import pytest
from django.conf import settings
from django.test import override_settings

from infrasynth.audit.models import ModelChangeLog, SecurityEvent
from infrasynth.audit.signals import model_changed, security_event_occurred
from infrasynth.security.models import Role


def audit_config(**overrides):
    return {**settings.INFRASYNTH_AUDIT, **overrides}


def _capture(signal):
    received = []
    receiver = lambda **kwargs: received.append(kwargs)  # noqa: E731
    signal.connect(receiver, weak=False)
    return received, receiver


@pytest.fixture
def role(db):
    return Role.objects.create(name="Test Role", slug="test-role", permissions=[])


class TestModelCreateTracking:
    def test_create_logs_entry(self, role):
        log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
        assert log.object_id == str(role.pk)
        assert log.action == "create"
        assert "name" in log.changes
        assert log.changes["name"] == [None, "Test Role"]

    def test_create_changes_include_serialized_fields(self, role):
        log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
        assert log.changes["slug"] == [None, "test-role"]
        assert log.changes["permissions"] == [None, "[]"]

    def test_create_actor_none_without_actor_field(self, role):
        log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
        assert log.actor is None


class TestModelUpdateTracking:
    def test_update_logs_field_changes(self, role):
        role._previous_state = Role.objects.get(pk=role.pk)
        role.name = "Renamed Role"
        role.save()

        logs = ModelChangeLog.objects.filter(
            model_label="infrasynth_security.Role",
            object_id=str(role.pk),
            action="update",
        )
        assert logs.count() == 1
        assert logs.first().changes["name"] == ["Test Role", "Renamed Role"]

    def test_no_changes_does_not_log(self, role):
        role._previous_state = Role.objects.get(pk=role.pk)
        role.save()

        assert not ModelChangeLog.objects.filter(
            model_label="infrasynth_security.Role",
            object_id=str(role.pk),
            action="update",
        ).exists()

    def test_update_logged_without_manual_snapshot(self, role):
        role.name = "Changed Automatically"
        role.save()

        log = ModelChangeLog.objects.get(
            model_label="infrasynth_security.Role",
            object_id=str(role.pk),
            action="update",
        )
        assert log.changes["name"] == ["Test Role", "Changed Automatically"]


class TestModelDeleteTracking:
    def test_delete_logs_entry(self, role):
        pk = role.pk
        role.delete()

        log = ModelChangeLog.objects.get(
            model_label="infrasynth_security.Role",
            object_id=str(pk),
            action="delete",
        )
        assert log.action == "delete"


class TestConfiguration:
    @override_settings(INFRASYNTH_AUDIT=audit_config(EXCLUDED_MODELS=["infrasynth_security.Role"]))
    def test_excluded_model_not_logged(self, db):
        Role.objects.create(name="Excluded", slug="excluded")
        assert not ModelChangeLog.objects.filter(model_label="infrasynth_security.Role").exists()

    @override_settings(INFRASYNTH_AUDIT=audit_config(EXCLUDED_FIELDS=["name", "slug"]))
    def test_excluded_fields_not_in_changes(self, db):
        Role.objects.create(name="Field", slug="field")
        log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
        assert "name" not in log.changes
        assert "slug" not in log.changes
        assert "is_system" in log.changes

    @override_settings(INFRASYNTH_AUDIT=audit_config(ENABLE_MODEL_CHANGE_TRACKING=False))
    def test_tracking_disabled(self, db):
        Role.objects.create(name="No Track", slug="no-track")
        assert not ModelChangeLog.objects.filter(model_label="infrasynth_security.Role").exists()

    @override_settings(INFRASYNTH_AUDIT=audit_config(ENABLE_SECURITY_EVENTS=False))
    def test_security_events_disabled(self, db):
        security_event_occurred.send(
            sender=Role,
            event_type="test",
            actor=None,
            ip_address=None,
            metadata={},
        )
        assert not SecurityEvent.objects.exists()


class TestSecurityEvents:
    def test_security_event_creates_log(self, db, user):
        security_event_occurred.send(
            sender=Role,
            event_type="login_failed",
            actor=user,
            ip_address="127.0.0.1",
            metadata={"reason": "bad_password"},
        )
        event = SecurityEvent.objects.get(event_type="login_failed")
        assert event.actor == user
        assert event.ip_address == "127.0.0.1"
        assert event.metadata == {"reason": "bad_password"}
        assert event.request_id


class TestModelChangedSignal:
    def test_create_emits(self, db):
        received, receiver = _capture(model_changed)
        try:
            role = Role.objects.create(name="Signalled", slug="signalled")
        finally:
            model_changed.disconnect(receiver)
        assert len(received) == 1
        assert received[0]["model_label"] == "infrasynth_security.Role"
        assert received[0]["object_id"] == str(role.pk)
        assert received[0]["action"] == "create"
        assert received[0]["changes"]["name"] == [None, "Signalled"]

    def test_update_emits_with_diff(self, db):
        role = Role.objects.create(name="Before", slug="before")
        received, receiver = _capture(model_changed)
        try:
            role.name = "After"
            role.save()
        finally:
            model_changed.disconnect(receiver)
        assert received[-1]["action"] == "update"
        assert received[-1]["changes"]["name"] == ["Before", "After"]

    def test_delete_emits(self, db):
        role = Role.objects.create(name="Doomed", slug="doomed")
        pk = role.pk
        received, receiver = _capture(model_changed)
        try:
            role.delete()
        finally:
            model_changed.disconnect(receiver)
        assert received[-1]["action"] == "delete"
        assert received[-1]["object_id"] == str(pk)

    @override_settings(INFRASYNTH_AUDIT=audit_config(EXCLUDED_MODELS=["infrasynth_security.Role"]))
    def test_excluded_model_does_not_emit(self, db):
        received, receiver = _capture(model_changed)
        try:
            Role.objects.create(name="Ignored", slug="ignored")
        finally:
            model_changed.disconnect(receiver)
        assert received == []


class TestConfigSecretAudit:
    def test_secret_value_never_enters_changes(self, db, tenant, clean_config_registry):
        from infrasynth.configs.models import ConfigValue
        from infrasynth.configs.registry import ConfigRegistry, ConfigType
        from infrasynth.configs.services import ConfigService

        ConfigRegistry.register("api.token", type=ConfigType.STRING, is_secret=True)
        ConfigService().set("api.token", "hunter2", tenant=tenant)

        ciphertext = ConfigValue.all_objects.get(tenant=tenant, key="api.token").value
        log = ModelChangeLog.objects.get(
            model_label="infrasynth_configs.ConfigValue",
            action="create",
        )
        assert "value" not in log.changes
        assert ciphertext not in str(log.changes)
        assert "hunter2" not in str(log.changes)