from io import StringIO
from django.contrib.auth import get_user_model
from django.core import mail
from django.core.files.uploadedfile import SimpleUploadedFile
from django.core.management import call_command
from django.db import IntegrityError, transaction
from django.test import Client, TestCase, override_settings
from django.urls import reverse
from workshops.forms import NoteUploadForm, SeatsForm
from workshops.models import Reservation, Venue, Workshop
from workshops.services import SoldOut, cancel, reserve

class WorkshopContractTests(TestCase):
    @classmethod
    def setUpTestData(cls):
        call_command("seed_lab", stdout=StringIO())
        cls.alex = get_user_model().objects.get(username="alex")
        cls.jay = get_user_model().objects.get(username="jay")
        cls.workshop = Workshop.objects.get(slug="lamp-care")

    def test_public_list_and_draft_visibility(self):
        response = self.client.get("/")
        self.assertContains(response, "Lamp care")
        self.assertNotContains(response, "Wood joints")
        self.assertEqual(self.client.get("/workshops/wood-joints/").status_code, 404)

    def test_csrf_rejection_and_acceptance(self):
        client = Client(enforce_csrf_checks=True)
        client.force_login(self.alex)
        client.get(self.workshop.get_absolute_url())
        self.assertEqual(client.post(reverse("workshops:book", args=[self.workshop.slug]), {"seats":1}).status_code, 403)
        self.assertEqual(Reservation.objects.count(), 0)
        token = client.cookies["csrftoken"].value
        response = client.post(reverse("workshops:book", args=[self.workshop.slug]), {"seats":1}, HTTP_X_CSRFTOKEN=token)
        self.assertEqual(response.status_code, 302)
        self.workshop.refresh_from_db()
        self.assertEqual(self.workshop.remaining, 6)

    def test_invalid_input_preserves_state(self):
        self.client.force_login(self.alex)
        for seats in [0, 5, "many", ""]:
            response = self.client.post(reverse("workshops:book", args=[self.workshop.slug]), {"seats":seats})
            self.assertEqual(response.status_code, 400)
        self.workshop.refresh_from_db()
        self.assertEqual(self.workshop.remaining, 7)
        self.assertEqual(Reservation.objects.count(), 0)

    def test_duplicate_request_rolls_back_decrement(self):
        reserve(workshop_id=self.workshop.pk, user=self.alex, seats=2)
        with self.assertRaises(IntegrityError):
            reserve(workshop_id=self.workshop.pk, user=self.alex, seats=1)
        self.workshop.refresh_from_db()
        self.assertEqual(self.workshop.remaining, 5)
        self.assertEqual(Reservation.objects.count(), 1)

    def test_cannot_oversell_or_use_bad_service_values(self):
        small = Workshop.objects.get(slug="bike-punctures")
        reserve(workshop_id=small.pk, user=self.alex, seats=4)
        with self.assertRaises(SoldOut):
            reserve(workshop_id=small.pk, user=self.jay, seats=1)
        for seats in [0, 5, True, 1.5]:
            with self.assertRaises(ValueError):
                reserve(workshop_id=self.workshop.pk, user=self.jay, seats=seats)
        small.refresh_from_db()
        self.assertEqual(small.remaining, 0)

    def test_ownership_and_single_restoration(self):
        record = reserve(workshop_id=self.workshop.pk, user=self.alex, seats=2)
        self.assertFalse(cancel(reservation_id=record.pk, user=self.jay))
        self.assertTrue(cancel(reservation_id=record.pk, user=self.alex))
        self.assertFalse(cancel(reservation_id=record.pk, user=self.alex))
        self.workshop.refresh_from_db()
        self.assertEqual(self.workshop.remaining, 7)

    def test_database_rejects_invalid_remaining(self):
        with self.assertRaises(IntegrityError):
            with transaction.atomic():
                Workshop.objects.filter(pk=self.workshop.pk).update(remaining=99)

    def test_user_deletion_cannot_bypass_reservation_service(self):
        from django.db.models.deletion import ProtectedError
        reserve(workshop_id=self.workshop.pk, user=self.alex, seats=1)
        with self.assertRaises(ProtectedError):
            self.alex.delete()
        self.assertEqual(Reservation.objects.count(), 1)

    def test_unsafe_title_is_escaped(self):
        self.workshop.title = "<script>alert(1)</script>"
        self.workshop.save(update_fields=["title"])
        response = self.client.get(self.workshop.get_absolute_url())
        self.assertContains(response, "&lt;script&gt;")
        self.assertNotContains(response, "<script>")

    def test_json_does_not_leak_drafts(self):
        response = self.client.get("/api/workshops/")
        self.assertEqual([row["slug"] for row in response.json()["workshops"]], ["lamp-care", "bike-punctures"])

    def test_methods_and_authentication(self):
        url = reverse("workshops:book", args=[self.workshop.slug])
        self.assertEqual(self.client.post(url, {"seats":1}).status_code, 302)
        self.client.force_login(self.alex)
        self.assertEqual(self.client.get(url).status_code, 405)
        self.assertEqual(self.client.get("/accounts/logout/").status_code, 405)
        self.assertEqual(self.client.post("/accounts/logout/").status_code, 302)
        self.assertNotIn("_auth_user_id", self.client.session)

    def test_form_upload_rejections(self):
        for name, body in [("big.txt", b"a" * 2049), ("bad.txt", b"\xff"), ("page.html", b"<script>"), ("nul.txt", b"a\x00b")]:
            form = NoteUploadForm(files={"note":SimpleUploadedFile(name, body)})
            self.assertFalse(form.is_valid(), name)

    @override_settings(DEBUG=False)
    def test_friendly_404(self):
        response = self.client.get("/workshops/missing/")
        self.assertEqual(response.status_code, 404)
        self.assertContains(response, "Workshop not found", status_code=404)

    def test_after_commit_timing(self):
        events = []
        with self.captureOnCommitCallbacks(execute=True) as callbacks:
            transaction.on_commit(lambda: events.append("done"))
        self.assertEqual(len(callbacks), 1)
        self.assertEqual(events, ["done"])

    def test_template_and_relationship_query_budget(self):
        with self.assertNumQueries(1):
            names = [row.venue.name for row in Workshop.objects.select_related("venue")]
        self.assertEqual(names, ["River Hall", "River Hall", "Roof Room"])

    def test_fixture_seed_is_repeatable(self):
        call_command("seed_lab", stdout=StringIO())
        self.assertEqual(Workshop.objects.count(), 3)
        self.assertFalse(self.alex.has_usable_password())

class AdminBoundaryTests(TestCase):
    def setUp(self):
        call_command("seed_lab", stdout=StringIO())
        self.admin = get_user_model().objects.create_superuser(username="local-review-admin", password=None)

    def test_staff_without_model_permission_is_denied(self):
        staff = get_user_model().objects.create_user(username="staff", password=None, is_staff=True)
        self.client.force_login(staff)
        self.assertEqual(self.client.get("/admin/workshops/workshop/").status_code, 403)

    def test_admin_lists_and_venue_crud(self):
        self.client.force_login(self.admin)
        self.assertContains(self.client.get("/admin/workshops/workshop/"), "Lamp care")
        response = self.client.post("/admin/workshops/venue/add/", {"name":"Test Hall", "code":"test-hall", "access_note":"Side door", "_save":"Save"})
        self.assertEqual(response.status_code, 302)
        venue = Venue.objects.get(code="test-hall")
        response = self.client.post(f"/admin/workshops/venue/{venue.pk}/change/", {"name":"Test Hall revised", "code":"test-hall", "access_note":"Side door", "_save":"Save"})
        self.assertEqual(response.status_code, 302)
        venue.refresh_from_db()
        self.assertEqual(venue.name, "Test Hall revised")
        response = self.client.post(f"/admin/workshops/venue/{venue.pk}/delete/", {"post":"yes"})
        self.assertEqual(response.status_code, 302)
        self.assertFalse(Venue.objects.filter(pk=venue.pk).exists())

    def test_admin_reservations_cannot_bypass_service(self):
        self.client.force_login(self.admin)
        self.assertEqual(self.client.get("/admin/workshops/reservation/add/").status_code, 403)

    def test_admin_bulk_publication(self):
        self.client.force_login(self.admin)
        draft = Workshop.objects.get(slug="wood-joints")
        response = self.client.post("/admin/workshops/workshop/", {"action":"publish_selected", "_selected_action":[str(draft.pk)], "index":"0"})
        self.assertEqual(response.status_code, 302)
        draft.refresh_from_db()
        self.assertTrue(draft.published)
        self.assertEqual(draft.remaining, 6)