"""Stripe billing: signature verification, automatic onboarding (tenant +
token + credentials email), idempotency, and subscription lifecycle."""

from __future__ import annotations

import hashlib
import hmac
import time

from sqlalchemy import select

from app import billing
from app.models import Tenant


def _sign(payload: bytes, secret: str, ts: int | None = None) -> str:
    t = ts if ts is not None else int(time.time())
    sig = hmac.new(secret.encode(), f"{t}.".encode() + payload, hashlib.sha256).hexdigest()
    return f"t={t},v1={sig}"


def test_signature_valid_invalid_and_stale():
    body = b'{"x":1}'
    good = _sign(body, "whsec_abc")
    assert billing.verify_stripe_signature(body, good, "whsec_abc") is True
    # wrong secret
    assert billing.verify_stripe_signature(body, good, "whsec_OTHER") is False
    # tampered body
    assert billing.verify_stripe_signature(b'{"x":2}', good, "whsec_abc") is False
    # stale timestamp (replay)
    old = _sign(body, "whsec_abc", ts=int(time.time()) - 4000)
    assert billing.verify_stripe_signature(body, old, "whsec_abc") is False
    # garbage header
    assert billing.verify_stripe_signature(body, "nonsense", "whsec_abc") is False


def _checkout_event(email="dueno@nuevocliente.com", business="Paraguas Luna",
                    customer="cus_123", sub="sub_456"):
    return {
        "type": "checkout.session.completed",
        "data": {"object": {
            "customer_details": {"email": email},
            "customer": customer,
            "subscription": sub,
            "custom_fields": [
                {"key": "negocio", "type": "text", "text": {"value": business}}
            ],
            "mode": "subscription", "payment_status": "paid",
        }},
    }


async def test_checkout_completed_provisions_tenant_and_emails(db_session, monkeypatch):
    sent = []

    async def fake_send(settings, to, subject, body, **kw):
        sent.append({"to": to, "subject": subject, "body": body, "html": kw.get("html")})
        return True

    import app.mailer

    monkeypatch.setattr(app.mailer, "send_email", fake_send)

    out = await billing.handle_checkout_completed(
        db_session, _checkout_event(), origin="https://bot.example"
    )
    assert out["status"] == "provisioned" and out["email_sent"] is True
    t = (
        await db_session.execute(select(Tenant).where(Tenant.slug == out["slug"]))
    ).scalar_one()
    # account fully usable: branding, notify email, portal token, stripe link
    assert t.brand_name == "Paraguas Luna"
    assert t.support_email == "dueno@nuevocliente.com"
    assert t.dashboard_token.startswith("cli_")
    assert t.stripe_customer_id == "cus_123" and t.stripe_subscription_id == "sub_456"
    by_to = {m["to"]: m for m in sent}
    # the CUSTOMER email contains everything they need to self-configure
    cust = by_to["dueno@nuevocliente.com"]
    assert t.dashboard_token in cust["body"]
    assert "/portal" in cust["body"] and "widget.js?t=" + t.slug in cust["body"]
    html = cust.get("html") or ""
    assert "<script" in html and t.dashboard_token in html
    # the FOUNDER got a 'new paying customer' alert
    assert "comercial@flexigobe.com" in by_to
    assert "<script src=" not in html  # raw tags would be stripped by mail clients


def _monthly_checkout_event(email="duena@mensual.com", business="Velas Aroma",
                            customer="cus_m1", sub="sub_m1"):
    """A checkout for the 29 EUR/month plan. The webhook is interval-agnostic:
    Stripe sends the same checkout.session.completed shape (mode=subscription)
    whether the price recurs monthly or every 3 months, so the only honest way
    to model 'monthly' here is the subscription event itself — there is no
    interval field on the session object."""
    ev = _checkout_event(email=email, business=business, customer=customer, sub=sub)
    ev["data"]["object"]["plan"] = {"interval": "month", "interval_count": 1}
    return ev


async def test_monthly_subscription_checkout_onboards_tenant_same_way(db_session, monkeypatch):
    """A monthly (29 EUR/month) subscriber is onboarded EXACTLY like the
    quarterly one — no webhook change is needed for the second pricing option."""
    sent = []

    async def fake_send(settings, to, subject, body, **kw):
        sent.append(to)
        return True

    import app.mailer

    monkeypatch.setattr(app.mailer, "send_email", fake_send)
    out = await billing.handle_checkout_completed(
        db_session, _monthly_checkout_event(), origin="https://bot.example"
    )
    assert out["status"] == "provisioned" and out["email_sent"] is True
    t = (
        await db_session.execute(select(Tenant).where(Tenant.slug == out["slug"]))
    ).scalar_one()
    assert t.brand_name == "Velas Aroma"
    assert t.support_email == "duena@mensual.com"
    assert t.stripe_customer_id == "cus_m1" and t.stripe_subscription_id == "sub_m1"
    assert "duena@mensual.com" in sent          # customer onboarded
    assert "comercial@flexigobe.com" in sent    # founder alerted to the payment
    assert t.chatbot_enabled is True and t.disabled_reason == ""


async def test_foreign_payment_link_checkout_is_ignored_not_provisioned(db_session, monkeypatch):
    """CRITICAL regression (found live): the Stripe ACCOUNT is shared with other
    ventures (eclipseando) that run their own Stripe Checkout. Stripe delivers
    EVERY checkout.session.completed on the account to every subscribed webhook,
    so a customer buying a hoodie from eclipseando landed here too and got a
    bogus Atendyo tenant + a "your AI assistant is ready" email. Once our own
    payment link is known, a session for any OTHER link must be ignored."""
    from app.store import upsert_config

    await upsert_config(db_session, "stripe_billing", {"payment_link_id": "plink_atendyo_setup"})
    sent = []

    async def fake_send(settings, to, subject, body, **kw):
        sent.append(to)
        return True

    import app.mailer

    monkeypatch.setattr(app.mailer, "send_email", fake_send)
    ev = _checkout_event(email="cliente@eclipseando-buyer.com")
    ev["data"]["object"]["payment_link"] = "plink_eclipseando_hoodie"
    out = await billing.handle_checkout_completed(db_session, ev, origin="https://bot.example")
    assert out == {"status": "ignored_foreign_checkout"}
    assert sent == []
    existing = (
        await db_session.execute(
            select(Tenant).where(Tenant.support_email == "cliente@eclipseando-buyer.com")
        )
    ).scalar_one_or_none()
    assert existing is None


async def test_own_payment_link_checkout_still_provisions_once_configured(db_session, monkeypatch):
    """Regression guard for the fix above: once payment_link_id/monthly_link_id
    are known, a session for one of OUR OWN links must still provision normally
    -- both the quarterly-setup link and the separate monthly link."""
    from app.store import upsert_config

    await upsert_config(
        db_session, "stripe_billing",
        {"payment_link_id": "plink_atendyo_setup", "monthly_link_id": "plink_atendyo_monthly"},
    )
    sent = []

    async def fake_send(settings, to, subject, body, **kw):
        sent.append(to)
        return True

    import app.mailer

    monkeypatch.setattr(app.mailer, "send_email", fake_send)

    ev = _checkout_event(email="real@cliente.com")
    ev["data"]["object"]["payment_link"] = "plink_atendyo_setup"
    out = await billing.handle_checkout_completed(db_session, ev, origin="https://bot.example")
    assert out["status"] == "provisioned"

    ev2 = _monthly_checkout_event(email="real2@cliente.com", customer="cus_m9", sub="sub_m9")
    ev2["data"]["object"]["payment_link"] = "plink_atendyo_monthly"
    out2 = await billing.handle_checkout_completed(db_session, ev2, origin="https://bot.example")
    assert out2["status"] == "provisioned"
    assert "real@cliente.com" in sent and "real2@cliente.com" in sent


async def test_checkout_attaches_to_existing_trial_not_orphan(db_session, monkeypatch):
    """B2: a self-serve TRIAL tenant that pays must get the subscription ATTACHED
    to its existing tenant (the merchant already installed widget.js pointing at
    this slug/token), NOT a brand-new orphaned tenant that the scheduler later
    pauses at trial end."""
    from datetime import datetime, timedelta, timezone

    from app.tenancy import create_tenant, generate_dashboard_token

    sent = []

    async def fake_send(settings, to, subject, body, **kw):
        sent.append(to)
        return True

    import app.mailer

    monkeypatch.setattr(app.mailer, "send_email", fake_send)

    # trial tenant exactly as demo_activate leaves it: real, email set, 14-day
    # trial countdown, NO stripe link, dashboard token already issued.
    trial = await create_tenant(
        db_session, "mitienda-trial", name="Mi Tienda",
        brand_name="Mi Tienda", support_email="due@mitienda.com",
    )
    trial.trial_ends_at = datetime.now(timezone.utc) + timedelta(days=14)
    token = await generate_dashboard_token(db_session, trial)
    await db_session.flush()
    trial_id = trial.id

    out = await billing.handle_checkout_completed(
        db_session,
        _checkout_event(email="due@mitienda.com", business="Mi Tienda",
                        customer="cus_trial", sub="sub_trial"),
        origin="https://x",
    )
    assert out["status"] == "attached_trial"

    rows = (
        await db_session.execute(
            select(Tenant).where(Tenant.support_email == "due@mitienda.com")
        )
    ).scalars().all()
    assert len(rows) == 1  # NO orphan — the trial tenant was reused
    t = rows[0]
    assert t.id == trial_id and t.slug == "mitienda-trial"  # same tenant
    assert t.dashboard_token == token                        # widget keeps working
    assert t.stripe_customer_id == "cus_trial" and t.stripe_subscription_id == "sub_trial"
    assert t.chatbot_enabled is True and t.disabled_reason == ""
    assert t.trial_ends_at is None                           # converted -> never auto-paused
    assert "comercial@flexigobe.com" in sent                 # founder alerted
    assert "due@mitienda.com" in sent                        # customer confirmed


async def test_checkout_retry_is_idempotent(db_session, monkeypatch):
    async def fake_send(settings, to, subject, body, **kw):
        return True

    import app.mailer

    monkeypatch.setattr(app.mailer, "send_email", fake_send)
    ev = _checkout_event(customer="cus_dup")
    first = await billing.handle_checkout_completed(db_session, ev, origin="https://x")
    again = await billing.handle_checkout_completed(db_session, ev, origin="https://x")
    assert first["status"] == "provisioned"
    assert again["status"] == "already_provisioned"
    rows = (
        await db_session.execute(select(Tenant).where(Tenant.stripe_customer_id == "cus_dup"))
    ).scalars().all()
    assert len(rows) == 1  # no duplicate account on webhook retries


async def test_subscription_lifecycle_toggles_chatbot(db_session, monkeypatch):
    async def fake_send(settings, to, subject, body, **kw):
        return True

    import app.mailer

    monkeypatch.setattr(app.mailer, "send_email", fake_send)
    out = await billing.handle_checkout_completed(
        db_session, _checkout_event(customer="cus_life"), origin="https://x"
    )
    t = (
        await db_session.execute(select(Tenant).where(Tenant.slug == out["slug"]))
    ).scalar_one()
    assert t.chatbot_enabled is True
    assert t.disabled_reason == ""

    # stops paying → Stripe cancels → chatbot OFF, reason recorded, sub unlinked
    deleted = {"type": "customer.subscription.deleted",
               "data": {"object": {"customer": "cus_life", "id": "sub_456"}}}
    r = await billing.handle_subscription_event(db_session, deleted)
    assert r["status"] == "disabled"
    await db_session.refresh(t)
    assert t.chatbot_enabled is False
    assert t.disabled_reason == "billing"
    assert t.stripe_subscription_id == ""  # late invoices can't match it anymore

    # buys again (new checkout, same customer) → chatbot back ON, state clean
    out2 = await billing.handle_checkout_completed(
        db_session, _checkout_event(customer="cus_life", sub="sub_789"), origin="https://x"
    )
    assert out2["status"] == "already_provisioned"
    await db_session.refresh(t)
    assert t.chatbot_enabled is True
    assert t.disabled_reason == ""
    assert t.stripe_subscription_id == "sub_789"


def _paid_event(customer: str, sub_shape: dict | None = None) -> dict:
    obj: dict = {"customer": customer}
    if sub_shape:
        obj.update(sub_shape)
    return {"type": "invoice.paid", "data": {"object": obj}}


async def _disabled_tenant(db_session, *, slug, customer, sub, reason) -> Tenant:
    t = Tenant(slug=slug, name=slug, stripe_customer_id=customer,
               stripe_subscription_id=sub, chatbot_enabled=False,
               disabled_reason=reason)
    db_session.add(t)
    await db_session.commit()
    return t


def test_invoice_subscription_id_across_api_versions():
    # pre-Basil: top-level, bare id or expanded object
    assert billing._invoice_subscription_id({"subscription": "sub_a"}) == "sub_a"
    assert billing._invoice_subscription_id({"subscription": {"id": "sub_b"}}) == "sub_b"
    # Basil+: parent.subscription_details
    assert billing._invoice_subscription_id(
        {"parent": {"subscription_details": {"subscription": "sub_c"}}}
    ) == "sub_c"
    # Basil+: per line item
    assert billing._invoice_subscription_id(
        {"lines": {"data": [
            {"parent": {"subscription_item_details": {"subscription": "sub_d"}}}
        ]}}
    ) == "sub_d"
    assert billing._invoice_subscription_id(
        {"lines": {"data": [{"subscription": "sub_e"}]}}
    ) == "sub_e"
    # no subscription anywhere (one-off invoice) → ""
    assert billing._invoice_subscription_id({"lines": {"data": [{}]}}) == ""


async def test_late_invoice_paid_after_cancel_does_not_resurrect(db_session, monkeypatch):
    """Stripe does not guarantee event order: an invoice.paid generated before
    the cancellation may arrive after it. It must NOT switch the tenant back on."""
    async def fake_send(settings, to, subject, body, **kw):
        return True

    import app.mailer

    monkeypatch.setattr(app.mailer, "send_email", fake_send)
    out = await billing.handle_checkout_completed(
        db_session, _checkout_event(customer="cus_late", sub="sub_late"), origin="https://x"
    )
    t = (
        await db_session.execute(select(Tenant).where(Tenant.slug == out["slug"]))
    ).scalar_one()
    deleted = {"type": "customer.subscription.deleted",
               "data": {"object": {"customer": "cus_late", "id": "sub_late"}}}
    assert (await billing.handle_subscription_event(db_session, deleted))["status"] == "disabled"
    await db_session.refresh(t)
    assert t.chatbot_enabled is False  # positively off before the late event

    late = _paid_event("cus_late", {"subscription": "sub_late"})
    r = await billing.handle_subscription_event(db_session, late)
    assert r["status"] == "subscription_mismatch"
    await db_session.refresh(t)
    assert t.chatbot_enabled is False  # still off: canceled stays canceled
    assert t.disabled_reason == "billing"


async def test_stale_subscription_deleted_does_not_disable_repurchased_tenant(db_session, monkeypatch):
    """Cancel + re-purchase, then the OLD subscription's deleted event arrives
    late (Stripe does not guarantee order). It must NOT switch off the paying
    client nor unlink its new subscription."""
    async def fake_send(settings, to, subject, body, **kw):
        return True

    import app.mailer

    monkeypatch.setattr(app.mailer, "send_email", fake_send)
    out = await billing.handle_checkout_completed(
        db_session, _checkout_event(customer="cus_re", sub="sub_old"), origin="https://x"
    )
    t = (
        await db_session.execute(select(Tenant).where(Tenant.slug == out["slug"]))
    ).scalar_one()
    # re-purchase: same customer, NEW subscription
    out2 = await billing.handle_checkout_completed(
        db_session, _checkout_event(customer="cus_re", sub="sub_new"), origin="https://x"
    )
    assert out2["status"] == "already_provisioned"
    await db_session.refresh(t)
    assert t.chatbot_enabled is True and t.stripe_subscription_id == "sub_new"

    stale = {"type": "customer.subscription.deleted",
             "data": {"object": {"customer": "cus_re", "id": "sub_old"}}}
    r = await billing.handle_subscription_event(db_session, stale)
    assert r["status"] == "stale_subscription"
    await db_session.refresh(t)
    assert t.chatbot_enabled is True  # the paying client keeps full service
    assert t.disabled_reason == ""
    assert t.stripe_subscription_id == "sub_new"  # the live link survived

    # the CURRENT subscription's deleted event still disables, as always
    real = {"type": "customer.subscription.deleted",
            "data": {"object": {"customer": "cus_re", "id": "sub_new"}}}
    r2 = await billing.handle_subscription_event(db_session, real)
    assert r2["status"] == "disabled"
    await db_session.refresh(t)
    assert t.chatbot_enabled is False
    assert t.disabled_reason == "billing"
    assert t.stripe_subscription_id == ""


async def test_invoice_paid_matching_subscription_reenables(db_session):
    """A paid invoice for the tenant's CURRENT subscription lifts a billing
    pause — across every Stripe API shape that carries the subscription id."""
    shapes = [
        ("viejo", {"subscription": "sub_m"}),
        ("basil", {"parent": {"subscription_details": {"subscription": "sub_m"}}}),
        ("lineas", {"lines": {"data": [
            {"parent": {"subscription_item_details": {"subscription": "sub_m"}}}
        ]}}),
    ]
    for slug, shape in shapes:
        t = await _disabled_tenant(
            db_session, slug=slug, customer=f"cus_{slug}", sub="sub_m", reason="billing"
        )
        r = await billing.handle_subscription_event(
            db_session, _paid_event(f"cus_{slug}", shape)
        )
        assert r["status"] == "enabled", slug
        await db_session.refresh(t)
        assert t.chatbot_enabled is True, slug
        assert t.disabled_reason == "", slug


async def test_invoice_paid_for_already_enabled_tenant_checks_subscription_too(db_session):
    """#28: an ALREADY-enabled tenant used to return 'enabled' unconditionally
    for ANY invoice.paid on their customer id, without checking the invoice's
    subscription matches their CURRENT one. A stale invoice for an old/replaced
    subscription must report subscription_mismatch, same as the disabled path."""
    t = Tenant(slug="yaactiva", name="yaactiva", stripe_customer_id="cus_ya",
              stripe_subscription_id="sub_actual", chatbot_enabled=True, disabled_reason="")
    db_session.add(t)
    await db_session.flush()

    r = await billing.handle_subscription_event(
        db_session, _paid_event("cus_ya", {"subscription": "sub_VIEJA"})
    )
    assert r["status"] == "subscription_mismatch"
    await db_session.refresh(t)
    assert t.chatbot_enabled is True  # untouched either way — just the status was misleading

    # the matching subscription still reports "enabled" as before
    r2 = await billing.handle_subscription_event(
        db_session, _paid_event("cus_ya", {"subscription": "sub_actual"})
    )
    assert r2["status"] == "enabled"


async def test_invoice_paid_mismatched_or_missing_subscription_stays_off(db_session):
    t = await _disabled_tenant(
        db_session, slug="desfase", customer="cus_mis", sub="sub_actual", reason="billing"
    )
    # wrong subscription id
    r = await billing.handle_subscription_event(
        db_session, _paid_event("cus_mis", {"subscription": "sub_OTRA"})
    )
    assert r["status"] == "subscription_mismatch"
    # no subscription id at all (one-off invoice)
    r2 = await billing.handle_subscription_event(db_session, _paid_event("cus_mis"))
    assert r2["status"] == "subscription_mismatch"
    await db_session.refresh(t)
    assert t.chatbot_enabled is False
    assert t.disabled_reason == "billing"


async def test_admin_paused_tenant_stays_off_after_invoice_paid(db_session):
    """Victor paused this client on purpose — a Stripe payment (even for the
    right subscription) must never override the admin's decision."""
    t = await _disabled_tenant(
        db_session, slug="castigada", customer="cus_adm", sub="sub_adm", reason="admin"
    )
    r = await billing.handle_subscription_event(
        db_session, _paid_event("cus_adm", {"subscription": "sub_adm"})
    )
    assert r["status"] == "admin_paused"
    await db_session.refresh(t)
    assert t.chatbot_enabled is False
    assert t.disabled_reason == "admin"


async def test_invoice_paid_before_checkout_is_safely_ignored(db_session):
    # Stripe doesn't guarantee event order on first purchase
    paid = {"type": "invoice.paid", "data": {"object": {"customer": "cus_unknown"}}}
    out = await billing.handle_subscription_event(db_session, paid)
    assert out["status"] == "unknown_customer"


async def test_webhook_route_rejects_bad_signature(app_client):
    _app, client = app_client
    r = await client.post(
        "/stripe/webhook",
        content=b'{"type":"checkout.session.completed"}',
        headers={"Stripe-Signature": "t=1,v1=deadbeef", "Content-Type": "application/json"},
    )
    assert r.status_code == 400


def test_slugify_business_names():
    assert billing._slugify("Paraguas Luna SL") == "paraguas-luna-sl"
    assert billing._slugify("Café & Té, Ltd.") == "cafe-te-ltd"
    assert billing._slugify("   ") == ""