"""Platform support journeys with synthetic records and provider failures."""
from dataclasses import replace
from urllib.parse import urlencode
from user_engine.domain import AuditRecord, OutboxEvent, utc_now
from test_journey_roles import JourneyFixture, TENANT, OTHER
from test_web import invoke

class PlatformSupportJourneys(JourneyFixture):
    def seed(self):
        self.app.service.store.append_audit(AuditRecord(audit_id="audit-support", actor=self.actor,
            action="tenant.account.update", subject="person", tenant=TENANT,
            correlation_id="support-123", summary="private-audit-summary"))
        self.app.service.store.append_outbox(OutboxEvent(event_id="support-delivery", event_type="notification.requested",
            aggregate_id="person", tenant=TENANT, correlation_id="support-123",
            payload={"private":"private-payload"}, failed_at=utc_now(), failure_reason="private-provider-error"))

    def test_operator_correlates_actions_and_delivery_without_raw_content(self):
        self.seed()
        self.app.service.store.append_outbox(OutboxEvent(event_id="unrelated", event_type="private-unrelated",
            aggregate_id="other", tenant=OTHER, correlation_id="different", payload={}))
        response,body=invoke(self.app,"/platform/activity",cookie="ue_session=operator",query="reference=support-123")
        self.assertEqual("200 OK",response["status"])
        for value in [b"tenant.account.update",b"notification.requested",b"Inspect delivery",b"support-delivery",b"Delivery failed"]:
            self.assertIn(value,body)
        for value in [b"private-audit-summary",b"private-payload",b"private-provider-error",b"private-unrelated"]:
            self.assertNotIn(value,body)
        self.assertIn(b"external outcome is unverified",body)

    def test_activity_denies_nonoperators_and_mutations(self):
        self.seed()
        for who in ["member","admin"]:
            response,body=invoke(self.app,"/platform/activity",cookie="ue_session="+who)
            self.assertEqual("403 Forbidden",response["status"])
            self.assertNotIn(b"support-delivery",body)
        response,_=self.post("/platform/activity",who="operator")
        self.assertEqual("404 Not Found",response["status"])

    def test_exact_filters_apply_before_display_limit_and_missing_is_explicit(self):
        self.seed()
        for i in range(105):
            self.app.service.store.append_outbox(OutboxEvent(event_id="noise-"+str(i),event_type="noise",
                aggregate_id="other",tenant=OTHER,correlation_id="noise",payload={}))
        response,body=invoke(self.app,"/platform/activity",cookie="ue_session=operator",
            query=urlencode({"reference":"support-123","tenant":TENANT}))
        self.assertEqual("200 OK",response["status"])
        self.assertIn(b"support-delivery",body)
        self.assertIn(b"Showing 2 of 2",body)
        for query in ["reference=support",urlencode({"reference":"support-123","tenant":OTHER})]:
            _,body=invoke(self.app,"/platform/activity",cookie="ue_session=operator",query=query)
            self.assertIn(b"No matching records",body)
            self.assertNotIn(b"support-delivery",body)

    def test_filter_values_are_escaped_and_bounded(self):
        response,body=invoke(self.app,"/platform/activity",cookie="ue_session=operator",query=urlencode({"reference":"<script>alert(1)</script>"}))
        self.assertEqual("200 OK",response["status"])
        self.assertIn(b"&lt;script&gt;",body);self.assertNotIn(b"<script>",body)
        response,_=invoke(self.app,"/platform/activity",cookie="ue_session=operator",query="reference="+"x"*201)
        self.assertEqual("400 Bad Request",response["status"])

    def test_recovery_denied_before_preview_and_operator_sees_factor_boundary(self):
        user=self.member(role="tenant-admin")
        path=f"/admin/{TENANT}/users/{user.user_id}/recover"
        response,body=self.post(path,who="admin")
        self.assertEqual("403 Forbidden",response["status"])
        self.assertNotIn(b"Confirm change",body)
        response,body=self.post(path,who="operator")
        self.assertEqual("200 OK",response["status"])
        self.assertIn(b"does not reset a password",body)
        self.assertIn(b"cannot bypass",body)
        self.assertEqual([],self.app.provisioning.actions)

    def test_service_capabilities_distinguish_configuration_from_health(self):
        self.app.provisioning=None;self.app.tenant_management=None;self.app.outbox_delivery=None
        response,body=invoke(self.app,"/platform/operations",cookie="ue_session=operator")
        self.assertEqual("200 OK",response["status"])
        self.assertIn(b"Configured; live health unverified",body)
        self.assertIn(b"Unavailable in this portal",body)
        self.assertIn(b"assisted password setup",body)
        self.assertIn(b"Review authentication policy",body)