const Fastify = require("fastify");

const employeesRoutes = require("../../../src/routes/employees");
const { resolvePermissionsForRoles } = require("../../../src/constants/permissions");
const { AppError } = require("../../../src/utils/AppError");

async function buildApp({ permissionCodes = ["system.users"], stats } = {}) {
  const app = Fastify();
  const employeeGroupBy = vi
    .fn()
    .mockResolvedValueOnce([
      { employment_status: "active", _count: { _all: 8 } },
      { employment_status: "probation", _count: { _all: 2 } },
    ])
    .mockResolvedValueOnce([
      { department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", _count: { _all: 6 } },
      { department_id: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", _count: { _all: 4 } },
    ]);
  const employeeCount = vi.fn().mockResolvedValueOnce(3).mockResolvedValueOnce(1);
  const departmentFindMany = vi.fn().mockResolvedValue([
    { id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", name: "行政部" },
    { id: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", name: "研发部" },
  ]);
  const contractCount = vi.fn().mockResolvedValue(2);
  const certificateGroupBy = vi.fn().mockResolvedValue([
    { employee_id: "emp-1" },
    { employee_id: "emp-2" },
    { employee_id: "emp-3" },
  ]);
  const certificateCount = vi.fn().mockResolvedValue(4);
  const performanceCycleFindFirst = vi
    .fn()
    .mockResolvedValueOnce({
      id: "cycle-active",
      name: "2026 Q2",
      cycle_type: "quarterly",
      status: "active",
      start_date: new Date("2026-04-01T00:00:00.000Z"),
      end_date: new Date("2026-06-30T00:00:00.000Z"),
    })
    .mockResolvedValueOnce({
      id: "cycle-completed",
      name: "2026 Q1",
      cycle_type: "quarterly",
      status: "completed",
      start_date: new Date("2026-01-01T00:00:00.000Z"),
      end_date: new Date("2026-03-31T00:00:00.000Z"),
    });
  const performanceReviewAggregate = vi.fn().mockResolvedValue({
    _avg: { overall_score: 4.2 },
    _count: { _all: 5 },
  });
  const performanceReviewGroupBy = vi.fn().mockResolvedValue([
    { overall_score: 4, _count: { _all: 3 } },
    { overall_score: 4.5, _count: { _all: 2 } },
  ]);
  const payslipAggregate = vi
    .fn()
    .mockResolvedValueOnce({
      _sum: { net_amount: 18800 },
      _avg: { net_amount: 9400 },
      _count: { _all: 2 },
    })
    .mockResolvedValueOnce({
      _sum: { net_amount: 17600 },
      _avg: { net_amount: 8800 },
      _count: { _all: 2 },
    });

  app.decorate("prisma", {
    employee: {
      groupBy: stats?.employeeGroupBy ?? employeeGroupBy,
      count: stats?.employeeCount ?? employeeCount,
      findMany: vi.fn().mockResolvedValue([]),
      findUnique: vi.fn().mockResolvedValue(null),
    },
    department: {
      findMany: stats?.departmentFindMany ?? departmentFindMany,
    },
    employeeContract: {
      count: stats?.employeeContractCount ?? contractCount,
      findMany: vi.fn().mockResolvedValue([]),
    },
    employeeCertificate: {
      groupBy: stats?.employeeCertificateGroupBy ?? certificateGroupBy,
      count: stats?.employeeCertificateCount ?? certificateCount,
      findMany: vi.fn().mockResolvedValue([]),
    },
    performanceReviewCycle: {
      findFirst: stats?.performanceReviewCycleFindFirst ?? performanceCycleFindFirst,
    },
    performanceReview: {
      aggregate: stats?.performanceReviewAggregate ?? performanceReviewAggregate,
      groupBy: stats?.performanceReviewGroupBy ?? performanceReviewGroupBy,
    },
    payslip: {
      aggregate: stats?.payslipAggregate ?? payslipAggregate,
    },
  });
  app.decorate("authenticate", async (request) => {
    request.employee = {
      id: "actor-1",
      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
      permissionCodes,
      roleCodes: [],
    };
  });
  app.decorate("requirePermission", (permissionCode) => async (request) => {
    request.employee = {
      id: "actor-1",
      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
      permissionCodes,
      roleCodes: [],
    };
    if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
    }
  });
  app.decorate("hasPermission", (employee, permissionCode) => {
    const codes = employee.permissionCodes ?? [];
    return codes.includes("*") || codes.includes(permissionCode);
  });
  app.decorate("config", { appTimezone: "Asia/Shanghai" });
  app.setErrorHandler((error, request, reply) => {
    reply
      .status(error.statusCode || 500)
      .send({ code: error.code || "ERR", message: error.message, details: error.details ?? null });
  });

  await app.register(employeesRoutes, { prefix: "/api" });
  return {
    app,
    employeeGroupBy,
    employeeCount,
    departmentFindMany,
    contractCount,
    certificateGroupBy,
    certificateCount,
    performanceCycleFindFirst,
    performanceReviewAggregate,
    performanceReviewGroupBy,
    payslipAggregate,
  };
}

describe("employees stats route", () => {
  it("returns aggregated employee stats for read-only viewers without salary or performance data", async () => {
    const {
      app,
      employeeGroupBy,
      employeeCount,
      departmentFindMany,
      contractCount,
      certificateGroupBy,
      certificateCount,
      performanceCycleFindFirst,
      performanceReviewAggregate,
      performanceReviewGroupBy,
      payslipAggregate,
    } = await buildApp({
      permissionCodes: ["report.dashboard.view"],
    });

    const response = await app.inject({
      method: "GET",
      url: "/api/employees/stats",
    });

    expect(response.statusCode).toBe(200);
    const payload = response.json();
    expect(payload.data.employmentStatusSummary.total).toBe(10);
    expect(payload.data.departmentHeadcount).toEqual([
      { departmentId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", departmentName: "行政部", count: 6 },
      { departmentId: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", departmentName: "研发部", count: 4 },
    ]);
    expect(payload.data.recentMovements.hires).toBe(3);
    expect(payload.data.recentMovements.departures).toBe(1);
    expect(payload.data.expiringContracts.count).toBe(2);
    expect(payload.data.certificateSummary).toEqual({
      dateFrom: payload.data.asOfDate,
      dateTo: expect.any(String),
      validHolderCount: 3,
      expiringSoonCount: 4,
    });
    expect(payload.data.performanceSummary).toEqual({
      cycle: null,
      averageScore: null,
      reviewedCount: 0,
      distribution: [],
    });
    expect(payload.data.salarySummary).toBeNull();
    expect(employeeGroupBy).toHaveBeenCalledTimes(2);
    expect(employeeCount).toHaveBeenCalledTimes(2);
    expect(departmentFindMany).toHaveBeenCalledTimes(1);
    expect(contractCount).toHaveBeenCalledTimes(1);
    expect(certificateGroupBy).toHaveBeenCalledTimes(1);
    expect(certificateCount).toHaveBeenCalledTimes(1);
    expect(performanceCycleFindFirst).not.toHaveBeenCalled();
    expect(performanceReviewAggregate).not.toHaveBeenCalled();
    expect(performanceReviewGroupBy).not.toHaveBeenCalled();
    expect(payslipAggregate).not.toHaveBeenCalled();

    await app.close();
  });

  it("does not expose sensitive summaries to system administrators with ordinary stats access", async () => {
    const {
      app,
      performanceCycleFindFirst,
      performanceReviewAggregate,
      performanceReviewGroupBy,
      payslipAggregate,
    } = await buildApp({
      permissionCodes: [
        ...resolvePermissionsForRoles(["system_admin"]),
        "report.dashboard.view",
      ],
    });

    const response = await app.inject({
      method: "GET",
      url: "/api/employees/stats",
    });

    expect(response.statusCode).toBe(200);
    expect(response.json().data.salarySummary).toBeNull();
    expect(response.json().data.performanceSummary).toEqual({
      cycle: null,
      averageScore: null,
      reviewedCount: 0,
      distribution: [],
    });
    expect(performanceCycleFindFirst).not.toHaveBeenCalled();
    expect(performanceReviewAggregate).not.toHaveBeenCalled();
    expect(performanceReviewGroupBy).not.toHaveBeenCalled();
    expect(payslipAggregate).not.toHaveBeenCalled();

    await app.close();
  });

  it("returns salary and performance summaries with explicit sensitive permissions", async () => {
    const {
      app,
      performanceCycleFindFirst,
      performanceReviewAggregate,
      performanceReviewGroupBy,
      payslipAggregate,
    } = await buildApp({
      permissionCodes: [
        "report.dashboard.view",
        "payroll.manage",
        "system.users_sensitive",
      ],
    });

    const response = await app.inject({
      method: "GET",
      url: "/api/employees/stats",
    });

    expect(response.statusCode).toBe(200);
    expect(response.json().data.salarySummary).toEqual({
      currentMonth: {
        month: expect.any(String),
        totalNetAmount: 18800,
        averageNetAmount: 9400,
        issuedCount: 2,
      },
      previousMonth: {
        month: expect.any(String),
        totalNetAmount: 17600,
        averageNetAmount: 8800,
        issuedCount: 2,
      },
    });
    expect(response.json().data.performanceSummary.cycle).toMatchObject({
      id: "cycle-active",
      name: "2026 Q2",
    });
    expect(performanceCycleFindFirst).toHaveBeenCalledTimes(2);
    expect(performanceReviewAggregate).toHaveBeenCalledTimes(1);
    expect(performanceReviewGroupBy).toHaveBeenCalledTimes(1);
    expect(payslipAggregate).toHaveBeenCalledTimes(2);

    await app.close();
  });

  it("rejects requests without people directory permission", async () => {
    const { app } = await buildApp({ permissionCodes: ["employee"] });

    const response = await app.inject({
      method: "GET",
      url: "/api/employees/stats",
    });

    expect(response.statusCode).toBe(403);

    await app.close();
  });
});