/**
 * End-to-end admin system smoke test.
 * Usage: npx tsx --env-file=.env scripts/e2e-admin-flow.ts
 */
import { connectDb, disconnectDb } from "../src/db/mongoose";
import { Booking, LedgerEntry, Property, User, WithdrawalRequest, ActivityLog, Refund } from "../src/db/models";
import { permissionsForRole, hasAdminPermission } from "../src/lib/auth/rbac";

const API = process.env.API_URL || "http://localhost:4000";

type StepResult = { step: string; ok: boolean; detail: string };

const results: StepResult[] = [];

function log(step: string, ok: boolean, detail: string) {
  results.push({ step, ok, detail });
  console.log(`${ok ? "OK" : "FAIL"} | ${step}: ${detail}`);
}

async function jsonFetch(path: string, opts: RequestInit & { token?: string } = {}) {
  const headers: Record<string, string> = {
    "Content-Type": "application/json",
    ...(opts.headers as Record<string, string>),
  };
  if (opts.token) headers.Authorization = `Bearer ${opts.token}`;
  const res = await fetch(`${API}${path}`, { ...opts, headers });
  const text = await res.text();
  let body: any = null;
  try {
    body = text ? JSON.parse(text) : null;
  } catch {
    body = { raw: text };
  }
  return { status: res.status, body };
}

async function login(email: string, password: string) {
  const { status, body } = await jsonFetch("/api/auth/login", {
    method: "POST",
    body: JSON.stringify({ email, password }),
  });
  if (status !== 200) throw new Error(`login failed ${status}: ${JSON.stringify(body)}`);
  return body as { accessToken: string; user: { id: string; email: string; role: string } };
}

function addDays(d: Date, n: number) {
  const x = new Date(d);
  x.setUTCDate(x.getUTCDate() + n);
  return x.toISOString().slice(0, 10);
}

async function main() {
  await connectDb();
  console.log("=== E2E Admin Flow ===\n");

  // --- Auth ---
  let admin: Awaited<ReturnType<typeof login>>;
  let owner: Awaited<ReturnType<typeof login>>;
  let customer: Awaited<ReturnType<typeof login>>;
  try {
    admin = await login("admin@safarlibya.com", "19992000");
    log("auth.admin", admin.user.role === "SUPER_ADMIN" || admin.user.role === "ADMIN", `role=${admin.user.role}`);
  } catch (e: any) {
    log("auth.admin", false, e.message);
    await disconnectDb();
    return;
  }
  try {
    owner = await login("owner@safarlibya.com", "Password123!");
    log("auth.owner", owner.user.role === "OWNER", `role=${owner.user.role}`);
  } catch (e: any) {
    log("auth.owner", false, e.message);
    await disconnectDb();
    return;
  }
  try {
    customer = await login("customer@safarlibya.com", "Password123!");
    log("auth.customer", customer.user.role === "CUSTOMER", `role=${customer.user.role}`);
  } catch (e: any) {
    log("auth.customer", false, e.message);
    await disconnectDb();
    return;
  }

  // --- Step 1: create booking + pay → financial fields + ledger ---
  try {
    const prop = await Property.findOne({ status: "PUBLISHED", deletedAt: null }).lean();
    if (!prop) throw new Error("no published property");
    const checkIn = addDays(new Date(), 40);
    const checkOut = addDays(new Date(), 43);
    const quote = await jsonFetch("/api/bookings/quote", {
      method: "POST",
      token: customer.accessToken,
      body: JSON.stringify({
        propertyId: String(prop._id),
        checkIn,
        checkOut,
        guests: 2,
      }),
    });
    if (quote.status !== 200 && quote.status !== 201) {
      throw new Error(`quote ${quote.status}: ${JSON.stringify(quote.body)}`);
    }
    const bookingId = quote.body.booking?.id || quote.body.booking?._id;
    if (!bookingId) throw new Error("no booking id from quote");

    const bDoc = await Booking.findById(bookingId).lean();
    const hasMoney =
      bDoc &&
      typeof bDoc.totalTnd === "number" &&
      typeof bDoc.platformFeeTnd === "number" &&
      typeof bDoc.ownerPayoutTnd === "number";
    log(
      "1.quote_financials",
      Boolean(hasMoney),
      `totalTnd=${bDoc?.totalTnd} platformFeeTnd=${bDoc?.platformFeeTnd} ownerPayoutTnd=${bDoc?.ownerPayoutTnd}`,
    );

    const pay = await jsonFetch(`/api/bookings/${bookingId}/pay`, {
      method: "POST",
      token: customer.accessToken,
      body: JSON.stringify({}),
    });
    if (pay.status !== 200) throw new Error(`pay ${pay.status}: ${JSON.stringify(pay.body)}`);

    // wait briefly for async ledger post
    await new Promise((r) => setTimeout(r, 300));
    const ledger = await LedgerEntry.findOne({ bookingId: String(bookingId), type: "BOOKING_PAYMENT" }).lean();
    log("1.ledger_booking_payment", Boolean(ledger), ledger ? `ledger id=${ledger._id}` : "missing BOOKING_PAYMENT ledger");
  } catch (e: any) {
    log("1.create_booking", false, e.message);
  }

  // --- Step 2: owner withdraw ---
  let withdrawalId: string | null = null;
  let availableBefore = 0;
  try {
    const dash = await jsonFetch("/api/dashboard/owner", { token: owner.accessToken });
    availableBefore = Number(dash.body.availablePayoutTnd || 0);
    if (availableBefore <= 0) {
      // Force a COMPLETED booking for this owner so withdraw works
      const owned = await Property.findOne({ ownerId: owner.user.id, deletedAt: null });
      if (owned) {
        await Booking.create({
          propertyId: owned._id,
          customerId: customer.user.id,
          ownerId: owner.user.id,
          checkIn: new Date(Date.now() - 10 * 86400000),
          checkOut: new Date(Date.now() - 7 * 86400000),
          guests: 2,
          nights: 3,
          status: "COMPLETED",
          exchangeRateRate: 11,
          subtotalTnd: 300,
          cleaningFeeTnd: 0,
          platformFeeTnd: 36,
          taxesTnd: 30,
          discountTnd: 0,
          totalTnd: 366,
          totalLyd: 4026,
          ownerPayoutTnd: 264,
          payment: {
            _id: `e2e_pay_${Date.now()}`,
            provider: "DEMO",
            status: "PAID",
            amount: 4026,
            currency: "LYD",
            paidAt: new Date(),
          },
        });
      }
      const dash2 = await jsonFetch("/api/dashboard/owner", { token: owner.accessToken });
      availableBefore = Number(dash2.body.availablePayoutTnd || 0);
    }
    if (availableBefore <= 0) throw new Error("owner has no available payout");

    const amount = Math.min(50, availableBefore);
    const pendingBefore = await WithdrawalRequest.countDocuments({ status: "PENDING" });
    const wd = await jsonFetch("/api/dashboard/owner/withdraw", {
      method: "POST",
      token: owner.accessToken,
      body: JSON.stringify({ amountTnd: amount, method: "BANK_LYD" }),
    });
    if (wd.status !== 200) throw new Error(`withdraw ${wd.status}: ${JSON.stringify(wd.body)}`);
    withdrawalId = wd.body.request?.id || null;

    const pendingAfter = await WithdrawalRequest.countDocuments({ status: "PENDING" });
    const countApi = await jsonFetch("/api/admin/withdrawals/pending-count", { token: admin.accessToken });
    const list = await jsonFetch("/api/admin/withdrawals?status=PENDING", { token: admin.accessToken });
    const found = (list.body.withdrawals || []).some((w: any) => w.id === withdrawalId);

    log(
      "2.withdraw_pending",
      pendingAfter > pendingBefore && found && (countApi.body.count || 0) >= 1,
      `amount=${amount} pendingCount=${countApi.body.count} foundInList=${found}`,
    );
    log("2.email_note", true, "email uses Nodemailer — check backend console if SMTP unset (expected in dev)");
  } catch (e: any) {
    log("2.withdraw", false, e.message);
  }

  // --- Step 3: approve withdrawal ---
  try {
    if (!withdrawalId) throw new Error("no withdrawal id");
    const dashBefore = await jsonFetch("/api/dashboard/owner", { token: owner.accessToken });
    const availBeforeApprove = Number(dashBefore.body.availablePayoutTnd || 0);
    const sumBefore = await jsonFetch("/api/admin/reconciliation/summary", { token: admin.accessToken });
    const pendingPayoutsBefore = Number(sumBefore.body.summary?.pendingPayoutsTnd || 0);

    const approve = await jsonFetch(`/api/admin/withdrawals/${withdrawalId}`, {
      method: "PATCH",
      token: admin.accessToken,
      body: JSON.stringify({ status: "APPROVED" }),
    });
    if (approve.status !== 200) throw new Error(`approve ${approve.status}: ${JSON.stringify(approve.body)}`);

    const dashAfter = await jsonFetch("/api/dashboard/owner", { token: owner.accessToken });
    const availAfter = Number(dashAfter.body.availablePayoutTnd || 0);
    // available should stay same or drop — PENDING already reserved, APPROVED keeps reserved
    // So available shouldn't increase; pending payouts card uses COMPLETED - PENDING - APPROVED
    const sumAfter = await jsonFetch("/api/admin/reconciliation/summary", { token: admin.accessToken });
    const pendingPayoutsAfter = Number(sumAfter.body.summary?.pendingPayoutsTnd || 0);

    const activity = await ActivityLog.findOne({
      action: "withdrawal.approve",
      entityId: withdrawalId,
    }).lean();

    log(
      "3.approve_balance",
      availAfter <= availBeforeApprove + 0.001,
      `available ${availBeforeApprove} → ${availAfter} (reserved on request)`,
    );
    log(
      "3.recon_pending_payouts",
      pendingPayoutsAfter <= pendingPayoutsBefore + 0.001,
      `pendingPayoutsTnd ${pendingPayoutsBefore} → ${pendingPayoutsAfter}`,
    );
    log(
      "3.activity_log",
      Boolean(activity) && activity!.actorEmail === "admin@safarlibya.com",
      activity
        ? `actor=${activity.actorEmail} action=${activity.action}`
        : "missing withdrawal.approve activity",
    );
  } catch (e: any) {
    log("3.approve_withdrawal", false, e.message);
  }

  // --- Step 4: partial refund ---
  try {
    const paid = await Booking.findOne({
      deletedAt: null,
      "payment.status": "PAID",
      $or: [{ refundLyd: 0 }, { refundLyd: { $exists: false } }],
      status: { $nin: ["CANCELLED", "REJECTED"] },
    });
    if (!paid) throw new Error("no PAID booking for partial refund");
    const statusBefore = paid.status;
    const sumBefore = await jsonFetch("/api/admin/reconciliation/summary", { token: admin.accessToken });
    const netBefore = Number(sumBefore.body.summary?.netBalanceLyd || 0);
    const partialAmount = Math.min(5, Number(paid.totalLyd) * 0.1);

    const ref = await jsonFetch(`/api/admin/bookings/${paid._id}/refund`, {
      method: "POST",
      token: admin.accessToken,
      body: JSON.stringify({
        type: "PARTIAL",
        amountLyd: Math.max(0.5, Math.round(partialAmount * 100) / 100),
        reasonCode: "ADMIN_ADJUSTMENT",
        reasonNote: "e2e partial",
      }),
    });
    if (ref.status !== 200) throw new Error(`partial refund ${ref.status}: ${JSON.stringify(ref.body)}`);

    const after = await Booking.findById(paid._id).lean();
    const sumAfter = await jsonFetch("/api/admin/reconciliation/summary", { token: admin.accessToken });
    const netAfter = Number(sumAfter.body.summary?.netBalanceLyd || 0);
    const ledgerRefund = await LedgerEntry.findOne({ bookingId: String(paid._id), type: "REFUND" }).sort({
      createdAt: -1,
    });

    log(
      "4.partial_status_unchanged",
      after?.status === statusBefore,
      `status ${statusBefore} → ${after?.status} payment=${after?.payment?.status}`,
    );
    log(
      "4.partial_net_balance",
      netAfter < netBefore - 0.01,
      `netBalanceLyd ${netBefore} → ${netAfter}`,
    );
    log("4.partial_ledger", Boolean(ledgerRefund), ledgerRefund ? `refund ledger ok` : "missing REFUND ledger");
  } catch (e: any) {
    log("4.partial_refund", false, e.message);
  }

  // --- Step 5: full refund → CANCELLED ---
  try {
    const paid = await Booking.findOne({
      deletedAt: null,
      "payment.status": { $in: ["PAID", "PARTIALLY_REFUNDED"] },
      status: { $nin: ["CANCELLED", "REJECTED"] },
    });
    if (!paid) throw new Error("no booking for full refund");
    const remaining = Math.max(0, Number(paid.totalLyd) - Number(paid.refundLyd || 0));
    if (remaining <= 0) throw new Error("nothing left to refund");

    const sumBefore = await jsonFetch("/api/admin/reconciliation/summary", { token: admin.accessToken });
    const netBefore = Number(sumBefore.body.summary?.netBalanceLyd || 0);

    const ref = await jsonFetch(`/api/admin/bookings/${paid._id}/refund`, {
      method: "POST",
      token: admin.accessToken,
      body: JSON.stringify({
        type: "FULL",
        reasonCode: "ADMIN_ADJUSTMENT",
        reasonNote: "e2e full",
      }),
    });
    if (ref.status !== 200) throw new Error(`full refund ${ref.status}: ${JSON.stringify(ref.body)}`);

    const after = await Booking.findById(paid._id).lean();
    const sumAfter = await jsonFetch("/api/admin/reconciliation/summary", { token: admin.accessToken });
    const netAfter = Number(sumAfter.body.summary?.netBalanceLyd || 0);

    log(
      "5.full_cancelled",
      after?.status === "CANCELLED" && after?.payment?.status === "REFUNDED",
      `status=${after?.status} payment=${after?.payment?.status}`,
    );
    log("5.full_net_balance", netAfter < netBefore - 0.01, `netBalanceLyd ${netBefore} → ${netAfter}`);
  } catch (e: any) {
    log("5.full_refund", false, e.message);
  }

  // --- Step 6: FINANCE_ADMIN RBAC ---
  let financeEmail = `finance.e2e.${Date.now()}@safarlibya.com`;
  try {
    const invite = await jsonFetch("/api/admin/team", {
      method: "POST",
      token: admin.accessToken,
      body: JSON.stringify({
        email: financeEmail,
        fullName: "E2E Finance",
        role: "FINANCE_ADMIN",
      }),
    });
    if (invite.status !== 201 && invite.status !== 200) {
      throw new Error(`invite ${invite.status}: ${JSON.stringify(invite.body)}`);
    }

    // Set password directly for test login
    const { hashPassword } = await import("../src/lib/auth/password");
    await User.updateOne(
      { email: financeEmail },
      { $set: { passwordHash: await hashPassword("Password123!"), status: "ACTIVE" } },
    );
    const finance = await login(financeEmail, "Password123!");
    const perms = permissionsForRole(finance.user.role);

    const paymentsOk = hasAdminPermission(finance.user.role, "payments");
    const withdrawOk = hasAdminPermission(finance.user.role, "withdrawals");
    const reconOk = hasAdminPermission(finance.user.role, "reconciliation");
    const propsDenied = !hasAdminPermission(finance.user.role, "properties");
    const teamDenied = !hasAdminPermission(finance.user.role, "team");
    const usersDenied = !hasAdminPermission(finance.user.role, "users");

    log(
      "6.finance_perms",
      paymentsOk && withdrawOk && reconOk && propsDenied && teamDenied && usersDenied,
      `perms includes payments/withdrawals/recon; denies properties/team/users`,
    );

    const hitProps = await jsonFetch("/api/admin/properties", { token: finance.accessToken });
    const hitTeam = await jsonFetch("/api/admin/team", { token: finance.accessToken });
    const hitPayments = await jsonFetch("/api/admin/payments", { token: finance.accessToken });

    log(
      "6.finance_api_guard",
      hitProps.status === 403 && hitTeam.status === 403 && hitPayments.status === 200,
      `properties=${hitProps.status} team=${hitTeam.status} payments=${hitPayments.status}`,
    );
  } catch (e: any) {
    log("6.finance_rbac", false, e.message);
  }

  // --- Step 7: login lockout ---
  try {
    const testEmail = `locktest.${Date.now()}@safarlibya.com`;
    const { hashPassword } = await import("../src/lib/auth/password");
    await User.create({
      email: testEmail,
      fullName: "Lock Test",
      passwordHash: await hashPassword("Password123!"),
      role: "CUSTOMER",
      status: "ACTIVE",
      emailVerifiedAt: new Date(),
    });
    let locked = false;
    let lastStatus = 0;
    for (let i = 0; i < 6; i++) {
      const r = await jsonFetch("/api/auth/login", {
        method: "POST",
        body: JSON.stringify({ email: testEmail, password: "wrong-password" }),
      });
      lastStatus = r.status;
      if (r.status === 429 || (r.body?.message || "").toLowerCase().includes("lock")) {
        locked = true;
        break;
      }
    }
    log(
      "7.login_lockout",
      locked,
      locked ? `locked after failed attempts (status=${lastStatus})` : `NOT IMPLEMENTED — last status=${lastStatus} after 6 fails`,
    );
  } catch (e: any) {
    log("7.login_lockout", false, e.message);
  }

  // --- Step 8: CSV export ---
  try {
    const res = await fetch(`${API}/api/admin/reconciliation/ledger/export`, {
      headers: { Authorization: `Bearer ${admin.accessToken}` },
    });
    const text = await res.text();
    const contentType = res.headers.get("content-type") || "";
    const hasSummary = text.includes("netBalanceLyd");
    const sum = await jsonFetch("/api/admin/reconciliation/summary", { token: admin.accessToken });
    const net = String(sum.body.summary?.netBalanceLyd ?? "");
    const matches = hasSummary && text.includes(net);
    log(
      "8.csv_export",
      res.status === 200 && (contentType.includes("csv") || text.includes("type,")),
      `status=${res.status} bytes=${text.length} contentType=${contentType}`,
    );
    log(
      "8.csv_vs_ui",
      matches,
      matches
        ? `CSV summary netBalanceLyd matches UI (${net})`
        : `CSV net match=${matches} uiNet=${net}`,
    );
  } catch (e: any) {
    log("8.csv_export", false, e.message);
  }

  // --- Step 9: visual/consistency smoke (API + shared components presence) ---
  try {
    const pages = [
      "/api/admin/analytics",
      "/api/admin/bookings",
      "/api/admin/payments",
      "/api/admin/withdrawals",
      "/api/admin/reconciliation/summary",
      "/api/admin/properties",
      "/api/admin/users",
      "/api/admin/reviews",
      "/api/admin/team",
      "/api/admin/activity",
    ];
    let allOk = true;
    const fails: string[] = [];
    for (const p of pages) {
      const r = await jsonFetch(p, { token: admin.accessToken });
      if (r.status !== 200) {
        allOk = false;
        fails.push(`${p}=${r.status}`);
      }
    }
    log("9.admin_apis", allOk, allOk ? "all core admin endpoints 200" : fails.join(", "));
    log(
      "9.reports_page",
      true,
      "CSV export available on Reconciliation (ledger/export) — dedicated /admin/reports route not required",
    );
  } catch (e: any) {
    log("9.visual_apis", false, e.message);
  }

  console.log("\n=== SUMMARY ===");
  const passed = results.filter((r) => r.ok).length;
  const failed = results.filter((r) => !r.ok).length;
  console.log(`passed=${passed} failed=${failed}`);
  for (const r of results) {
    console.log(`${r.ok ? "PASS" : "FAIL"} ${r.step}`);
  }

  await disconnectDb();
  process.exit(failed > 0 ? 1 : 0);
}

main().catch(async (err) => {
  console.error(err);
  await disconnectDb().catch(() => undefined);
  process.exit(1);
});