"""Phase 2C — Core document resolver + internal execution plans. No HTTP/state flips."""
from __future__ import annotations

from uuid import uuid4

from src.domain.codegen.prompt_wrapper import _app_recipes
from src.domain.connectors.document_resolve import (
    DispatchAuthorization,
    DocumentConnectionSnapshot,
    invoke_document,
    map_document_capability_input,
    normalize_logical_document,
    provider_document_id_for_alias,
    public_result_is_capability_shaped,
    resolve_document,
    to_public_document_result,
)
from src.domain.connectors.invoke_capabilities import (
    DOCUMENT_CREATE_POST_CREATE_BINDING,
    DOCUMENT_FAMILY_PHASE_2C,
    DOCUMENT_FAMILY_RESOLVER_DESIGN,
    DOCUMENT_FROZEN_VERBS,
    is_implemented,
)
from src.domain.connectors.public_gateway import (
    PHASE_2C_STATUS,
    PHASE_2D_STATUS,
    PHASE_2E_STATUS,
    PUBLIC_INVOCABLE_CAPABILITIES,
)
from src.domain.manifest.service import _connectors_manifest_envelope

_CAPS = {"integrations.execute"}
_DOC = {"document": "proposal"}
_GOOGLE_ID = "1aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789abc"


def _docs(**overrides) -> DocumentConnectionSnapshot:
    data = dict(
        connection_id=uuid4(),
        connector_key="google_docs",
        status="active",
        has_secrets=True,
        permission_mode="allow",
        config={"document": "proposal", "document_id": _GOOGLE_ID},
        requires_secrets=True,
        client_side_only=False,
    )
    data.update(overrides)
    return DocumentConnectionSnapshot(**data)


def test_phase_2c_is_complete_without_runtime_flips() -> None:
    assert PHASE_2C_STATUS == "complete"
    assert PHASE_2D_STATUS == "complete"
    assert PHASE_2E_STATUS == "complete"
    phase = DOCUMENT_FAMILY_PHASE_2C
    assert phase["resolver"] is True
    assert phase["catalog_invocable"] is False
    assert phase["implements_attached"] is False
    assert phase["codegen_default"] is False
    assert phase["core_private_invoke_http"] is False
    assert phase["create_does_not_persist_binding"] is True
    assert phase["resolver_eligibility_is_not_execution_authorization"] is True
    assert phase["next_slice"] == "2f_document_runtime_truth"
    design = DOCUMENT_FAMILY_RESOLVER_DESIGN
    assert design["resolver"] is True
    assert design["create_does_not_persist_binding"] is True
    assert DOCUMENT_CREATE_POST_CREATE_BINDING["blocks_2c"] is False
    assert DOCUMENT_CREATE_POST_CREATE_BINDING["status"] == "deferred"
    for verb in DOCUMENT_FROZEN_VERBS:
        assert is_implemented(verb) is True
        assert verb in PUBLIC_INVOCABLE_CAPABILITIES
    envelope = _connectors_manifest_envelope(items={})
    for verb in DOCUMENT_FROZEN_VERBS:
        cap = envelope["capabilities"][verb]
        assert cap["method"] is not None
    assert "capabilities/document." in _app_recipes()


def test_catalog_invocable_gate_allows_resolve_when_true() -> None:
    result = resolve_document(
        capability="document.get",
        payload=_DOC,
        connections=[_docs()],
        enabled_capabilities=_CAPS,
        enforce_invocable=True,
    )
    assert result.reason_code != "capability_not_invocable"
    assert result.ok is True


def test_logical_document_rejects_google_ids() -> None:
    assert normalize_logical_document("proposal") == "proposal"
    assert normalize_logical_document(_GOOGLE_ID) is None
    assert normalize_logical_document("https://docs.google.com/document/d/x") is None
    assert provider_document_id_for_alias(
        {"document": "proposal", "document_id": _GOOGLE_ID},
        "proposal",
    ) == _GOOGLE_ID
    assert provider_document_id_for_alias(
        {"document": "proposal", "document_id": _GOOGLE_ID},
        "other",
    ) is None


def test_get_plan_maps_alias_to_provider_document_id() -> None:
    row = _docs()
    result = resolve_document(
        capability="document.get",
        payload={"document": "proposal", "metadata": {"order_id": "9"}},
        connections=[row],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert result.ok is True
    assert result.plan is not None
    assert result.plan.action == "google_docs.get_document"
    assert result.plan.resolved_input == {"document_id": _GOOGLE_ID}
    payload = result.plan.integration_execute_payload()
    assert payload["request_type"] == "integration.execute"
    assert payload["action"] == "google_docs.get_document"


def test_append_insert_replace_mappings() -> None:
    row = _docs()
    append = resolve_document(
        capability="document.append_text",
        payload={"document": "proposal", "text": "more"},
        connections=[row],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert append.plan is not None
    assert append.plan.action == "google_docs.append_text"
    assert append.plan.resolved_input == {"document_id": _GOOGLE_ID, "text": "more"}
    insert = resolve_document(
        capability="document.insert_text",
        payload={"document": "proposal", "text": "hi"},
        connections=[row],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert insert.plan is not None
    assert insert.plan.action == "google_docs.insert_text"
    assert insert.plan.resolved_input == {
        "document_id": _GOOGLE_ID,
        "text": "hi",
        "index": 1,
    }
    replace = resolve_document(
        capability="document.replace_text",
        payload={"document": "proposal", "find": "OLD", "replace": "NEW"},
        connections=[row],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert replace.plan is not None
    assert replace.plan.action == "google_docs.replace_all_text"
    assert replace.plan.resolved_input == {
        "document_id": _GOOGLE_ID,
        "find": "OLD",
        "replace": "NEW",
    }
    assert "match_case" not in replace.plan.resolved_input


def test_insert_end_is_position_invalid() -> None:
    result = resolve_document(
        capability="document.insert_text",
        payload={"document": "proposal", "text": "hi", "position": "end"},
        connections=[_docs()],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert result.reason_code == "position_invalid"


def test_unique_connection_without_alias_is_document_unbound() -> None:
    result = resolve_document(
        capability="document.get",
        payload=_DOC,
        connections=[_docs(config={"document_id": _GOOGLE_ID})],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert result.ok is False
    assert result.reason_code == "document_unbound"


def test_document_map_binds_without_config_alias() -> None:
    row = _docs(config={"document_map": {"proposal": _GOOGLE_ID}})
    result = resolve_document(
        capability="document.get",
        payload=_DOC,
        connections=[row],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert result.ok is True
    assert result.plan is not None
    assert result.plan.resolved_input["document_id"] == _GOOGLE_ID


def test_project_document_map_selects_connection() -> None:
    unbound = _docs(config={"document_id": _GOOGLE_ID})
    bound = _docs(config={"document": "proposal", "document_id": "doc-bound"})
    result = resolve_document(
        capability="document.get",
        payload=_DOC,
        connections=[unbound, bound],
        enabled_capabilities=_CAPS,
        document_map={"proposal": bound.connection_id},
        enforce_invocable=False,
    )
    assert result.ok is True
    assert result.plan is not None
    assert result.plan.connection_id == bound.connection_id
    assert result.plan.resolved_input["document_id"] == "doc-bound"


def test_two_google_docs_without_alias_are_ambiguous() -> None:
    result = resolve_document(
        capability="document.get",
        payload=_DOC,
        connections=[
            _docs(config={"document_id": "a"}),
            _docs(config={"document_id": "b"}),
        ],
        enabled_capabilities=_CAPS,
        provider_hint="google_docs",
        enforce_invocable=False,
    )
    assert result.reason_code == "binding_ambiguous"


def test_provider_hint_does_not_pick_among_google_docs() -> None:
    a = _docs()
    b = _docs()
    result = resolve_document(
        capability="document.get",
        payload=_DOC,
        connections=[a, b],
        enabled_capabilities=_CAPS,
        provider_hint="google_docs",
        enforce_invocable=False,
    )
    assert result.reason_code == "binding_ambiguous"


def test_explicit_binding_selects_one_account() -> None:
    a = _docs()
    b = _docs()
    result = resolve_document(
        capability="document.get",
        payload=_DOC,
        connections=[a, b],
        enabled_capabilities=_CAPS,
        binding_connection_id=b.connection_id,
        enforce_invocable=False,
    )
    assert result.ok is True
    assert result.plan is not None
    assert result.plan.connection_id == b.connection_id


def test_create_uses_unique_eligible_connection_without_document_resource() -> None:
    row = _docs(config={})
    result = resolve_document(
        capability="document.create",
        payload={"title": "Proposal"},
        connections=[row],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert result.ok is True
    assert result.plan is not None
    assert result.plan.action == "google_docs.create_document"
    assert result.plan.resolved_input == {"title": "Proposal"}
    assert result.plan.document is None
    assert result.diagnostics["create_does_not_persist_binding"] is True


def test_create_two_connections_are_ambiguous() -> None:
    result = resolve_document(
        capability="document.create",
        payload={"title": "Proposal"},
        connections=[_docs(config={}), _docs(config={})],
        enabled_capabilities=_CAPS,
        provider_hint="google_docs",
        enforce_invocable=False,
    )
    assert result.reason_code == "binding_ambiguous"


def test_calendar_is_not_a_document_candidate() -> None:
    calendar = DocumentConnectionSnapshot(
        connection_id=uuid4(),
        connector_key="google_calendar",
        status="active",
        has_secrets=True,
        permission_mode="allow",
        config={"document": "proposal", "document_id": _GOOGLE_ID},
    )
    result = resolve_document(
        capability="document.get",
        payload=_DOC,
        connections=[calendar],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert result.reason_code == "capability_not_bound"


def test_provider_fields_on_capability_input_are_forbidden() -> None:
    result = resolve_document(
        capability="document.get",
        payload={"document": "proposal", "document_id": _GOOGLE_ID},
        connections=[_docs()],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert result.reason_code == "provider_fields_forbidden"
    insert = resolve_document(
        capability="document.insert_text",
        payload={"document": "proposal", "text": "hi", "index": 12},
        connections=[_docs()],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert insert.reason_code == "provider_fields_forbidden"
    replace = resolve_document(
        capability="document.replace_text",
        payload={"document": "proposal", "find": "a", "match_case": True},
        connections=[_docs()],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    assert replace.reason_code == "provider_fields_forbidden"


def test_public_result_hides_google_ids() -> None:
    resolution = resolve_document(
        capability="document.get",
        payload=_DOC,
        connections=[_docs()],
        enabled_capabilities=_CAPS,
        enforce_invocable=False,
    )
    public = to_public_document_result(
        resolution, capability="document.get", enqueue={"ok": True, "job_id": "job_1"}
    )
    body = public.as_dict()
    assert public_result_is_capability_shaped(body)
    assert body == {
        "capability": "document.get",
        "status": "queued",
    }
    assert "document_ref" not in body
    assert _GOOGLE_ID not in str(body)
    rejected = to_public_document_result(
        resolution, capability="document.get"
    ).as_dict()
    assert rejected["status"] == "rejected"
    assert rejected["reason_code"] == "provider_unavailable"


def test_dispatch_rechecks_authorization_separately() -> None:
    allowed = invoke_document(
        capability="document.get",
        payload=_DOC,
        connections=[_docs()],
        enabled_capabilities=_CAPS,
        authorize=DispatchAuthorization(allowed=True),
        enforce_invocable=False,
    )
    assert allowed.ok is True
    denied = invoke_document(
        capability="document.get",
        payload=_DOC,
        connections=[_docs()],
        enabled_capabilities=_CAPS,
        authorize=DispatchAuthorization(
            allowed=False, reason_code="connector_action_denied", message="no"
        ),
        enforce_invocable=False,
    )
    assert denied.ok is False
    assert denied.reason_code == "connector_action_denied"


def test_map_helpers_omit_provider_specifics() -> None:
    mapped = map_document_capability_input(
        "document.replace_text",
        document_id=_GOOGLE_ID,
        payload={"find": "a"},
    )
    assert mapped == {"document_id": _GOOGLE_ID, "find": "a"}
    assert "match_case" not in mapped