import { expect, test as base, type APIRequestContext, type APIResponse } from '@playwright/test';
import { translations } from '../src/i18n/translations';
import type { CvVariant } from '../src/cvBuilder';

const apiUrl = 'http://localhost:5302/api';
const password = 'E2ePassword123!';
type Owner = { id: string; email: string; headers: Record<string, string> };
type SourceItem = { id?: string; [key: string]: unknown };
type CareerProfile = Record<string, unknown> & {
  contact: Record<string, unknown>;
  jobs: SourceItem[];
  education: SourceItem[];
  projects: SourceItem[];
  certifications: SourceItem[];
};
type CareerReadback = { profile: CareerProfile; completeness: unknown; cvText: string | null };
type CareerVersion = { version: number; source: string; createdAtUtc: string; isCurrent: boolean };
type Preview = { themeId: string; html: string; suggestedFileName: string };

async function json<T>(response: APIResponse, status = 200): Promise<T> {
  expect(response.status(), `${response.url()} must return ${status}`).toBe(status);
  return response.json();
}

async function login(api: APIRequestContext, email: string): Promise<Owner> {
  expect((await api.post(`${apiUrl}/auth/login`, { data: { email, password } })).status()).toBe(200);
  const me = await json<{ id: string; sessionContext: string }>(await api.get(`${apiUrl}/auth/me`));
  const csrf = (await api.storageState()).cookies.find(cookie => cookie.name === 'XSRF-TOKEN');
  expect(csrf).toBeDefined();
  return { id: me.id, email, headers: { 'X-CSRF-TOKEN': csrf!.value, 'X-Session-Context': me.sessionContext } };
}

async function createOwner(admin: APIRequestContext, headers: Record<string, string>) {
  const email = `p7-career-ids-${Date.now()}-${Math.random().toString(36).slice(2)}@example.test`;
  expect((await admin.post(`${apiUrl}/users`, { headers, data: { email, password, roles: [] } })).status()).toBe(200);
  return email;
}

const test = base.extend<{ owner: Owner }>({
  owner: async ({ page, context, playwright }, provide) => {
    const admin = await playwright.request.newContext();
    try {
      const adminOwner = await login(admin, 'e2e@example.test');
      const owner = await login(page.request, await createOwner(admin, adminOwner.headers));
      expect((await page.request.put(`${apiUrl}/auth/preferences/language`, { headers: owner.headers, data: { language: 'en' } })).status()).toBe(204);
      await context.route('**/*', route => {
        const url = new URL(route.request().url());
        return ['localhost', '127.0.0.1'].includes(url.hostname) || ['data:', 'blob:', 'about:'].includes(url.protocol)
          ? route.continue() : route.abort();
      });
      await context.addInitScript(() => {
        localStorage.setItem('uiLanguage', 'en');
        localStorage.setItem('jobtracker.themeMode', 'light');
      });
      await provide(owner);
    } finally { await admin.dispose(); }
  },
});

function sourceIds(profile: CareerProfile) {
  return Object.fromEntries((['jobs', 'education', 'projects', 'certifications'] as const)
    .map(key => [key, profile[key].map(item => item.id)]));
}

function historyMetadata(versions: CareerVersion[]) {
  return versions.map(({ version, source, createdAtUtc }) => ({ version, source, createdAtUtc }));
}

test('[P7-03 PRES-C01 C03 C06 C07 C10 W05 W06] unrelated canonical UI save preserves four source IDs, existing CV overrides, sibling and frozen package', async ({ page, owner }, info) => {
  test.setTimeout(120_000);
  const raw = 'Exact owner source — æøå\nReviewed work and qualifications.\n';
  const profile = {
    version: '1',
    metadata: { fields: { 'contact.fullName': { confidence: 0.9, method: 'manual', sourceSnippet: 'Owner-reviewed contact', reviewState: 'reviewed' } } },
    contact: { fullName: 'Åse Source-ID', headline: 'Canonical engineer', phone: '+47 900 00 001', location: 'Oslo, Norge',
      website: 'https://example.test/portfolio', linkedIn: 'https://www.linkedin.com/in/source-fixture', gitHub: 'https://github.com/source-fixture',
      links: [{ label: 'Reviewed work', url: 'https://example.test/work' }] },
    summary: ['A source-backed professional summary.'],
    jobs: [{ id: 'job-source', title: 'Canonical role', company: 'Nordlys AS', start: 'Jan 2020', end: 'Dec 2022',
      bullets: ['Canonical work evidence.'], skills: ['C#'] }],
    education: [{ id: 'education-source', qualification: 'Computer science', qualificationLevel: 'Bachelor', institution: 'Fixture University',
      location: 'Oslo', start: 'Aug 2016', end: 'Jun 2019', details: ['Reviewed qualification.'] }],
    projects: [{ id: 'project-source', name: 'Recorded project', role: 'Developer', location: 'Remote', start: '2023-01', end: '2023-12',
      bullets: ['Reviewed project evidence.'], skills: ['React'] }],
    certifications: [{ id: 'cert-source', name: 'Recorded certification', issuer: 'Fixture Academy', location: 'Remote', date: 'Jun 2022',
      details: ['Reviewed certification detail.'] }],
    skills: ['C#', 'Norsk'], languages: [{ name: 'Norwegian Sign Language', level: 'Professional working proficiency', notes: 'Reviewed language note.' }],
    interests: ['Documented community work'], awards: ['Reviewed award'], publications: ['Reviewed publication'],
    organisations: ['Reviewed organisation'], references: ['Available by owner agreement'],
    otherSections: [{ title: 'Custom factual section', items: ['Recorded custom fact.', 'Another reviewed custom fact.'] }],
  };
  await json<CareerReadback>(await page.request.put(`${apiUrl}/career/profile`, { headers: owner.headers, data: { profile, cvText: raw } }));
  const before = await json<CareerReadback>(await page.request.get(`${apiUrl}/career/profile`));
  expect(sourceIds(before.profile)).toEqual({ jobs: ['job-source'], education: ['education-source'], projects: ['project-source'], certifications: ['cert-source'] });
  const company = await json<{ id: number }>(await page.request.post(`${apiUrl}/companies`, { headers: owner.headers, data: { name: 'Source-ID fixture AS' } }), 201);
  const job = await json<{ id: number }>(await page.request.post(`${apiUrl}/jobapplications`, { headers: owner.headers,
    data: { companyId: company.id, jobTitle: 'Source-ID preservation', status: 'Saved' } }), 201);
  const retainedTitle = 'CV-only retained role';
  const retainedBullet = 'CV-only retained evidence';
  let selected = await json<CvVariant>(await page.request.post(`${apiUrl}/cv/variants`, { headers: owner.headers,
    data: { name: 'Selected source-ID CV', jobApplicationId: job.id, settings: { themeId: 'minimal',
      overrides: { [before.profile.jobs[0].id!]: { title: retainedTitle, bullets: [retainedBullet] } } } } }));
  const sibling = await json<CvVariant>(await page.request.post(`${apiUrl}/cv/variants`, { headers: owner.headers,
    data: { name: 'Untouched source-ID sibling', settings: { themeId: 'minimal' } } }));
  const selectedHistoryBefore = await json<unknown>(await page.request.get(`${apiUrl}/cv/variants/${selected.id}/versions`));
  const siblingHistoryBefore = await json<unknown>(await page.request.get(`${apiUrl}/cv/variants/${sibling.id}/versions`));
  const selectedPreviewBefore = await json<Preview>(await page.request.get(`${apiUrl}/cv/variants/${selected.id}/preview`));
  const siblingPreviewBefore = await json<Preview>(await page.request.get(`${apiUrl}/cv/variants/${sibling.id}/preview`));
  expect(selectedPreviewBefore.html).toContain(retainedTitle);
  expect(selectedPreviewBefore.html).toContain(retainedBullet);
  expect(siblingPreviewBefore.html).toContain('Canonical role');
  expect((await page.request.put(`${apiUrl}/jobapplications/${job.id}/cv`, { headers: owner.headers, data: { variantId: selected.id } })).status()).toBe(200);
  const packageSummary = await json<{ id: number }>(await page.request.post(`${apiUrl}/jobapplications/${job.id}/submitted-packages`, { headers: owner.headers }));
  const packageUrl = `${apiUrl}/jobapplications/${job.id}/submitted-packages/${packageSummary.id}`;
  const frozenBefore = await json<unknown>(await page.request.get(packageUrl));
  // Linking the selected CV updates its timestamp during setup. The preservation
  // baseline must include that setup mutation before the unrelated career edit.
  selected = await json<CvVariant>(await page.request.get(`${apiUrl}/cv/variants/${selected.id}`));

  await page.setViewportSize({ width: 390, height: 844 });
  await page.goto('/career?section=profile');
  const t = translations.en;
  const phone = page.getByLabel(t.profileCvContactPhone, { exact: true });
  await expect(phone).toHaveValue(String(before.profile.contact.phone));
  await phone.fill('+47 900 00 002');
  const requestPromise = page.waitForRequest(request => request.url() === `${apiUrl}/career/profile` && request.method() === 'PUT');
  const responsePromise = page.waitForResponse(response => response.url() === `${apiUrl}/career/profile` && response.request().method() === 'PUT');
  await page.getByRole('button', { name: t.profileSaveChanges, exact: true }).focus();
  await page.keyboard.press('Enter');
  const savedRequest = await requestPromise;
  const savedResponse = await responsePromise;
  const savedStatus = savedResponse.status();
  const requested = savedRequest.postDataJSON() as { profile: CareerProfile; cvText: string };
  const after = await json<CareerReadback>(await page.request.get(`${apiUrl}/career/profile`));
  const selectedAfter = await json<CvVariant>(await page.request.get(`${apiUrl}/cv/variants/${selected.id}`));
  const siblingAfter = await json<CvVariant>(await page.request.get(`${apiUrl}/cv/variants/${sibling.id}`));
  const selectedHistoryAfter = await json<unknown>(await page.request.get(`${apiUrl}/cv/variants/${selected.id}/versions`));
  const siblingHistoryAfter = await json<unknown>(await page.request.get(`${apiUrl}/cv/variants/${sibling.id}/versions`));
  const selectedPreviewAfter = await json<Preview>(await page.request.get(`${apiUrl}/cv/variants/${selected.id}/preview`));
  const siblingPreviewAfter = await json<Preview>(await page.request.get(`${apiUrl}/cv/variants/${sibling.id}/preview`));
  const frozenAfter = await json<unknown>(await page.request.get(packageUrl));

  // Collect the persisted IDs AND effective override output before the first preservation
  // assertion, so the RED attempt retains both consequences of the existing browser save.
  await info.attach('native-career-source-id-readbacks', { body: JSON.stringify({ savedStatus, requested,
    ids: { before: sourceIds(before.profile), requested: sourceIds(requested.profile), after: sourceIds(after.profile) },
    observed: {
      requestedIdsEqual: JSON.stringify(sourceIds(requested.profile)) === JSON.stringify(sourceIds(before.profile)),
      persistedIdsEqual: JSON.stringify(sourceIds(after.profile)) === JSON.stringify(sourceIds(before.profile)),
      overrideTitleBefore: selectedPreviewBefore.html.includes(retainedTitle), overrideTitleAfter: selectedPreviewAfter.html.includes(retainedTitle),
      overrideBulletBefore: selectedPreviewBefore.html.includes(retainedBullet), overrideBulletAfter: selectedPreviewAfter.html.includes(retainedBullet),
      selectedDtoUnchanged: JSON.stringify(selectedAfter) === JSON.stringify(selected), siblingDtoUnchanged: JSON.stringify(siblingAfter) === JSON.stringify(sibling),
      selectedHistoryUnchanged: JSON.stringify(selectedHistoryAfter) === JSON.stringify(selectedHistoryBefore),
      siblingHistoryUnchanged: JSON.stringify(siblingHistoryAfter) === JSON.stringify(siblingHistoryBefore),
      frozenDetailUnchanged: JSON.stringify(frozenAfter) === JSON.stringify(frozenBefore),
    },
    canonical: { before, after }, selected: { before: selected, after: selectedAfter, historyBefore: selectedHistoryBefore, historyAfter: selectedHistoryAfter,
      previewBefore: selectedPreviewBefore, previewAfter: selectedPreviewAfter },
    sibling: { before: sibling, after: siblingAfter, historyBefore: siblingHistoryBefore, historyAfter: siblingHistoryAfter,
      previewBefore: siblingPreviewBefore, previewAfter: siblingPreviewAfter }, frozen: { before: frozenBefore, after: frozenAfter },
    qualification: 'Actual canonical browser Save and local SQLite HTTP readbacks. No PDF/model/provider call; frozen full-detail/HTML proof only, no new attachment-byte proof or concurrency-protection claim.' }), contentType: 'application/json' });
  await info.attach('native-career-source-id-editor', { body: await page.screenshot({ fullPage: true }), contentType: 'image/png' });
  expect(savedStatus).toBe(200);
  expect(sourceIds(requested.profile)).toEqual(sourceIds(before.profile));
  expect(sourceIds(after.profile)).toEqual(sourceIds(before.profile));
  const { contact: beforeContact, ...nonContactBefore } = before.profile;
  const { contact: afterContact, ...nonContactAfter } = after.profile;
  expect(nonContactAfter).toEqual(nonContactBefore);
  expect(afterContact).toEqual({ ...beforeContact, phone: '+47 900 00 002' });
  expect(requested.cvText).toBe(raw);
  expect(after.cvText).toBe(raw);
  expect(selectedAfter).toEqual(selected);
  expect(siblingAfter).toEqual(sibling);
  expect(selectedHistoryAfter).toEqual(selectedHistoryBefore);
  expect(siblingHistoryAfter).toEqual(siblingHistoryBefore);
  expect(selectedPreviewAfter.html).toContain(retainedTitle);
  expect(selectedPreviewAfter.html).toContain(retainedBullet);
  expect(siblingPreviewAfter.html).toContain('Canonical role');
  expect(siblingPreviewAfter.html).not.toContain(retainedTitle);
  expect(frozenAfter).toEqual(frozenBefore);
  await page.reload();
  await expect(page.getByLabel(t.profileCvContactPhone, { exact: true })).toHaveValue('+47 900 00 002');
});

test('[P7-03 PRES-C01 C03 E05 E09] real HTTP bounds canonical last-writer saves and structured-history recovery without claiming stale-write protection', async ({ page, owner, playwright }, info) => {
  test.setTimeout(90_000);
  const initialProfile = { version: '1', contact: { fullName: 'Canonical recovery owner', headline: 'Initial source' },
    jobs: [{ id: 'recovery-source', title: 'Recorded role', company: 'Fixture AS', bullets: ['Recorded evidence.'] }], skills: ['Norsk'] };
  const initialRaw = 'Initial raw source — æøå\n';
  await json<CareerReadback>(await page.request.put(`${apiUrl}/career/profile`, { headers: owner.headers, data: { profile: initialProfile, cvText: initialRaw } }));
  const staleSnapshot = await json<CareerReadback>(await page.request.get(`${apiUrl}/career/profile`));
  const initialHistory = await json<CareerVersion[]>(await page.request.get(`${apiUrl}/career/profile/versions`));
  expect(initialHistory.map(row => row.version)).toEqual([1]);
  const secondSession = await playwright.request.newContext();
  const admin = await playwright.request.newContext();
  const other = await playwright.request.newContext();
  const anonymous = await playwright.request.newContext();
  try {
    const secondOwner = await login(secondSession, owner.email);
    expect(secondOwner.id).toBe(owner.id);
    const secondSnapshot = await json<CareerReadback>(await secondSession.get(`${apiUrl}/career/profile`));
    expect(secondSnapshot).toEqual(staleSnapshot);
    const remoteRaw = 'Remote current raw source — æøå\n';
    const remote = await json<CareerReadback>(await secondSession.put(`${apiUrl}/career/profile`, { headers: secondOwner.headers,
      data: { profile: { ...secondSnapshot.profile, contact: { ...secondSnapshot.profile.contact, headline: 'Remote reviewed source' } }, cvText: remoteRaw } }));
    const remoteHistory = await json<CareerVersion[]>(await page.request.get(`${apiUrl}/career/profile/versions`));
    expect(remoteHistory.map(row => row.version)).toEqual([2, 1]);
    const currentRaw = 'Last writer raw source remains current after structured restore — æøå\n';
    const staleBody = { profile: { ...staleSnapshot.profile, contact: { ...staleSnapshot.profile.contact, headline: 'Stale snapshot accepted as last writer' } }, cvText: currentRaw };
    const staleWrite = await page.request.put(`${apiUrl}/career/profile`, { headers: owner.headers, data: staleBody });
    const staleStatus = staleWrite.status();
    const lastWriter = await json<CareerReadback>(staleWrite);
    const afterStale = await json<CareerReadback>(await secondSession.get(`${apiUrl}/career/profile`));
    const historyAfterStale = await json<CareerVersion[]>(await secondSession.get(`${apiUrl}/career/profile/versions`));
    expect(staleStatus).toBe(200);
    expect(staleBody).not.toHaveProperty('expectedVersion');
    expect(afterStale).toEqual(lastWriter);
    expect(afterStale.profile.contact.headline).toBe('Stale snapshot accepted as last writer');
    expect(historyAfterStale.map(row => row.version)).toEqual([3, 2, 1]);
    expect(historyMetadata(historyAfterStale.slice(1))).toEqual(historyMetadata(remoteHistory));
    const restored = await json<CareerReadback>(await secondSession.post(`${apiUrl}/career/profile/versions/2/restore`, { headers: secondOwner.headers }));
    const recovered = await json<CareerReadback>(await page.request.get(`${apiUrl}/career/profile`));
    const restoredHistory = await json<CareerVersion[]>(await page.request.get(`${apiUrl}/career/profile/versions`));
    expect(restored.profile).toEqual(remote.profile);
    expect(recovered).toEqual(restored);
    expect(recovered.cvText).toBe(currentRaw);
    expect(recovered.cvText).not.toBe(remoteRaw);
    expect(restoredHistory.map(row => row.version)).toEqual([4, 3, 2, 1]);
    expect(restoredHistory[0]).toMatchObject({ source: 'restore:v2', isCurrent: true });
    expect(restoredHistory.slice(1).every(row => !row.isCurrent)).toBe(true);
    expect(historyMetadata(restoredHistory.slice(1))).toEqual(historyMetadata(historyAfterStale));
    expect((await page.request.post(`${apiUrl}/career/profile/versions/99999/restore`, { headers: owner.headers })).status()).toBe(404);

    const adminOwner = await login(admin, 'e2e@example.test');
    const otherOwner = await login(other, await createOwner(admin, adminOwner.headers));
    const otherBefore = await json<CareerReadback>(await other.get(`${apiUrl}/career/profile`));
    expect(await json<CareerReadback>(await other.get(`${apiUrl}/career/profile?ownerUserId=${encodeURIComponent(owner.id)}`))).toEqual(otherBefore);
    expect(await json<CareerVersion[]>(await other.get(`${apiUrl}/career/profile/versions?ownerUserId=${encodeURIComponent(owner.id)}`))).toEqual([]);
    expect((await other.post(`${apiUrl}/career/profile/versions/2/restore`, { headers: otherOwner.headers })).status()).toBe(404);
    await json<CareerReadback>(await other.put(`${apiUrl}/career/profile`, { headers: otherOwner.headers,
      data: { ownerUserId: owner.id, profile: { version: '1', contact: { fullName: 'Other account only' }, skills: ['Other owner fact'] }, cvText: 'Other owner raw source' } }));
    expect((await json<CareerReadback>(await other.get(`${apiUrl}/career/profile`))).profile.contact.fullName).toBe('Other account only');
    expect((await anonymous.get(`${apiUrl}/career/profile`)).status()).toBe(401);
    expect((await anonymous.get(`${apiUrl}/career/profile/versions`)).status()).toBe(401);
    expect((await anonymous.put(`${apiUrl}/career/profile`, { data: staleBody })).status()).toBe(401);
    expect((await anonymous.post(`${apiUrl}/career/profile/versions/2/restore`)).status()).toBe(401);
    expect(await json<CareerReadback>(await page.request.get(`${apiUrl}/career/profile`))).toEqual(recovered);
    expect(await json<CareerVersion[]>(await page.request.get(`${apiUrl}/career/profile/versions`))).toEqual(restoredHistory);
    await info.attach('native-canonical-stale-contract-characterization', { body: JSON.stringify({ initial: staleSnapshot, remote,
      staleRequest: staleBody, staleStatus, lastWriter: afterStale, historyAfterStale, recovered, restoredHistory,
      ownerIsolation: { forgedOwnerQueryCannotReadForeign: true, foreignStructuredVersion404: true, forgedBodyWritesOnlyOwnProfile: true, anonymous401: true },
      qualification: 'Two real authenticated HTTP sessions in disposable SQLite. Canonical stale saves remain accepted last-writer replacements; history recovery appends a structured revision and does not restore raw cvText. No conflict prevention, browser draft-recovery, attachment-byte, model/provider or production acceptance is claimed.' }), contentType: 'application/json' });
  } finally { await secondSession.dispose(); await admin.dispose(); await other.dispose(); await anonymous.dispose(); }
});