"""
Additional route coverage beyond tests/test_api.py's core happy-path
set — account management, billing, internal (n8n) routes, and the
Stripe webhook signature-verification path.
"""
import importlib
import types
import pytest
from repositories.tenant_repository import tenant_repository
from repositories.seat_repository import seat_repository
from repositories.competitor_repository import competitor_repository
from repositories.scrape_repository import scrape_repository
from repositories.battlecard_repository import battlecard_repository
from repositories.comparable_repository import comparable_repository
from repositories.alert_repository import alert_repository


def _make_tenant(**overrides):
    data = {
        'name': 'G Adventures', 'email': 'pm@gadventures.com', 'domain': 'gadventures.com',
        'tier': 'analyse', 'status': 'active', 'max_seats': 5,
        'onboarding_checklist': {'add_competitor': False, 'tour_step': 0},
    }
    data.update(overrides)
    return tenant_repository.create(data)


def _install_fake_module(monkeypatch, dotted_name, **attrs):
    """
    Imports the real module at `dotted_name` (core.extractor,
    industries.adventure_travel.prompt — always real, importable Phase
    2 modules) and patches attributes via monkeypatch.setattr, which
    records the original value and restores it on teardown. Must
    import the real module rather than substitute a blank fake one —
    see the identical helper in tests/services/test_analysis_service.py
    for why.
    """
    target = importlib.import_module(dotted_name)
    for key, value in attrs.items():
        monkeypatch.setattr(target, key, value)


# ── Account ────────────────────────────────────────────────────────

def test_get_account_returns_tenant_with_seats(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    seat_repository.create({'tenant_id': tenant['id'], 'email': 'pm@gadventures.com', 'active': True})
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.get(f'/account/{tenant["id"]}', headers=api_headers)

    assert response.status_code == 200
    assert response.json['name'] == 'G Adventures'
    assert len(response.json['seats']) == 1


def test_get_account_unknown_tenant_404(client, api_headers, monkeypatch):
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: 'does-not-exist')
    response = client.get('/account/does-not-exist', headers=api_headers)
    assert response.status_code == 404


def test_get_account_rejects_mismatched_session_tenant(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    other_tenant = _make_tenant(domain='otherco.com', email='pm@otherco.com')
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: other_tenant['id'])

    response = client.get(f'/account/{tenant["id"]}', headers=api_headers)

    assert response.status_code == 403


def test_get_my_account_requires_session(client, api_headers):
    response = client.get('/account/me', headers=api_headers)
    assert response.status_code == 401


def test_get_my_account_returns_own_tenant(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.get('/account/me', headers=api_headers)

    assert response.status_code == 200
    assert response.json['name'] == 'G Adventures'


def test_update_timezone_requires_session(client, api_headers):
    response = client.patch('/account/timezone', json={'timezone': 'Europe/London'}, headers=api_headers)
    assert response.status_code == 401


def test_update_timezone_requires_field(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.patch('/account/timezone', json={}, headers=api_headers)

    assert response.status_code == 400
    assert response.json['code'] == 'missing_field'


def test_update_timezone_sets_when_empty(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.patch('/account/timezone', json={'timezone': 'Europe/London'}, headers=api_headers)

    assert response.status_code == 200
    assert response.json['timezone'] == 'Europe/London'
    assert tenant_repository.get_by_id(tenant['id'])['timezone'] == 'Europe/London'


def test_update_timezone_never_overwrites_existing(client, api_headers, monkeypatch):
    tenant = tenant_repository.create({
        'name': 'G Adventures', 'domain': 'gadventures.com', 'tier': 'analyse',
        'status': 'active', 'max_seats': 5, 'timezone': 'America/Toronto',
    })
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.patch('/account/timezone', json={'timezone': 'Europe/London'}, headers=api_headers)

    assert response.status_code == 200
    assert response.json['timezone'] == 'America/Toronto'  # unchanged — first-write-wins


def test_update_competitor(client, api_headers):
    tenant = _make_tenant()
    competitor = competitor_repository.create({
        'tenant_id': tenant['id'], 'name': 'Intrepid', 'website': 'https://intrepidtravel.com',
        'catalogue_url': 'https://intrepidtravel.com/adventures', 'primary_market': 'GB', 'active': True,
    })

    response = client.put(
        f'/account/competitors/{competitor["id"]}', json={'primary_market': 'US'}, headers=api_headers
    )

    assert response.status_code == 200
    assert response.json['primary_market'] == 'US'


def test_update_unknown_competitor_404(client, api_headers):
    response = client.put('/account/competitors/nope', json={}, headers=api_headers)
    assert response.status_code == 404


def test_delete_competitor_deactivates(client, api_headers):
    tenant = _make_tenant()
    competitor = competitor_repository.create({
        'tenant_id': tenant['id'], 'name': 'Intrepid', 'website': 'https://intrepidtravel.com',
        'catalogue_url': 'https://intrepidtravel.com/adventures', 'primary_market': 'GB',
        'active': True,
    })

    response = client.delete(f'/account/competitors/{competitor["id"]}', headers=api_headers)

    assert response.status_code == 200
    assert competitor_repository.get_by_id(competitor['id'])['active'] is False


def test_delete_unknown_competitor_404(client, api_headers):
    response = client.delete('/account/competitors/nope', headers=api_headers)
    assert response.status_code == 404


def test_account_template_returns_configured_url(client, api_headers, monkeypatch):
    monkeypatch.setattr('api.TEMPLATE_SHEET_URL', 'https://docs.google.com/spreadsheets/d/abc123/copy')
    response = client.get('/account/template', headers=api_headers)
    assert response.status_code == 200
    assert response.json['template_url'] == 'https://docs.google.com/spreadsheets/d/abc123/copy'


def test_onboarding_patch_requires_resolvable_session(client, api_headers):
    response = client.patch('/account/onboarding', json={'tour_step': 2}, headers=api_headers)
    assert response.status_code == 401


def test_onboarding_patch_updates_checklist(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.patch(
        '/account/onboarding', json={'tour_step': 2},
        headers={**api_headers, 'Authorization': 'Bearer sometoken'}
    )

    assert response.status_code == 200
    assert response.json['onboarding_checklist']['tour_step'] == 2


def test_onboarding_patch_falls_back_to_email_when_no_jwt_session(client, api_headers):
    # This is the Apps Script's only path — it has no PocketBase JWT,
    # just the PM's Google email via Session.getActiveUser().
    tenant = _make_tenant()

    response = client.patch(
        '/account/onboarding', json={'email': 'pm@gadventures.com', 'sync_from_sheet': True},
        headers=api_headers
    )

    assert response.status_code == 200
    assert response.json['onboarding_checklist']['sync_from_sheet'] is True


def test_onboarding_patch_401_when_neither_jwt_nor_email_resolve(client, api_headers):
    response = client.patch(
        '/account/onboarding', json={'email': 'nobody@nowhere.com', 'sync_from_sheet': True},
        headers=api_headers
    )
    assert response.status_code == 401


def test_delete_account_requires_tenant_id(client, api_headers):
    response = client.post('/account/delete', json={}, headers=api_headers)
    assert response.status_code == 400


def test_delete_account_unknown_tenant_404(client, api_headers):
    response = client.post('/account/delete', json={'tenant_id': 'does-not-exist'}, headers=api_headers)
    assert response.status_code == 404


def test_delete_account_erases_every_tenant_scoped_collection(client, api_headers, monkeypatch):
    from repositories.product_repository import product_repository
    from repositories.price_history_repository import price_history_repository
    from repositories.alert_repository import alert_repository
    from repositories.battlecard_repository import battlecard_repository
    from repositories.comparable_repository import comparable_repository
    from repositories.client_trips_repository import client_trips_repository

    tenant = _make_tenant()
    competitor = competitor_repository.create({
        'tenant_id': tenant['id'], 'name': 'Intrepid', 'website': 'https://intrepidtravel.com',
        'catalogue_url': 'https://intrepidtravel.com/adventures', 'primary_market': 'GB', 'active': True,
    })
    seat_repository.create({'tenant_id': tenant['id'], 'email': 'pm@gadventures.com', 'active': True})
    product = product_repository.create({
        'tenant_id': tenant['id'], 'competitor_id': competitor['id'], 'trip_name': 'Peru Classic',
    })
    price_history_repository.create({'tenant_id': tenant['id'], 'product_id': product['id'], 'majority_price_usd': 2190})
    scrape_repository.create({
        'tenant_id': tenant['id'], 'triggered_by': 'manual', 'status': 'complete',
        'competitors_total': 1, 'competitors_done': 1,
    })
    alert = alert_repository.create({
        'tenant_id': tenant['id'], 'competitor_id': competitor['id'], 'alert_type': 'new_product', 'message': 'x',
    })
    battlecard_repository.upsert(competitor['id'], {'tenant_id': tenant['id'], 'content': 'x'})
    comparable_repository.create({
        'tenant_id': tenant['id'], 'client_product': 'Inca Trail', 'competitor_product': product['id'],
        'similarity_score': 0.9,
    })
    client_trips_repository.create({'tenant_id': tenant['id'], 'trip_name': 'Inca Trail'})

    sent = []
    monkeypatch.setattr('services.email_service.send_account_deleted_email', lambda email, name: sent.append(email))

    response = client.post('/account/delete', json={'tenant_id': tenant['id']}, headers=api_headers)

    assert response.status_code == 200
    assert tenant_repository.get_by_id(tenant['id']) is None  # hard-deleted, not just deactivated
    assert competitor_repository.get_by_id(competitor['id']) is None
    assert seat_repository.list_for_tenant(tenant['id']) == []
    assert product_repository.list_all_for_tenant(tenant['id']) == []
    assert price_history_repository.list_for_tenant(tenant['id']) == []
    assert scrape_repository.list_all_for_tenant(tenant['id']) == []
    assert alert_repository.get_by_id(alert['id']) is None
    assert battlecard_repository.list_for_tenant(tenant['id']) == []
    assert comparable_repository.list_for_tenant(tenant['id'], include_dismissed=True) == []
    assert client_trips_repository.list_for_tenant(tenant['id']) == []
    assert sent == ['pm@gadventures.com']


def test_delete_account_side_effect_failures_dont_block_erasure(client, api_headers, monkeypatch):
    """Stripe cancellation and the confirmation email are side effects — a failure in either never blocks erasure."""
    tenant = _make_tenant(stripe_subscription_id='sub_123')
    monkeypatch.setattr(
        'services.billing_service._stripe',
        lambda: type('_S', (), {'Subscription': type('_Sub', (), {
            'delete': staticmethod(lambda *a, **k: (_ for _ in ()).throw(RuntimeError('stripe down')))
        })})()
    )
    monkeypatch.setattr(
        'services.email_service.send_account_deleted_email',
        lambda *a, **k: (_ for _ in ()).throw(RuntimeError('resend down'))
    )

    response = client.post('/account/delete', json={'tenant_id': tenant['id']}, headers=api_headers)

    assert response.status_code == 200
    assert tenant_repository.get_by_id(tenant['id']) is None


# ── Billing ────────────────────────────────────────────────────────

def test_billing_portal_requires_session(client, api_headers):
    response = client.get('/billing/portal', headers=api_headers)
    assert response.status_code == 401


def test_billing_portal_no_stripe_customer_returns_400(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.get(
        '/billing/portal', headers={**api_headers, 'Authorization': 'Bearer x'}
    )
    assert response.status_code == 400
    assert response.json['code'] == 'no_stripe_customer'


def test_billing_upgrade_requires_fields(client, api_headers):
    response = client.post('/billing/upgrade', json={}, headers=api_headers)
    assert response.status_code == 400


def test_billing_upgrade_unconfigured_tier_returns_400(client, api_headers):
    tenant = _make_tenant()
    response = client.post(
        '/billing/upgrade', json={'tenant_id': tenant['id'], 'target_tier': 'discover'}, headers=api_headers
    )
    assert response.status_code == 400
    assert response.json['code'] == 'upgrade_failed'


# ── Internal (n8n) ─────────────────────────────────────────────────

def test_internal_battlecard_requires_tenant_id(client, api_headers):
    response = client.post('/internal/battlecard/c1', json={}, headers=api_headers)
    assert response.status_code == 400


def test_internal_battlecard_generates_card(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    competitor = competitor_repository.create({
        'tenant_id': tenant['id'], 'name': 'Intrepid', 'website': 'https://intrepidtravel.com',
        'catalogue_url': 'https://intrepidtravel.com/adventures', 'primary_market': 'GB', 'active': True,
    })
    _install_fake_module(
        monkeypatch, 'core.extractor',
        extract_with_openrouter=lambda prompt, content: {
            'positioning': 'x', 'strengths': [], 'weaknesses': [], 'pricing_observation': 'y'
        }
    )

    response = client.post(
        f'/internal/battlecard/{competitor["id"]}', json={'tenant_id': tenant['id']}, headers=api_headers
    )

    assert response.status_code == 200
    assert response.json['content_json']['positioning'] == 'x'


def test_internal_weekly_brief(client, api_headers, monkeypatch):
    called = []
    monkeypatch.setattr('api.brief_service.send_weekly_brief', lambda tenant_id: called.append(tenant_id))
    response = client.post('/internal/weekly-brief/t1', headers=api_headers)
    assert response.status_code == 200
    assert called == ['t1']


def test_internal_daily_digest(client, api_headers, monkeypatch):
    monkeypatch.setattr('api.alert_service.send_daily_digest', lambda tenant_id: tenant_id == 't1')
    response = client.post('/internal/daily-digest/t1', headers=api_headers)
    assert response.status_code == 200
    assert response.json['sent'] is True


def test_internal_data_cleanup(client, api_headers, monkeypatch):
    monkeypatch.setattr(
        'services.retention_service.run_weekly_cleanup',
        lambda: {'scrape_runs_deleted': 3, 'alerts_deleted': 1, 'price_history_deleted': 0}
    )
    response = client.post('/internal/data-cleanup', headers=api_headers)
    assert response.status_code == 200
    assert response.json == {'scrape_runs_deleted': 3, 'alerts_deleted': 1, 'price_history_deleted': 0}


def test_internal_welcome_email_unknown_tenant_404(client, api_headers):
    response = client.post('/internal/welcome-email/does-not-exist', headers=api_headers)
    assert response.status_code == 404


def test_internal_welcome_email_sends(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    monkeypatch.setattr('api.email_service.send_welcome_email', lambda email, name, url=None: True)

    response = client.post(
        f'/internal/welcome-email/{tenant["id"]}', json={'template_url': 'https://sheets/x'}, headers=api_headers
    )

    assert response.status_code == 200
    assert response.json['sent'] is True


def test_internal_trial_reminder_no_active_trial_404(client, api_headers):
    tenant = _make_tenant(trial_ends_at=None)
    response = client.post(f'/internal/trial-reminder/{tenant["id"]}', headers=api_headers)
    assert response.status_code == 404


def test_internal_trial_reminder_sends(client, api_headers, monkeypatch):
    from datetime import datetime, timedelta, timezone
    tenant = _make_tenant(trial_ends_at=(datetime.now(timezone.utc) + timedelta(days=2)).isoformat())
    captured = {}
    monkeypatch.setattr(
        'api.email_service.send_trial_reminder_email',
        lambda email, name, days_left, trial_end_date: captured.update(days_left=days_left) or True
    )

    response = client.post(f'/internal/trial-reminder/{tenant["id"]}', headers=api_headers)

    assert response.status_code == 200
    assert response.json['sent'] is True
    assert captured['days_left'] in (1, 2)  # datetime.days truncation can land on either


def test_internal_alert_email_unknown_alert_404(client, api_headers):
    response = client.post('/internal/alert-email/does-not-exist', headers=api_headers)
    assert response.status_code == 404


def test_internal_alert_email_unsupported_type_400(client, api_headers):
    tenant = _make_tenant()
    competitor = competitor_repository.create({
        'tenant_id': tenant['id'], 'name': 'Intrepid', 'website': 'https://intrepidtravel.com',
        'catalogue_url': 'https://intrepidtravel.com/adventures', 'primary_market': 'GB', 'active': True,
    })
    alert = alert_repository.create({
        'tenant_id': tenant['id'], 'competitor_id': competitor['id'], 'alert_type': 'new_comparable', 'message': 'x',
    })

    response = client.post(f'/internal/alert-email/{alert["id"]}', headers=api_headers)

    assert response.status_code == 400
    assert response.json['code'] == 'unsupported_alert_type'


def test_internal_alert_email_sends_price_change_and_marks_delivered(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    competitor = competitor_repository.create({
        'tenant_id': tenant['id'], 'name': 'Intrepid', 'website': 'https://intrepidtravel.com',
        'catalogue_url': 'https://intrepidtravel.com/adventures', 'primary_market': 'GB', 'active': True,
    })
    alert = alert_repository.create({
        'tenant_id': tenant['id'], 'competitor_id': competitor['id'], 'alert_type': 'price_change',
        'message': 'Price dropped', 'change_percent': -12,
    })
    monkeypatch.setattr('api.email_service.send_price_alert_email', lambda email, alert_data: True)

    response = client.post(f'/internal/alert-email/{alert["id"]}', headers=api_headers)

    assert response.status_code == 200
    assert response.json['sent'] is True
    assert alert_repository.get_by_id(alert['id'])['delivered_email'] is True


def test_internal_alert_email_sends_new_product(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    competitor = competitor_repository.create({
        'tenant_id': tenant['id'], 'name': 'Flash Pack', 'website': 'https://flashpack.com',
        'catalogue_url': 'https://flashpack.com/adventures', 'primary_market': 'US', 'active': True,
    })
    alert = alert_repository.create({
        'tenant_id': tenant['id'], 'competitor_id': competitor['id'], 'alert_type': 'new_product', 'message': 'New trip',
    })
    monkeypatch.setattr('api.email_service.send_new_product_email', lambda email, alert_data: True)

    response = client.post(f'/internal/alert-email/{alert["id"]}', headers=api_headers)

    assert response.status_code == 200
    assert response.json['sent'] is True


def test_internal_scrape_enqueues_job(client, api_headers, monkeypatch):
    import jobs
    tenant = _make_tenant()
    captured = {}
    monkeypatch.setattr(jobs, 'enqueue_research_job', lambda job_id, data: captured.update(job_id=job_id))

    response = client.post(f'/internal/scrape/{tenant["id"]}', json={'competitors': []}, headers=api_headers)

    assert response.status_code == 200
    assert response.json['job_id'] == captured['job_id']


def test_internal_embed_products(client, api_headers, monkeypatch):
    from repositories.product_repository import product_repository
    from repositories.client_trips_repository import client_trips_repository
    tenant = _make_tenant()
    competitor = competitor_repository.create({
        'tenant_id': tenant['id'], 'name': 'Intrepid', 'website': 'https://intrepidtravel.com',
        'catalogue_url': 'https://intrepidtravel.com/adventures', 'primary_market': 'GB', 'active': True,
    })
    product_repository.create({
        'tenant_id': tenant['id'], 'competitor_id': competitor['id'], 'trip_name': 'Peru Classic',
    })
    client_trips_repository.create({'tenant_id': tenant['id'], 'trip_name': 'Inca Trail'})
    monkeypatch.setattr('services.embedding_service.embed_trip', lambda trip: [0.1, 0.2])

    response = client.post(f'/internal/embed-products/{tenant["id"]}', headers=api_headers)

    assert response.status_code == 200
    assert response.json['embedded'] == 2
    assert response.json['embedded_products'] == 1
    assert response.json['embedded_client_trips'] == 1


def test_internal_match_comparable(client, api_headers, monkeypatch):
    from repositories.client_trips_repository import client_trips_repository
    tenant = _make_tenant()
    client_trips_repository.create({'tenant_id': tenant['id'], 'trip_name': 'Inca Trail', 'embedding': [1, 0]})
    monkeypatch.setattr(
        'services.embedding_service.find_comparable_trips',
        lambda client_trips, competitor_trips, threshold=0.75: [
            {'client_product': 'x', 'competitor_product': 'p1', 'similarity_score': 0.9,
             'price_difference': 10, 'duration_difference': 0}
        ]
    )

    response = client.post(f'/internal/match-comparable/{tenant["id"]}', headers=api_headers)

    assert response.status_code == 200
    assert response.json['matches_created'] == 1
    assert response.json['matches_updated'] == 0
    matches = comparable_repository.list_for_tenant(tenant['id'])
    assert len(matches) == 1
    assert matches[0]['last_matched'] is not None


def test_internal_match_comparable_upserts_on_repeat_run(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    monkeypatch.setattr(
        'services.embedding_service.find_comparable_trips',
        lambda client_trips, competitor_trips, threshold=0.75: [
            {'client_product': 'x', 'competitor_product': 'p1', 'similarity_score': 0.9,
             'price_difference': 10, 'duration_difference': 0}
        ]
    )

    client.post(f'/internal/match-comparable/{tenant["id"]}', headers=api_headers)
    response = client.post(f'/internal/match-comparable/{tenant["id"]}', headers=api_headers)

    assert response.json['matches_created'] == 0
    assert response.json['matches_updated'] == 1
    # Same pair matched twice — updated in place, never duplicated.
    assert len(comparable_repository.list_for_tenant(tenant['id'])) == 1


def test_internal_match_comparable_preserves_dismissed_flag_on_upsert(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    monkeypatch.setattr(
        'services.embedding_service.find_comparable_trips',
        lambda client_trips, competitor_trips, threshold=0.75: [
            {'client_product': 'x', 'competitor_product': 'p1', 'similarity_score': 0.9,
             'price_difference': 10, 'duration_difference': 0}
        ]
    )
    client.post(f'/internal/match-comparable/{tenant["id"]}', headers=api_headers)
    match = comparable_repository.list_for_tenant(tenant['id'], include_dismissed=True)[0]
    comparable_repository.dismiss(match['id'])

    client.post(f'/internal/match-comparable/{tenant["id"]}', headers=api_headers)

    still_dismissed = comparable_repository.list_for_tenant(tenant['id'], include_dismissed=True)[0]
    assert still_dismissed['dismissed'] is True


# ── Research history — latest (Apps Script sidebar pull) ────────────

def test_research_history_latest_requires_known_email(client, api_headers):
    response = client.get('/research/history/latest', query_string={'email': 'nobody@nowhere.com'}, headers=api_headers)
    assert response.status_code == 404


def test_research_history_latest_no_completed_runs_yet(client, api_headers):
    _make_tenant()
    response = client.get(
        '/research/history/latest', query_string={'email': 'pm@gadventures.com'}, headers=api_headers
    )
    assert response.status_code == 404
    assert response.json['code'] == 'not_found'


def test_research_history_latest_returns_most_recent_completed_run(client, api_headers):
    tenant = _make_tenant()
    scrape_repository.create({
        'tenant_id': tenant['id'], 'triggered_by': 'manual', 'status': 'failed',
        'competitors_total': 1, 'competitors_done': 1, 'results': {},
        'started_at': '2026-06-01T00:00:00Z',
    })
    latest = scrape_repository.create({
        'tenant_id': tenant['id'], 'triggered_by': 'manual', 'status': 'complete',
        'competitors_total': 2, 'competitors_done': 2, 'results': {'success': [{'name': 'Intrepid'}]},
        'started_at': '2026-06-15T00:00:00Z',
    })

    response = client.get(
        '/research/history/latest', query_string={'email': 'pm@gadventures.com'}, headers=api_headers
    )

    assert response.status_code == 200
    assert response.json['id'] == latest['id']


# ── Research history / status / battlecards / comparable-trips ────

def test_research_status_unknown_job_404(client, api_headers):
    response = client.get('/research/status/nope', headers=api_headers)
    assert response.status_code == 404


def test_research_status_known_job(client, api_headers):
    tenant = _make_tenant()
    run = scrape_repository.create({
        'tenant_id': tenant['id'], 'triggered_by': 'manual', 'status': 'running',
        'competitors_total': 2, 'competitors_done': 1, 'results': {},
    })
    response = client.get(f'/research/status/{run["id"]}', headers=api_headers)
    assert response.status_code == 200
    assert response.json['progress'] == {'total': 2, 'done': 1}


def test_research_history_detail_unknown_404(client, api_headers):
    response = client.get('/research/history/nope', headers=api_headers)
    assert response.status_code == 404


def test_research_cancel_known_job(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    run = scrape_repository.create({
        'tenant_id': tenant['id'], 'triggered_by': 'manual', 'status': 'running',
        'competitors_total': 2, 'competitors_done': 1, 'results': {},
    })
    calls = []
    monkeypatch.setattr('jobs.cancel_research_job', lambda job_id: calls.append(job_id) or True)

    response = client.post(f'/research/cancel/{run["id"]}', headers=api_headers)

    assert response.status_code == 200
    assert response.json['status'] == 'cancelling'
    assert calls == [run['id']]


def test_research_cancel_unknown_job_404(client, api_headers, monkeypatch):
    monkeypatch.setattr('jobs.cancel_research_job', lambda job_id: False)
    response = client.post('/research/cancel/nope', headers=api_headers)
    assert response.status_code == 404


# ── Rate limiting — CORS preflight exemption ───────────────────────

def test_options_preflight_never_rate_limited(client):
    """
    Regression test — the dashboard's 3s status-poll loop tripped a 429
    on the browser's own CORS preflight (OPTIONS) within under a minute:
    each cross-origin GET also fires an OPTIONS first, doubling counted
    requests against the 30/minute default limit. OPTIONS must never be
    rate limited — it carries no X-API-Key and isn't a real request.
    """
    for _ in range(50):  # comfortably past the 30/minute default limit
        response = client.options('/research/status/anything')
        assert response.status_code != 429


def test_get_requests_still_rate_limited(client, api_headers):
    """
    The OPTIONS exemption must not accidentally exempt real requests too.
    Uses /research/history rather than /research/status — the latter now
    has its own override_defaults=True limit (see api.py) specifically
    because it's polled, so it wouldn't trip the blanket default here.
    """
    responses = [client.get('/research/history', query_string={'email': 'pm@test.com'}, headers=api_headers)
                 for _ in range(35)]
    assert any(r.status_code == 429 for r in responses)


def test_research_status_survives_a_full_poll_cycle_worth_of_requests(client, api_headers):
    """
    Regression test — a real test job's 20-minute poll loop (3s interval,
    analysis_store.js's POLL_TIMEOUT_ATTEMPTS=400) tripped the blanket
    200/hour default well before the job even finished, because
    research_status had no override. 250 requests here comfortably
    exceeds the old 200/hour default and must still all succeed under
    the route's own 3000/hour override.
    """
    responses = [client.get('/research/status/nope', headers=api_headers) for _ in range(250)]
    assert all(r.status_code == 404 for r in responses)  # 404 (unknown job), never 429


def test_research_history_for_tenant(client, api_headers):
    tenant = _make_tenant()
    scrape_repository.create({
        'tenant_id': tenant['id'], 'triggered_by': 'manual', 'status': 'complete',
        'competitors_total': 1, 'competitors_done': 1, 'results': {},
    })
    response = client.get('/research/history', query_string={'email': 'pm@gadventures.com'}, headers=api_headers)
    assert response.status_code == 200
    assert len(response.json) == 1


def test_research_history_excludes_per_competitor_bookkeeping_rows(client, api_headers):
    # Regression test — analysis_service.run_competitor_analysis()'s
    # refresh path creates its own scrape_runs row PER COMPETITOR purely
    # to persist a content_hash for next time (hardcoded
    # triggered_by='cron', competitors_total=1, results={}), regardless of
    # what triggered the parent job. Without filtering these out, "last 5
    # runs" showed misleading 1-competitor entries with no restorable
    # results instead of the real batch run.
    tenant = _make_tenant()
    real_run = scrape_repository.create({
        'tenant_id': tenant['id'], 'triggered_by': 'manual', 'status': 'complete',
        'competitors_total': 5, 'competitors_done': 5,
        'results': {'success': [{'name': 'Intrepid'}], 'failed': []},
    })
    for _ in range(5):
        scrape_repository.create({
            'tenant_id': tenant['id'], 'triggered_by': 'cron', 'status': 'complete',
            'competitors_total': 1, 'competitors_done': 1, 'results': {},
            'content_hash': 'somehash',
        })

    response = client.get('/research/history', query_string={'email': 'pm@gadventures.com'}, headers=api_headers)

    assert response.status_code == 200
    assert len(response.json) == 1
    assert response.json[0]['id'] == real_run['id']


def test_research_history_latest_excludes_per_competitor_bookkeeping_rows(client, api_headers):
    tenant = _make_tenant()
    real_run = scrape_repository.create({
        'tenant_id': tenant['id'], 'triggered_by': 'manual', 'status': 'complete',
        'competitors_total': 5, 'competitors_done': 5,
        'results': {'success': [{'name': 'Intrepid'}], 'failed': []},
        'started_at': '2026-06-01T00:00:00Z',
    })
    # Created after the real run, same as the actual per-competitor loop —
    # this is exactly the case that could previously win the "latest
    # complete" lookup used by the Apps Script sidebar's pull integration.
    scrape_repository.create({
        'tenant_id': tenant['id'], 'triggered_by': 'cron', 'status': 'complete',
        'competitors_total': 1, 'competitors_done': 1, 'results': {},
        'content_hash': 'somehash', 'started_at': '2026-06-01T00:05:00Z',
    })

    response = client.get(
        '/research/history/latest', query_string={'email': 'pm@gadventures.com'}, headers=api_headers
    )

    assert response.status_code == 200
    assert response.json['id'] == real_run['id']


def test_battlecards_route(client, api_headers):
    tenant = _make_tenant()
    competitor = competitor_repository.create({
        'tenant_id': tenant['id'], 'name': 'Intrepid', 'website': 'https://intrepidtravel.com',
        'catalogue_url': 'https://intrepidtravel.com/adventures', 'primary_market': 'GB', 'active': True,
    })
    battlecard_repository.upsert(competitor['id'], {'tenant_id': tenant['id'], 'content': 'x', 'content_json': {}})

    response = client.post('/battlecards', json={'email': 'pm@gadventures.com'}, headers=api_headers)

    assert response.status_code == 200
    assert response.json[0]['competitor_name'] == 'Intrepid'


def test_comparable_trips_route(client, api_headers):
    tenant = _make_tenant()
    comparable_repository.create({'tenant_id': tenant['id'], 'client_product': 'x', 'similarity_score': 0.8})

    response = client.post('/comparable-trips', json={'email': 'pm@gadventures.com'}, headers=api_headers)

    assert response.status_code == 200
    assert len(response.json) == 1


# ── Alerts ─────────────────────────────────────────────────────────

def test_get_alerts_requires_session(client, api_headers):
    response = client.get('/alerts', headers=api_headers)
    assert response.status_code == 401


def test_get_alerts_returns_recent_for_session_tenant(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    alert_repository.create({'tenant_id': tenant['id'], 'alert_type': 'price_change', 'message': 'x'})
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.get('/alerts', headers=api_headers)

    assert response.status_code == 200
    assert len(response.json) == 1


def test_get_alerts_unread_only(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    alert_repository.create({'tenant_id': tenant['id'], 'alert_type': 'price_change', 'message': 'x', 'read': True})
    alert_repository.create({'tenant_id': tenant['id'], 'alert_type': 'new_product', 'message': 'y', 'read': False})
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.get('/alerts', query_string={'unread_only': 'true'}, headers=api_headers)

    assert response.status_code == 200
    assert len(response.json) == 1
    assert response.json[0]['message'] == 'y'


def test_mark_alert_read_requires_session(client, api_headers):
    response = client.patch('/alerts/a1/read', headers=api_headers)
    assert response.status_code == 401


def test_mark_alert_read_unknown_alert_404(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])
    response = client.patch('/alerts/does-not-exist/read', headers=api_headers)
    assert response.status_code == 404


def test_mark_alert_read_rejects_other_tenants_alert(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    other_tenant = _make_tenant(domain='otherco.com', email='pm@otherco.com')
    alert = alert_repository.create({'tenant_id': other_tenant['id'], 'alert_type': 'price_change', 'message': 'x'})
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.patch(f'/alerts/{alert["id"]}/read', headers=api_headers)

    assert response.status_code == 403


def test_mark_alert_read_success(client, api_headers, monkeypatch):
    tenant = _make_tenant()
    alert = alert_repository.create({'tenant_id': tenant['id'], 'alert_type': 'price_change', 'message': 'x'})
    monkeypatch.setattr('api.auth_service.get_tenant_id_from_request', lambda req: tenant['id'])

    response = client.patch(f'/alerts/{alert["id"]}/read', headers=api_headers)

    assert response.status_code == 200
    assert response.json['read'] is True


def test_preview_prompt(client, api_headers, monkeypatch):
    _install_fake_module(
        monkeypatch, 'industries.adventure_travel.prompt',
        build_prompt=lambda *a, **k: 'a fake built prompt'
    )
    response = client.post('/preview-prompt', json={
        'productName': 'Inca Trail', 'destination': 'Peru', 'duration': 15, 'travelStyle': 'Classic',
    }, headers=api_headers)
    assert response.status_code == 200
    assert response.json['prompt'] == 'a fake built prompt'


# ── Auth password reset proxy routes ────────────────────────────────

def test_request_password_reset_missing_email(client, api_headers):
    response = client.post('/auth/request-password-reset', json={}, headers=api_headers)
    assert response.status_code == 400


def test_request_password_reset_ok(client, api_headers, monkeypatch):
    monkeypatch.setattr('api.requests.post', lambda *a, **k: types.SimpleNamespace(status_code=204))
    response = client.post(
        '/auth/request-password-reset', json={'email': 'pm@gadventures.com'}, headers=api_headers
    )
    assert response.status_code == 200


def test_confirm_password_reset_missing_fields(client, api_headers):
    response = client.post('/auth/confirm-password-reset', json={'token': 'x'}, headers=api_headers)
    assert response.status_code == 400


def test_confirm_password_reset_invalid_token(client, api_headers, monkeypatch):
    monkeypatch.setattr('api.requests.post', lambda *a, **k: types.SimpleNamespace(status_code=400))
    response = client.post('/auth/confirm-password-reset', json={
        'token': 'bad', 'password': 'newpass123', 'passwordConfirm': 'newpass123',
    }, headers=api_headers)
    assert response.status_code == 400
    assert response.json['code'] == 'reset_failed'


def test_confirm_password_reset_ok(client, api_headers, monkeypatch):
    monkeypatch.setattr('api.requests.post', lambda *a, **k: types.SimpleNamespace(status_code=200))
    response = client.post('/auth/confirm-password-reset', json={
        'token': 'good', 'password': 'newpass123', 'passwordConfirm': 'newpass123',
    }, headers=api_headers)
    assert response.status_code == 200


# ── Stripe webhook ──────────────────────────────────────────────────

def test_stripe_webhook_invalid_signature_rejected(client, monkeypatch):
    import stripe as stripe_module

    def _raise(*a, **k):
        raise ValueError('bad signature')

    monkeypatch.setattr(stripe_module.Webhook, 'construct_event', staticmethod(_raise))

    response = client.post(
        '/stripe/webhook', data=b'{}', headers={'Stripe-Signature': 'bad'}
    )
    assert response.status_code == 400
    assert response.json['code'] == 'invalid_signature'


def test_stripe_webhook_dispatches_checkout_completed(client, monkeypatch):
    import stripe as stripe_module
    tenant = _make_tenant()

    fake_event = {
        'type': 'checkout.session.completed',
        'data': {'object': {
            'metadata': {'tenant_id': tenant['id'], 'target_tier': 'discover'},
            'subscription': 'sub_1',
        }},
    }
    monkeypatch.setattr(stripe_module.Webhook, 'construct_event', staticmethod(lambda *a, **k: fake_event))

    response = client.post('/stripe/webhook', data=b'{}', headers={'Stripe-Signature': 'ok'})

    assert response.status_code == 200
    assert tenant_repository.get_by_id(tenant['id'])['tier'] == 'discover'


def test_stripe_webhook_dispatches_subscription_deleted(client, monkeypatch):
    import stripe as stripe_module
    tenant = _make_tenant(stripe_customer_id='cus_123')

    fake_event = {
        'type': 'customer.subscription.deleted',
        'data': {'object': {'customer': 'cus_123'}},
    }
    monkeypatch.setattr(stripe_module.Webhook, 'construct_event', staticmethod(lambda *a, **k: fake_event))

    response = client.post('/stripe/webhook', data=b'{}', headers={'Stripe-Signature': 'ok'})

    assert response.status_code == 200
    assert tenant_repository.get_by_id(tenant['id'])['status'] == 'inactive'


def test_stripe_webhook_unhandled_event_type_ok(client, monkeypatch):
    import stripe as stripe_module
    fake_event = {'type': 'invoice.paid', 'data': {'object': {}}}
    monkeypatch.setattr(stripe_module.Webhook, 'construct_event', staticmethod(lambda *a, **k: fake_event))

    response = client.post('/stripe/webhook', data=b'{}', headers={'Stripe-Signature': 'ok'})
    assert response.status_code == 200