package payment

import (
	"context"
	"crypto"
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"crypto/rsa"
	"crypto/sha256"
	"crypto/x509"
	"encoding/base64"
	"encoding/json"
	"encoding/pem"
	"fmt"
	"io"
	"net/http"
	"net/http/httptest"
	"net/url"
	"strings"
	"testing"

	"kra/internal/biz"
	"kra/pkg/paymentkit"

	gopayAlipay "github.com/go-pay/gopay/alipay"
	gopayWechatV3 "github.com/go-pay/gopay/wechat/v3"
)

func testRSAKeyPair(t *testing.T) (*rsa.PrivateKey, string, string) {
	t.Helper()
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		t.Fatal(err)
	}
	privatePEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
	publicDER, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
	if err != nil {
		t.Fatal(err)
	}
	publicPEM := pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: publicDER})
	return key, string(privatePEM), string(publicPEM)
}

func testRSA2Sign(t *testing.T, key *rsa.PrivateKey, data []byte) string {
	t.Helper()
	digest := sha256.Sum256(data)
	signature, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, digest[:])
	if err != nil {
		t.Fatal(err)
	}
	return base64.StdEncoding.EncodeToString(signature)
}

func TestAlipayGoPayRequestParamHonorsGatewayAndVerifiesResponse(t *testing.T) {
	platformKey, privatePEM, publicPEM := testRSAKeyPair(t)
	var requestForm url.Values
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		body, err := io.ReadAll(r.Body)
		if err != nil {
			t.Errorf("read request: %v", err)
			return
		}
		requestForm, err = url.ParseQuery(string(body))
		if err != nil {
			t.Errorf("parse request: %v", err)
			return
		}
		if requestForm.Get("method") != "alipay.trade.query" {
			t.Errorf("method = %q", requestForm.Get("method"))
		}
		if !strings.Contains(requestForm.Get("biz_content"), `"out_trade_no":"T-ALIPAY"`) {
			t.Errorf("biz_content = %q", requestForm.Get("biz_content"))
		}
		ok, err := gopayAlipay.VerifySyncSign(goPayAlipayKey(publicPEM, true), alipaySignContent(requestForm), requestForm.Get("sign"))
		if err != nil || !ok {
			t.Errorf("request signature valid = %v, err = %v", ok, err)
		}
		response := []byte(`{"code":"10000","msg":"Success","trade_no":"P-ALIPAY","out_trade_no":"T-ALIPAY","trade_status":"TRADE_SUCCESS","total_amount":"10.00","buyer_pay_amount":"9.00","point_amount":"1.00","receipt_amount":"9.00","trans_currency":"CNY"}`)
		payload := fmt.Sprintf(`{"alipay_trade_query_response":%s,"sign":%q}`, response, testRSA2Sign(t, platformKey, response))
		w.Header().Set("Content-Type", "application/json")
		_, _ = io.WriteString(w, payload)
	}))
	defer server.Close()

	result, err := (&alipayAdapter{}).Query(context.Background(), "T-ALIPAY", map[string]any{
		"app_id":      "app-test",
		"private_key": privatePEM,
		"public_key":  publicPEM,
		"gateway_url": server.URL,
	})
	if err != nil {
		t.Fatal(err)
	}
	if requestForm == nil || result.TradeNo != "T-ALIPAY" || result.ProviderTradeNo != "P-ALIPAY" || result.Amount != 1000 || result.Currency != "CNY" {
		t.Fatalf("unexpected result: %+v, request: %v", result, requestForm)
	}
	if !result.AmountBreakdownKnown || result.PayerPaidAmount != 900 || result.CashPaidAmount != 800 || result.PointPaidAmount != 100 || result.DiscountAmount != 100 || result.SettlementAmount != 900 {
		t.Fatalf("unexpected amount breakdown: %+v", result)
	}
}

func TestAlipayGoPayCallbackVerificationDoesNotMutateFields(t *testing.T) {
	key, _, publicPEM := testRSAKeyPair(t)
	fields := map[string]string{
		"app_id":       "app-test",
		"trade_no":     "P-ALIPAY",
		"out_trade_no": "T-ALIPAY",
		"trade_status": "TRADE_SUCCESS",
		"sign_type":    "RSA2",
	}
	body := toGoPayBodyMap(fields)
	body.Remove("sign_type")
	sign, err := gopayAlipay.GetRsaSign(body, gopayAlipay.RSA2, key)
	if err != nil {
		t.Fatal(err)
	}
	fields["sign"] = sign
	config := map[string]any{"app_id": "app-test", "public_key": publicPEM}
	if err = verifyAlipay(fields, config); err != nil {
		t.Fatal(err)
	}
	if fields["sign"] == "" || fields["sign_type"] != "RSA2" {
		t.Fatalf("verification mutated source fields: %#v", fields)
	}
	fields["trade_no"] = "tampered"
	if err = verifyAlipay(fields, config); err == nil {
		t.Fatal("tampered callback unexpectedly verified")
	}
}

func TestWechatV2GoPayCallbackVerificationAndSandboxAmount(t *testing.T) {
	const key = "wechat-secret"
	var requestValues map[string]string
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		body, err := io.ReadAll(r.Body)
		if err != nil {
			t.Errorf("read request: %v", err)
			return
		}
		requestValues, err = paymentkit.XMLValues(body)
		if err != nil {
			t.Errorf("parse request: %v", err)
			return
		}
		if requestValues["total_fee"] != "123" {
			t.Errorf("total_fee = %q, want 123", requestValues["total_fee"])
		}
		if err = verifyWechatV2(requestValues, key); err != nil {
			t.Errorf("request signature: %v", err)
		}
		response := map[string]string{"return_code": "SUCCESS", "return_msg": "OK", "result_code": "SUCCESS", "prepay_id": "prepay"}
		response["sign"] = wechatV2Sign(response, key, "MD5")
		_, _ = w.Write(paymentkit.XMLEncode(response))
	}))
	defer server.Close()

	result, err := (&wechatV2Adapter{}).Create(context.Background(), &biz.PaymentRequest{
		TradeNo: "T-WECHAT", Subject: "subject", Amount: 123, Currency: "CNY", NotifyURL: "http://notify.local",
	}, map[string]any{
		"app_id": "wx-test", "merchant_id": "mch-test", "mch_key": key,
		"environment": "sandbox", "create_url": server.URL,
	})
	if err != nil {
		t.Fatal(err)
	}
	if result.Status != "created" || requestValues["total_fee"] != "123" {
		t.Fatalf("unexpected create result: %+v, request: %#v", result, requestValues)
	}

	callbackValues := map[string]string{
		"return_code": "SUCCESS", "result_code": "SUCCESS", "appid": "wx-test", "mch_id": "mch-test",
		"out_trade_no": "T-WECHAT", "transaction_id": "P-WECHAT", "trade_state": "SUCCESS",
	}
	callbackValues["sign"] = wechatV2Sign(callbackValues, key, "MD5")
	originalSign := callbackValues["sign"]
	if err = verifyWechatV2(callbackValues, key); err != nil {
		t.Fatal(err)
	}
	if callbackValues["sign"] != originalSign {
		t.Fatal("verification mutated source values")
	}
	callbackBody := paymentkit.XMLEncode(callbackValues)
	callbackResult, err := (&wechatV2Adapter{}).Callback(context.Background(), &biz.PaymentCallback{Body: callbackBody}, map[string]any{
		"app_id": "wx-test", "merchant_id": "mch-test", "mch_key": key,
	})
	if err != nil {
		t.Fatal(err)
	}
	if callbackResult.Status != "success" || callbackResult.ProviderTradeNo != "P-WECHAT" {
		t.Fatalf("unexpected callback result: %+v", callbackResult)
	}
}

type roundTripperFunc func(*http.Request) (*http.Response, error)

func (f roundTripperFunc) RoundTrip(request *http.Request) (*http.Response, error) {
	return f(request)
}

func TestWechatV3EndpointTransportPreservesSignedPathAndQuery(t *testing.T) {
	endpoint, err := url.Parse("https://payments.test.local")
	if err != nil {
		t.Fatal(err)
	}
	request, err := http.NewRequest(http.MethodGet, "https://api.mch.weixin.qq.com/v3/pay/transactions/out-trade-no/T-1?mchid=M-1", nil)
	if err != nil {
		t.Fatal(err)
	}
	request.Header.Set("Authorization", `WECHATPAY2-SHA256-RSA2048 mchid="M-1"`)

	transport := &wechatV3EndpointTransport{
		endpoint: endpoint,
		base: roundTripperFunc(func(got *http.Request) (*http.Response, error) {
			if got.URL.Scheme != "https" || got.URL.Host != "payments.test.local" {
				t.Fatalf("endpoint = %s", got.URL)
			}
			if got.URL.EscapedPath() != "/v3/pay/transactions/out-trade-no/T-1" || got.URL.RawQuery != "mchid=M-1" {
				t.Fatalf("signed target changed to %s", got.URL.RequestURI())
			}
			if got.Header.Get("Authorization") != request.Header.Get("Authorization") {
				t.Fatal("authorization header changed while rewriting endpoint")
			}
			return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody, Header: make(http.Header), Request: got}, nil
		}),
	}

	if _, err = transport.RoundTrip(request); err != nil {
		t.Fatal(err)
	}
	if request.URL.Host != "api.mch.weixin.qq.com" {
		t.Fatal("transport mutated the original request")
	}
}

func TestWechatV3PrepayResultUsesGoPayClientSigning(t *testing.T) {
	_, privatePEM, _ := testRSAKeyPair(t)
	client, err := gopayWechatV3.NewClientV3(
		"mch-test",
		"merchant-serial",
		"01234567890123456789012345678901",
		privatePEM,
	)
	if err != nil {
		t.Fatal(err)
	}

	for _, tc := range []struct {
		name      string
		tradeType string
		assert    func(*testing.T, map[string]any)
	}{
		{
			name: "jsapi", tradeType: "jsapi",
			assert: func(t *testing.T, payload map[string]any) {
				if payload["appId"] != "wx-test" || payload["package"] != "prepay_id=PREPAY-1" || strings.TrimSpace(fmt.Sprint(payload["paySign"])) == "" {
					t.Fatalf("JSAPI payload = %#v", payload)
				}
			},
		},
		{
			name: "applet", tradeType: "mini_program",
			assert: func(t *testing.T, payload map[string]any) {
				if payload["appId"] != "wx-test" || payload["package"] != "prepay_id=PREPAY-1" || strings.TrimSpace(fmt.Sprint(payload["paySign"])) == "" {
					t.Fatalf("applet payload = %#v", payload)
				}
			},
		},
		{
			name: "app", tradeType: "app",
			assert: func(t *testing.T, payload map[string]any) {
				if payload["appid"] != "wx-test" || payload["partnerid"] != "mch-test" || payload["prepayid"] != "PREPAY-1" || strings.TrimSpace(fmt.Sprint(payload["sign"])) == "" {
					t.Fatalf("App payload = %#v", payload)
				}
			},
		},
	} {
		t.Run(tc.name, func(t *testing.T) {
			result, err := wechatV3PrepayCreateResult(client, "wx-test", tc.tradeType, "T-WECHAT-V3", &gopayWechatV3.PrepayRsp{
				Code:     gopayWechatV3.Success,
				Response: &gopayWechatV3.Prepay{PrepayId: "PREPAY-1"},
			})
			if err != nil {
				t.Fatal(err)
			}
			if result.TradeNo != "T-WECHAT-V3" || result.QueryID != "" || result.Status != "created" {
				t.Fatalf("result = %+v", result)
			}
			var payload map[string]any
			if err = json.Unmarshal(result.Payload, &payload); err != nil {
				t.Fatal(err)
			}
			tc.assert(t, payload)
		})
	}
}

func TestWechatV3GoPayCallbackVerificationAndDecryption(t *testing.T) {
	platformKey, merchantPrivatePEM, platformPublicPEM := testRSAKeyPair(t)
	const (
		apiV3Key      = "01234567890123456789012345678901"
		resourceNonce = "0123456789ab"
		headerNonce   = "callback-nonce"
		timestamp     = "1787068800"
		serial        = "ABCDEF123456"
	)

	plain := []byte(`{"appid":"wx-test","mchid":"mch-test","out_trade_no":"T-WECHAT-V3","transaction_id":"P-WECHAT-V3","trade_state":"SUCCESS"}`)
	block, err := aes.NewCipher([]byte(apiV3Key))
	if err != nil {
		t.Fatal(err)
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		t.Fatal(err)
	}
	ciphertext := base64.StdEncoding.EncodeToString(gcm.Seal(nil, []byte(resourceNonce), plain, []byte("transaction")))
	body, err := json.Marshal(map[string]any{
		"id": "EVENT-WECHAT-V3", "event_type": "TRANSACTION.SUCCESS", "resource_type": "encrypt-resource", "summary": "payment success",
		"resource": map[string]any{"algorithm": "AEAD_AES_256_GCM", "ciphertext": ciphertext, "associated_data": "transaction", "original_type": "transaction", "nonce": resourceNonce},
	})
	if err != nil {
		t.Fatal(err)
	}
	signature := testRSA2Sign(t, platformKey, []byte(timestamp+"\n"+headerNonce+"\n"+string(body)+"\n"))
	callback := &biz.PaymentCallback{
		Body: body,
		Headers: map[string]string{
			gopayWechatV3.HeaderTimestamp: timestamp,
			gopayWechatV3.HeaderNonce:     headerNonce,
			gopayWechatV3.HeaderSerial:    serial,
			gopayWechatV3.HeaderSignature: signature,
		},
	}

	result, err := (&wechatV3Adapter{}).Callback(context.Background(), callback, map[string]any{
		"api_v3_key": apiV3Key, "platform_cert": platformPublicPEM, "private_key": merchantPrivatePEM,
		"platform_serial_no": strings.ToLower(serial), "serial_no": "merchant-serial", "app_id": "wx-test", "merchant_id": "mch-test",
	})
	if err != nil {
		t.Fatal(err)
	}
	if result.Status != "success" || result.TradeNo != "T-WECHAT-V3" || result.ProviderTradeNo != "P-WECHAT-V3" {
		t.Fatalf("unexpected callback result: %+v", result)
	}
	if callback.Query["event_id"] != "EVENT-WECHAT-V3" {
		t.Fatalf("event id = %q", callback.Query["event_id"])
	}
}