status_code == 403