//! Blog workflow: create project -> create post -> publish -> public page -> RSS

use crate::harness::TestHarness;
use serde_json::Value;

#[tokio::test]
async fn blog_post_lifecycle() {
    let mut h = TestHarness::new().await;

    // Setup: creator with project
    let user_id = h.signup("blogger", "blogger@example.com", "password123").await;
    h.grant_creator(user_id).await;
    h.client.post_form("/logout", "").await;
    h.login("blogger", "password123").await;

    let resp = h
        .client
        .post_form("/api/projects", "slug=my-blog&title=My+Blog")
        .await;
    let project: Value = resp.json();
    let project_id = project["id"].as_str().unwrap();

    // Make project public
    h.client
        .put_json(
            &format!("/api/projects/{}", project_id),
            r#"{"is_public": true}"#,
        )
        .await;

    // Create blog post
    let resp = h
        .client
        .post_json(
            &format!("/api/projects/{}/blog", project_id),
            r#"{"title": "First Post", "body_markdown": "Hello **world**!", "is_published": false}"#,
        )
        .await;
    assert!(
        resp.status.is_success(),
        "Create blog post failed: {} {}",
        resp.status,
        resp.text
    );
    let post: Value = resp.json();
    let post_id = post["id"].as_str().unwrap();
    let post_slug = post["slug"].as_str().unwrap();

    // Publish the post
    let resp = h
        .client
        .put_json(
            &format!("/api/blog/{}", post_id),
            &format!(
                r#"{{"title": "First Post", "slug": "{}", "body_markdown": "Hello **world**!", "is_published": true}}"#,
                post_slug
            ),
        )
        .await;
    assert!(
        resp.status.is_success(),
        "Publish blog post failed: {} {}",
        resp.status,
        resp.text
    );

    // Check blog page is accessible
    let blog_url = format!("/p/my-blog/blog/{}", post_slug);
    let resp = h.client.get(&blog_url).await;
    assert_eq!(
        resp.status, 200,
        "Blog post page should be accessible at {}",
        blog_url
    );
    assert!(
        resp.text.contains("First Post"),
        "Blog post page should contain the title"
    );

    // Check RSS feed
    let resp = h.client.get("/p/my-blog/blog/feed.xml").await;
    assert_eq!(resp.status, 200, "RSS feed should be accessible");
    assert!(
        resp.text.contains("<rss") || resp.text.contains("<?xml"),
        "RSS feed should be valid XML"
    );
    assert!(
        resp.text.contains("First Post"),
        "RSS feed should contain the blog post title"
    );
}

#[tokio::test]
async fn blog_post_crud() {
    let mut h = TestHarness::new().await;

    // Setup: creator with project
    let user_id = h.signup("cruduser", "cruduser@example.com", "password123").await;
    h.grant_creator(user_id).await;
    h.client.post_form("/logout", "").await;
    h.login("cruduser", "password123").await;

    let resp = h
        .client
        .post_form("/api/projects", "slug=crud-blog&title=CRUD+Blog")
        .await;
    let project: Value = resp.json();
    let project_id = project["id"].as_str().unwrap();

    // Create a draft blog post
    let resp = h
        .client
        .post_json(
            &format!("/api/projects/{}/blog", project_id),
            r#"{"title": "Draft Post", "body_markdown": "Initial body", "is_published": false}"#,
        )
        .await;
    assert!(resp.status.is_success(), "Create draft failed: {} {}", resp.status, resp.text);
    let post: Value = resp.json();
    let post_id = post["id"].as_str().unwrap();
    let post_slug = post["slug"].as_str().unwrap();
    assert_eq!(post["is_published"].as_bool(), Some(false));

    // Read it back via GET /api/blog/{id}
    let resp = h.client.get(&format!("/api/blog/{}", post_id)).await;
    assert!(resp.status.is_success(), "Get blog post failed: {} {}", resp.status, resp.text);
    let fetched: Value = resp.json();
    assert_eq!(fetched["title"].as_str(), Some("Draft Post"));
    assert_eq!(fetched["body_markdown"].as_str(), Some("Initial body"));
    assert_eq!(fetched["is_published"].as_bool(), Some(false));

    // Update title and body
    let resp = h
        .client
        .put_json(
            &format!("/api/blog/{}", post_id),
            &format!(
                r#"{{"title": "Updated Post", "slug": "{}", "body_markdown": "Updated body content", "is_published": false}}"#,
                post_slug
            ),
        )
        .await;
    assert!(resp.status.is_success(), "Update blog post failed: {} {}", resp.status, resp.text);

    // Verify changes persisted
    let resp = h.client.get(&format!("/api/blog/{}", post_id)).await;
    let fetched: Value = resp.json();
    assert_eq!(fetched["title"].as_str(), Some("Updated Post"));
    assert_eq!(fetched["body_markdown"].as_str(), Some("Updated body content"));

    // Publish the post
    let resp = h
        .client
        .put_json(
            &format!("/api/blog/{}", post_id),
            &format!(
                r#"{{"title": "Updated Post", "slug": "{}", "body_markdown": "Updated body content", "is_published": true}}"#,
                post_slug
            ),
        )
        .await;
    assert!(resp.status.is_success(), "Publish blog post failed: {} {}", resp.status, resp.text);

    // Verify is_published
    let resp = h.client.get(&format!("/api/blog/{}", post_id)).await;
    let fetched: Value = resp.json();
    assert_eq!(fetched["is_published"].as_bool(), Some(true));

    // Delete the post
    let resp = h.client.delete(&format!("/api/blog/{}", post_id)).await;
    assert!(resp.status.is_success(), "Delete blog post failed: {} {}", resp.status, resp.text);

    // Verify 404 after deletion
    let resp = h.client.get(&format!("/api/blog/{}", post_id)).await;
    assert_eq!(resp.status, 404, "Deleted blog post should return 404");
}

#[tokio::test]
async fn non_owner_cannot_edit_blog() {
    let mut h = TestHarness::new().await;

    // User A creates project + post
    let user_a = h.signup("blogowner", "blogowner@example.com", "password123").await;
    h.grant_creator(user_a).await;
    h.client.post_form("/logout", "").await;
    h.login("blogowner", "password123").await;

    let resp = h
        .client
        .post_form("/api/projects", "slug=owner-blog&title=Owner+Blog")
        .await;
    let project: Value = resp.json();
    let project_id = project["id"].as_str().unwrap();

    let resp = h
        .client
        .post_json(
            &format!("/api/projects/{}/blog", project_id),
            r#"{"title": "Owner Post", "body_markdown": "Secret content", "is_published": false}"#,
        )
        .await;
    assert!(resp.status.is_success(), "Create post failed: {}", resp.text);
    let post: Value = resp.json();
    let post_id = post["id"].as_str().unwrap();
    let post_slug = post["slug"].as_str().unwrap();

    // Log out user A, sign up user B
    h.client.post_form("/logout", "").await;
    let user_b = h.signup("intruder", "intruder@example.com", "password123").await;
    h.grant_creator(user_b).await;
    h.client.post_form("/logout", "").await;
    h.login("intruder", "password123").await;

    // User B tries to update user A's post
    let resp = h
        .client
        .put_json(
            &format!("/api/blog/{}", post_id),
            &format!(
                r#"{{"title": "Hacked", "slug": "{}", "body_markdown": "Hacked body", "is_published": true}}"#,
                post_slug
            ),
        )
        .await;
    assert_eq!(resp.status, 403, "Non-owner update should be 403, got {}", resp.status);

    // User B tries to delete user A's post
    let resp = h.client.delete(&format!("/api/blog/{}", post_id)).await;
    assert_eq!(resp.status, 403, "Non-owner delete should be 403, got {}", resp.status);
}

#[tokio::test]
async fn blog_post_list_respects_visibility() {
    let mut h = TestHarness::new().await;

    // Setup: creator with public project
    let user_id = h.signup("listuser", "listuser@example.com", "password123").await;
    h.grant_creator(user_id).await;
    h.client.post_form("/logout", "").await;
    h.login("listuser", "password123").await;

    let resp = h
        .client
        .post_form("/api/projects", "slug=list-blog&title=List+Blog")
        .await;
    let project: Value = resp.json();
    let project_id = project["id"].as_str().unwrap();

    // Make project public
    h.client
        .put_json(
            &format!("/api/projects/{}", project_id),
            r#"{"is_public": true}"#,
        )
        .await;

    // Create a published post
    let resp = h
        .client
        .post_json(
            &format!("/api/projects/{}/blog", project_id),
            r#"{"title": "Public Post", "body_markdown": "Visible to all", "is_published": true}"#,
        )
        .await;
    assert!(resp.status.is_success(), "Create public post failed: {}", resp.text);
    let public_post: Value = resp.json();
    let public_slug = public_post["slug"].as_str().unwrap();

    // Create a draft post
    let resp = h
        .client
        .post_json(
            &format!("/api/projects/{}/blog", project_id),
            r#"{"title": "Draft Post", "body_markdown": "Hidden from public", "is_published": false}"#,
        )
        .await;
    assert!(resp.status.is_success(), "Create draft post failed: {}", resp.text);

    // List via API (public endpoint) should show only the published post
    let resp = h
        .client
        .get(&format!("/api/projects/{}/blog", project_id))
        .await;
    assert!(resp.status.is_success(), "List blog posts failed: {}", resp.text);
    let list: Value = resp.json();
    let posts = list["data"].as_array().unwrap();
    assert_eq!(posts.len(), 1, "Public list should contain only 1 published post");
    assert_eq!(posts[0]["title"].as_str(), Some("Public Post"));

    // Verify the public post is accessible on the public page
    let blog_url = format!("/p/list-blog/blog/{}", public_slug);
    let resp = h.client.get(&blog_url).await;
    assert_eq!(resp.status, 200, "Published post should be accessible at {}", blog_url);
    assert!(resp.text.contains("Public Post"), "Page should contain the post title");
}

/// The landing "Last shipped" velocity line: suppressed with no eligible post,
/// surfaced for the most recent flagged changelog post, and never fed by
/// landing-flagged posts on non-changelog projects.
#[tokio::test]
async fn landing_velocity_line() {
    let mut h = TestHarness::new().await;

    // State 1: no eligible post on a fresh platform — line is suppressed.
    let resp = h.client.get("/").await;
    assert_eq!(resp.status, 200, "Landing should render: {}", resp.text);
    assert!(
        !resp.text.contains("Last shipped:"),
        "Velocity line must be absent with zero eligible posts"
    );

    // Creator owns both a non-changelog project and the changelog project.
    let user_id = h.signup("shipper", "shipper@example.com", "password123").await;
    h.grant_creator(user_id).await;
    h.client.post_form("/logout", "").await;
    h.login("shipper", "password123").await;

    // A non-changelog project with a landing-flagged, published post.
    let resp = h
        .client
        .post_form("/api/projects", "slug=updates&title=Updates")
        .await;
    let updates: Value = resp.json();
    let updates_id = updates["id"].as_str().unwrap();
    h.client
        .put_json(&format!("/api/projects/{}", updates_id), r#"{"is_public": true}"#)
        .await;
    let resp = h
        .client
        .post_json(
            &format!("/api/projects/{}/blog", updates_id),
            r#"{"title": "Off-topic note", "body_markdown": "Body", "is_published": true, "show_on_landing": true}"#,
        )
        .await;
    assert!(resp.status.is_success(), "Create flagged non-changelog post failed: {}", resp.text);

    // State 2: a flagged post on a non-changelog project is ignored by the
    // landing reader (which filters by the changelog slug).
    h.client.post_form("/logout", "").await;
    let resp = h.client.get("/").await;
    assert!(
        !resp.text.contains("Last shipped:"),
        "Landing-flagged post on a non-changelog project must not surface"
    );
    assert!(
        !resp.text.contains("Off-topic note"),
        "Non-changelog post title must not appear on the landing page"
    );

    // The changelog project with a landing-flagged, published post.
    h.login("shipper", "password123").await;
    let resp = h
        .client
        .post_form("/api/projects", "slug=changelog&title=Changelog")
        .await;
    let changelog: Value = resp.json();
    let changelog_id = changelog["id"].as_str().unwrap();
    h.client
        .put_json(&format!("/api/projects/{}", changelog_id), r#"{"is_public": true}"#)
        .await;
    let resp = h
        .client
        .post_json(
            &format!("/api/projects/{}/blog", changelog_id),
            r#"{"title": "Shipped gallery widget", "body_markdown": "Body", "is_published": true, "show_on_landing": true}"#,
        )
        .await;
    assert!(resp.status.is_success(), "Create flagged changelog post failed: {}", resp.text);
    let post: Value = resp.json();
    let post_slug = post["slug"].as_str().unwrap();
    assert_eq!(
        post["show_on_landing"].as_bool(),
        Some(true),
        "Create response should echo the landing flag"
    );

    // State 3: the changelog post surfaces as the velocity line.
    h.client.post_form("/logout", "").await;
    let resp = h.client.get("/").await;
    assert!(
        resp.text.contains("Last shipped:"),
        "Velocity line should appear once a changelog post is flagged: {}",
        resp.text
    );
    assert!(
        resp.text.contains("Shipped gallery widget"),
        "Velocity line should carry the post title"
    );
    assert!(
        resp.text.contains(&format!("/changelog/{}", post_slug)),
        "Velocity line should link to /changelog/{}",
        post_slug
    );
}