using System.IO.Compression;
using System.Net;
using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Reflection;
using System.Text.Json;
using MiaoJiZhang.Api.Controllers;
using MiaoJiZhang.Api.Services;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.AspNetCore.TestHost;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.DependencyInjection.Extensions;
using Testcontainers.MySql;

namespace MiaoJiZhang.Api.Tests;

[CollectionDefinition(Name)]
public sealed class ApiCollection : ICollectionFixture<ApiFixture>
{
    public const string Name = "api";
}

public sealed class ApiFixture : IAsyncLifetime
{
    private const string AdminUsername = "test_admin";
    private const string BootstrapPassword = "test-bootstrap-password-123";
    private const string AdminPassword = "test-permanent-password-456";
    private readonly MySqlContainer _database = new MySqlBuilder("mysql:8.4")
        .WithDatabase("miaoji_test")
        .WithUsername("miaoji_test")
        .WithPassword("miaoji_test_password")
        .WithCleanUp(true)
        .Build();

    public WebApplicationFactory<Program> Factory { get; private set; } = null!;

    public async Task InitializeAsync()
    {
        await _database.StartAsync();
        Environment.SetEnvironmentVariable(
            "ConnectionStrings__Default",
            _database.GetConnectionString());
        Environment.SetEnvironmentVariable(
            "Jwt__Secret",
            "test-only-jwt-secret-at-least-thirty-two-characters");
        Environment.SetEnvironmentVariable("Admin__BootstrapUsername", AdminUsername);
        Environment.SetEnvironmentVariable("Admin__BootstrapPassword", BootstrapPassword);
        Environment.SetEnvironmentVariable("Admin__CookieSecure", "false");
        Environment.SetEnvironmentVariable(
            "Push__TokenEncryptionKey",
            Convert.ToBase64String(Enumerable.Range(1, 32).Select(value => (byte)value).ToArray()));
        Environment.SetEnvironmentVariable("RateLimiting__AuthPermitLimit", "1000");

        Factory = new WebApplicationFactory<Program>().WithWebHostBuilder(
            builder =>
            {
                builder.UseEnvironment("Development");
                builder.ConfigureTestServices(services =>
                {
                    services.RemoveAll<ILlmClient>();
                    services.AddSingleton<ILlmClient, NullLlmClient>();
                });
            });
        using var client = Factory.CreateClient();
        var ping = await client.GetAsync("/api/ping");
        ping.EnsureSuccessStatusCode();
        await BootstrapAdminAsync();
    }

    public async Task DisposeAsync()
    {
        Factory?.Dispose();
        await _database.DisposeAsync();
        Environment.SetEnvironmentVariable("ConnectionStrings__Default", null);
        Environment.SetEnvironmentVariable("Jwt__Secret", null);
        Environment.SetEnvironmentVariable("Admin__BootstrapUsername", null);
        Environment.SetEnvironmentVariable("Admin__BootstrapPassword", null);
        Environment.SetEnvironmentVariable("Admin__CookieSecure", null);
        Environment.SetEnvironmentVariable("Push__TokenEncryptionKey", null);
        Environment.SetEnvironmentVariable("RateLimiting__AuthPermitLimit", null);
    }

    public async Task<HttpClient> RegisterAsync(string username)
    {
        var client = Factory.CreateClient();
        var response = await client.PostAsJsonAsync(
            "/api/auth/register",
            new { username, password = "test-password-123", agreedToTerms = true });
        response.EnsureSuccessStatusCode();
        var payload = await response.Content.ReadFromJsonAsync<JsonElement>();
        client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
            "Bearer",
            payload.GetProperty("token").GetString());
        return client;
    }

    public async Task<HttpClient> AdminAsync()
    {
        var client = Factory.CreateClient();
        var login = await client.PostAsJsonAsync(
            "/api/admin/auth/login",
            new { username = AdminUsername, password = AdminPassword });
        login.EnsureSuccessStatusCode();
        var payload = await login.Content.ReadFromJsonAsync<JsonElement>();
        client.DefaultRequestHeaders.Add(
            AdminSessionService.CsrfHeader,
            payload.GetProperty("csrfToken").GetString());
        return client;
    }

    private async Task BootstrapAdminAsync()
    {
        using var client = Factory.CreateClient();
        var login = await client.PostAsJsonAsync(
            "/api/admin/auth/login",
            new { username = AdminUsername, password = BootstrapPassword });
        login.EnsureSuccessStatusCode();
        var payload = await login.Content.ReadFromJsonAsync<JsonElement>();
        client.DefaultRequestHeaders.Add(
            AdminSessionService.CsrfHeader,
            payload.GetProperty("csrfToken").GetString());
        var changed = await client.PutAsJsonAsync(
            "/api/admin/auth/password",
            new { currentPassword = BootstrapPassword, newPassword = AdminPassword });
        changed.EnsureSuccessStatusCode();
    }
}

[Collection(ApiCollection.Name)]
public sealed class ApiIntegrationTests(ApiFixture fixture)
{
    [Fact]
    public async Task PublicRuntimeDefaults_AreAvailableForProductionFlows()
    {
        using var publicClient = fixture.Factory.CreateClient();
        var avatars = await publicClient.GetFromJsonAsync<JsonElement>(
            "/api/public/avatars");
        var personas = await publicClient.GetFromJsonAsync<JsonElement>(
            "/api/public/personas");

        Assert.Contains(avatars.EnumerateArray(), item =>
            item.GetProperty("key").GetString() == "cat");
        Assert.Contains(personas.EnumerateArray(), item =>
            item.GetProperty("key").GetString() == "sassy_cat");

        using var user = await fixture.RegisterAsync("runtime_defaults_user");
        foreach (var type in new[] { "expense", "income" })
        {
            var categories = await user.GetFromJsonAsync<JsonElement>(
                $"/api/categories?type={type}");
            Assert.Contains(categories.EnumerateArray(), item =>
                item.GetProperty("name").GetString() == "其他");
        }
    }

    [Fact]
    public async Task DataIsolation_TimeZone_Recycle_Budget_AndExport_WorkTogether()
    {
        using var owner = await fixture.RegisterAsync("owner_account");
        using var stranger = await fixture.RegisterAsync("stranger_account");

        var ledgers = await owner.GetFromJsonAsync<JsonElement>("/api/ledgers");
        var ledgerId = ledgers[0].GetProperty("id").GetInt64();
        var incomeCategories = await owner.GetFromJsonAsync<JsonElement>(
            "/api/categories?type=income");
        var expenseCategories = await owner.GetFromJsonAsync<JsonElement>(
            "/api/categories?type=expense");
        var incomeCategoryId = incomeCategories[0].GetProperty("id").GetInt64();
        var expenseCategoryId = expenseCategories[0].GetProperty("id").GetInt64();

        var forbiddenLedger = await stranger.PutAsJsonAsync(
            $"/api/ledgers/{ledgerId}/default",
            new { });
        Assert.Equal(HttpStatusCode.NotFound, forbiddenLedger.StatusCode);

        var mismatch = await owner.PostAsJsonAsync(
            "/api/transactions",
            new
            {
                ledgerId,
                categoryId = expenseCategoryId,
                type = "income",
                amount = 100,
                occurredAt = "2026-06-30T16:30:00Z",
            });
        Assert.Equal(HttpStatusCode.BadRequest, mismatch.StatusCode);

        var createdResponse = await owner.PostAsJsonAsync(
            "/api/transactions",
            new
            {
                ledgerId,
                categoryId = incomeCategoryId,
                type = "income",
                amount = 100,
                note = "跨月收入",
                occurredAt = "2026-06-30T16:30:00Z",
            });
        createdResponse.EnsureSuccessStatusCode();
        var created = await createdResponse.Content.ReadFromJsonAsync<JsonElement>();
        var transactionId = created.GetProperty("id").GetInt64();

        var july = await owner.GetFromJsonAsync<JsonElement>(
            $"/api/transactions/month?year=2026&month=7&ledgerId={ledgerId}");
        Assert.Equal(1, july.GetProperty("count").GetInt32());
        Assert.Equal(100m, july.GetProperty("income").GetDecimal());
        Assert.Equal(0m, july.GetProperty("expense").GetDecimal());
        var persistedOccurredAt = july.GetProperty("days")[0]
            .GetProperty("items")[0]
            .GetProperty("occurredAt")
            .GetString();
        Assert.EndsWith("Z", persistedOccurredAt, StringComparison.Ordinal);

        var recurringBudget = await owner.PutAsJsonAsync(
            $"/api/budgets?year=2026&month=7&ledgerId={ledgerId}",
            new
            {
                categoryId = expenseCategoryId,
                amount = 800,
                recurring = true,
            });
        recurringBudget.EnsureSuccessStatusCode();
        var augustBudget = await owner.GetFromJsonAsync<JsonElement>(
            $"/api/budgets?year=2026&month=8&ledgerId={ledgerId}");
        Assert.True(
            augustBudget.GetProperty("categories")[0]
                .GetProperty("isRecurring")
                .GetBoolean());

        var delete = await owner.DeleteAsync(
            $"/api/transactions/{transactionId}");
        Assert.Equal(HttpStatusCode.NoContent, delete.StatusCode);
        var recycle = await owner.GetFromJsonAsync<JsonElement>(
            $"/api/transactions/recycle-bin?ledgerId={ledgerId}");
        Assert.Single(recycle.EnumerateArray());

        var restore = await owner.PostAsync(
            $"/api/transactions/{transactionId}/restore",
            null);
        restore.EnsureSuccessStatusCode();
        recycle = await owner.GetFromJsonAsync<JsonElement>(
            $"/api/transactions/recycle-bin?ledgerId={ledgerId}");
        Assert.Empty(recycle.EnumerateArray());

        var export = await owner.GetByteArrayAsync("/api/users/me/export");
        using var archive = new ZipArchive(new MemoryStream(export));
        Assert.Contains(archive.Entries, entry => entry.Name == "transactions.csv");
        Assert.Contains(archive.Entries, entry => entry.Name == "budgets.csv");
        var backupEntry = Assert.Single(
            archive.Entries, entry => entry.Name == "backup.json");
        using var reader = new StreamReader(backupEntry.Open());
        var backup = await reader.ReadToEndAsync();
        Assert.DoesNotContain(
            "passwordHash",
            backup,
            StringComparison.OrdinalIgnoreCase);
        Assert.DoesNotContain(
            "apiKey",
            backup,
            StringComparison.OrdinalIgnoreCase);
    }

    [Fact]
    public async Task AccountClosure_RevokesOldToken_AndLoginCancelsDuringGracePeriod()
    {
        using var client = await fixture.RegisterAsync("closure_account");
        var closure = await client.PostAsJsonAsync(
            "/api/users/me/closure",
            new
            {
                password = "test-password-123",
                confirmationText = "注销账号",
            });
        Assert.Equal(HttpStatusCode.Accepted, closure.StatusCode);

        var oldSession = await client.GetAsync("/api/users/me");
        Assert.Equal(HttpStatusCode.Unauthorized, oldSession.StatusCode);

        using var restored = fixture.Factory.CreateClient();
        var login = await restored.PostAsJsonAsync(
            "/api/auth/login",
            new
            {
                username = "closure_account",
                password = "test-password-123",
            });
        login.EnsureSuccessStatusCode();
        var payload = await login.Content.ReadFromJsonAsync<JsonElement>();
        Assert.True(payload.GetProperty("accountClosureCancelled").GetBoolean());
        restored.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
            "Bearer",
            payload.GetProperty("token").GetString());
        Assert.Equal(
            HttpStatusCode.OK,
            (await restored.GetAsync("/api/users/me")).StatusCode);
    }

    [Fact]
    public async Task CategoryReorder_RejectsUnknownIcons_AndReportsUseLedgerPeriod()
    {
        using var client = await fixture.RegisterAsync("report_account");
        var ledgers = await client.GetFromJsonAsync<JsonElement>("/api/ledgers");
        var ledgerId = ledgers[0].GetProperty("id").GetInt64();

        var invalid = await client.PostAsJsonAsync(
            "/api/categories",
            new { name = "未知图标", iconKey = "not-real", type = "expense" });
        Assert.Equal(HttpStatusCode.BadRequest, invalid.StatusCode);

        async Task<long> CreateCategory(string name, string iconKey)
        {
            var response = await client.PostAsJsonAsync(
                "/api/categories",
                new { name, iconKey, type = "expense" });
            response.EnsureSuccessStatusCode();
            return (await response.Content.ReadFromJsonAsync<JsonElement>())
                .GetProperty("id").GetInt64();
        }

        var firstId = await CreateCategory("养车", "car");
        var secondId = await CreateCategory("宠物", "pet");
        var reorder = await client.PutAsJsonAsync(
            "/api/categories/reorder",
            new { type = "expense", categoryIds = new[] { secondId, firstId } });
        Assert.Equal(HttpStatusCode.NoContent, reorder.StatusCode);
        var categories = await client.GetFromJsonAsync<JsonElement>(
            "/api/categories?type=expense");
        var customIds = categories.EnumerateArray()
            .Where(item => item.GetProperty("isCustom").GetBoolean())
            .Select(item => item.GetProperty("id").GetInt64())
            .ToArray();
        Assert.Equal(new[] { secondId, firstId }, customIds);

        var weekly = await client.GetAsync(
            $"/api/reports/weekly?date=2026-07-19&ledgerId={ledgerId}");
        weekly.EnsureSuccessStatusCode();
        var yearly = await client.GetAsync(
            $"/api/reports/yearly?year=2026&ledgerId={ledgerId}");
        yearly.EnsureSuccessStatusCode();
    }
    [Fact]
    public async Task RegistrationDefaultAndUserAiPermission_AreEnforcedImmediately()
    {
        async Task SetDefaultAsync(bool enabled)
        {
            await using var scope = fixture.Factory.Services.CreateAsyncScope();
            var db = scope.ServiceProvider.GetRequiredService<
                MiaoJiZhang.Infrastructure.Persistence.AppDbContext>();
            var config = await db.AppConfigs.SingleAsync(item =>
                item.Key == "permission.default.ai_enabled");
            config.Value = enabled ? "true" : "false";
            config.Version++;
            config.UpdatedAt = DateTime.UtcNow;
            await db.SaveChangesAsync();
        }

        await SetDefaultAsync(false);
        try
        {
            using var client = await fixture.RegisterAsync("permission_default_off");
            var profile = await client.GetFromJsonAsync<JsonElement>("/api/users/me");
            Assert.False(
                profile.GetProperty("permissions").GetProperty("ai").GetBoolean());

            var denied = await client.PostAsJsonAsync(
                "/api/chat/messages",
                new { content = "本月花了多少" });
            Assert.Equal(HttpStatusCode.Forbidden, denied.StatusCode);
            var error = await denied.Content.ReadFromJsonAsync<JsonElement>();
            Assert.Equal(
                "AI_PERMISSION_DENIED",
                error.GetProperty("code").GetString());
        }
        finally
        {
            await SetDefaultAsync(true);
        }
    }

    [Fact]
    public async Task AiChatQuota_IsBoundToUserAndUsesConfiguredPeriod()
    {
        using var client = await fixture.RegisterAsync("ai_quota_account");
        var profile = await client.GetFromJsonAsync<JsonElement>("/api/users/me");
        var userId = profile.GetProperty("userId").GetInt64();

        using var admin = await fixture.AdminAsync();
        var update = await admin.PutAsJsonAsync(
            $"/api/admin/users/{userId}/ai-quota",
            new { limit = 1, period = "week", resetUsage = true });
        update.EnsureSuccessStatusCode();

        var first = await client.PostAsJsonAsync(
            "/api/chat/messages",
            new { content = "本周花了多少" });
        first.EnsureSuccessStatusCode();

        var denied = await client.PostAsJsonAsync(
            "/api/chat/messages",
            new { content = "再查一次本周支出" });
        Assert.Equal(HttpStatusCode.TooManyRequests, denied.StatusCode);
        var error = await denied.Content.ReadFromJsonAsync<JsonElement>();
        Assert.Equal(
            "AI_CHAT_QUOTA_EXCEEDED",
            error.GetProperty("code").GetString());
        Assert.Equal(
            "week",
            error.GetProperty("quota").GetProperty("period").GetString());

        profile = await client.GetFromJsonAsync<JsonElement>("/api/users/me");
        var quota = profile.GetProperty("aiChatQuota");
        Assert.Equal(1, quota.GetProperty("limit").GetInt32());
        Assert.Equal(1, quota.GetProperty("used").GetInt32());
        Assert.Equal(0, quota.GetProperty("remaining").GetInt32());
        Assert.Equal("week", quota.GetProperty("period").GetString());
    }

    [Fact]
    public async Task RecognitionClientRequestId_IsIdempotentAcrossConcurrentChannels()
    {
        using var client = await fixture.RegisterAsync("recognition_idempotency");
        var ledgers = await client.GetFromJsonAsync<JsonElement>("/api/ledgers");
        var ledgerId = ledgers[0].GetProperty("id").GetInt64();
        var categories = await client.GetFromJsonAsync<JsonElement>(
            "/api/categories?type=expense");
        var categoryId = categories[0].GetProperty("id").GetInt64();
        const string clientRequestId = "wx-order-20260721-001";
        var payload = new
        {
            ledgerId,
            categoryId,
            type = "expense",
            amount = 28.50m,
            note = "微信支付",
            occurredAt = "2026-07-21T10:30:00+08:00",
            source = "local_ocr",
            clientRequestId,
        };

        var responses = await Task.WhenAll(
            client.PostAsJsonAsync("/api/transactions", payload),
            client.PostAsJsonAsync("/api/transactions", payload));
        Assert.All(responses, response => response.EnsureSuccessStatusCode());

        var created = await Task.WhenAll(
            responses.Select(response =>
                response.Content.ReadFromJsonAsync<JsonElement>()));
        Assert.Equal(
            created[0].GetProperty("id").GetInt64(),
            created[1].GetProperty("id").GetInt64());
        Assert.Equal("local_ocr", created[0].GetProperty("source").GetString());

        var month = await client.GetFromJsonAsync<JsonElement>(
            $"/api/transactions/month?year=2026&month=7&ledgerId={ledgerId}");
        Assert.Equal(1, month.GetProperty("count").GetInt32());
    }

    [Fact]
    public async Task RecognitionBatch_PreservesThreeConsecutiveTransfers_AndIsIdempotent()
    {
        using var client = await fixture.RegisterAsync("recognition_batch_transfers");
        var ledgers = await client.GetFromJsonAsync<JsonElement>("/api/ledgers");
        var ledgerId = ledgers[0].GetProperty("id").GetInt64();
        var categories = await client.GetFromJsonAsync<JsonElement>(
            "/api/categories?type=expense");
        var categoryId = categories[0].GetProperty("id").GetInt64();
        var batchId = Guid.NewGuid().ToString();
        var payload = new
        {
            batchId,
            ledgerId,
            items = new[]
            {
                new
                {
                    candidateId = "transfer-1",
                    clientRequestId = "recognition-wechat-flow-1",
                    categoryId,
                    type = "transfer",
                    amount = 20m,
                    note = "转账给张三",
                    paymentMethod = "微信",
                    occurredAt = "2026-07-25T10:00:01+08:00",
                    source = "recognition_ai",
                    sourceText = "微信转账成功",
                    transferDirection = "out",
                    counterparty = "张三",
                    provider = "wechat",
                    providerTransactionId = "wx-transfer-order-1",
                    recognitionOccurrenceId = "wx-transfer-flow-1",
                },
                new
                {
                    candidateId = "transfer-2",
                    clientRequestId = "recognition-wechat-flow-2",
                    categoryId,
                    type = "transfer",
                    amount = 20m,
                    note = "转账给张三",
                    paymentMethod = "微信",
                    occurredAt = "2026-07-25T10:00:10+08:00",
                    source = "recognition_ai",
                    sourceText = "微信转账成功",
                    transferDirection = "out",
                    counterparty = "张三",
                    provider = "wechat",
                    providerTransactionId = "wx-transfer-order-2",
                    recognitionOccurrenceId = "wx-transfer-flow-2",
                },
                new
                {
                    candidateId = "transfer-3",
                    clientRequestId = "recognition-wechat-flow-3",
                    categoryId,
                    type = "transfer",
                    amount = 30m,
                    note = "转账给张三",
                    paymentMethod = "微信",
                    occurredAt = "2026-07-25T10:00:20+08:00",
                    source = "recognition_ai",
                    sourceText = "微信转账成功",
                    transferDirection = "out",
                    counterparty = "张三",
                    provider = "wechat",
                    providerTransactionId = "wx-transfer-order-3",
                    recognitionOccurrenceId = "wx-transfer-flow-3",
                },
            },
        };

        var responses = await Task.WhenAll(
            client.PostAsJsonAsync("/api/transactions/recognition-batch", payload),
            client.PostAsJsonAsync("/api/transactions/recognition-batch", payload));
        Assert.All(responses, response => response.EnsureSuccessStatusCode());
        var results = await Task.WhenAll(
            responses.Select(response => response.Content.ReadFromJsonAsync<JsonElement>()));
        var first = results[0];
        var retry = results[1];
        Assert.Equal(3, first.GetArrayLength());
        Assert.Equal(3, retry.GetArrayLength());
        Assert.Equal(
            first.EnumerateArray()
                .Select(item => item.GetProperty("transaction").GetProperty("id").GetInt64()),
            retry.EnumerateArray()
                .Select(item => item.GetProperty("transaction").GetProperty("id").GetInt64()));

        var month = await client.GetFromJsonAsync<JsonElement>(
            $"/api/transactions/month?year=2026&month=7&ledgerId={ledgerId}");
        Assert.Equal(3, month.GetProperty("count").GetInt32());
        Assert.Equal(70m, month.GetProperty("expense").GetDecimal());
        Assert.All(
            month.GetProperty("days")[0].GetProperty("items").EnumerateArray(),
            item =>
            {
                Assert.Equal("transfer", item.GetProperty("type").GetString());
                Assert.Equal("out", item.GetProperty("transferDirection").GetString());
                Assert.Equal("张三", item.GetProperty("counterparty").GetString());
            });
    }

    [Fact]
    public async Task TransferDirections_AffectStatisticsAndBudgets_AndRecognitionIdsAreIdempotent()
    {
        using var client = await fixture.RegisterAsync("transfer_semantics");
        var ledgers = await client.GetFromJsonAsync<JsonElement>("/api/ledgers");
        var ledgerId = ledgers[0].GetProperty("id").GetInt64();
        var expenseCategories = await client.GetFromJsonAsync<JsonElement>(
            "/api/categories?type=expense");
        var incomeCategories = await client.GetFromJsonAsync<JsonElement>(
            "/api/categories?type=income");
        var expenseCategoryId = expenseCategories[0].GetProperty("id").GetInt64();
        var incomeCategoryId = incomeCategories[0].GetProperty("id").GetInt64();

        var totalBudget = await client.PutAsJsonAsync(
            $"/api/budgets?year=2026&month=7&ledgerId={ledgerId}",
            new { categoryId = (long?)null, amount = 100m });
        totalBudget.EnsureSuccessStatusCode();
        var categoryBudget = await client.PutAsJsonAsync(
            $"/api/budgets?year=2026&month=7&ledgerId={ledgerId}",
            new { categoryId = expenseCategoryId, amount = 80m });
        categoryBudget.EnsureSuccessStatusCode();

        var transferOut = new
        {
            ledgerId,
            categoryId = expenseCategoryId,
            type = "transfer",
            transferDirection = "out",
            counterparty = "李四",
            amount = 40m,
            occurredAt = "2026-07-25T11:00:00+08:00",
            source = "accessibility",
            clientRequestId = "wx-event-out-a",
            provider = "wechat",
            providerTransactionId = "wx-order-out-001",
            recognitionOccurrenceId = "wx-occurrence-out-001",
        };
        var outResponse = await client.PostAsJsonAsync("/api/transactions", transferOut);
        outResponse.EnsureSuccessStatusCode();
        var outTransaction = await outResponse.Content.ReadFromJsonAsync<JsonElement>();

        var providerRetry = await client.PostAsJsonAsync(
            "/api/transactions",
            new
            {
                transferOut.ledgerId,
                transferOut.categoryId,
                transferOut.type,
                transferOut.transferDirection,
                transferOut.counterparty,
                transferOut.amount,
                transferOut.occurredAt,
                transferOut.source,
                clientRequestId = "wx-event-out-b",
                transferOut.provider,
                transferOut.providerTransactionId,
                recognitionOccurrenceId = "wx-occurrence-out-changed",
            });
        providerRetry.EnsureSuccessStatusCode();
        var retried = await providerRetry.Content.ReadFromJsonAsync<JsonElement>();
        Assert.Equal(
            outTransaction.GetProperty("id").GetInt64(),
            retried.GetProperty("id").GetInt64());

        var inResponse = await client.PostAsJsonAsync(
            "/api/transactions",
            new
            {
                ledgerId,
                categoryId = incomeCategoryId,
                type = "transfer",
                transferDirection = "in",
                counterparty = "李四",
                amount = 75m,
                occurredAt = "2026-07-25T11:05:00+08:00",
                source = "accessibility",
                clientRequestId = "wx-event-in-a",
                recognitionOccurrenceId = "wx-occurrence-in-001",
            });
        inResponse.EnsureSuccessStatusCode();
        var inTransaction = await inResponse.Content.ReadFromJsonAsync<JsonElement>();
        var occurrenceRetry = await client.PostAsJsonAsync(
            "/api/transactions",
            new
            {
                ledgerId,
                categoryId = incomeCategoryId,
                type = "transfer",
                transferDirection = "in",
                counterparty = "李四",
                amount = 75m,
                occurredAt = "2026-07-25T11:05:00+08:00",
                source = "accessibility",
                clientRequestId = "wx-event-in-b",
                recognitionOccurrenceId = "wx-occurrence-in-001",
            });
        occurrenceRetry.EnsureSuccessStatusCode();
        var occurrenceRetried = await occurrenceRetry.Content.ReadFromJsonAsync<JsonElement>();
        Assert.Equal(
            inTransaction.GetProperty("id").GetInt64(),
            occurrenceRetried.GetProperty("id").GetInt64());

        var month = await client.GetFromJsonAsync<JsonElement>(
            $"/api/transactions/month?year=2026&month=7&ledgerId={ledgerId}");
        Assert.Equal(2, month.GetProperty("count").GetInt32());
        Assert.Equal(40m, month.GetProperty("expense").GetDecimal());
        Assert.Equal(75m, month.GetProperty("income").GetDecimal());

        var stats = await client.GetFromJsonAsync<JsonElement>(
            $"/api/transactions/stats?year=2026&month=7&ledgerId={ledgerId}");
        Assert.Equal(40m, stats.GetProperty("totalExpense").GetDecimal());
        Assert.Equal(75m, stats.GetProperty("totalIncome").GetDecimal());

        var budgets = await client.GetFromJsonAsync<JsonElement>(
            $"/api/budgets?year=2026&month=7&ledgerId={ledgerId}");
        Assert.Equal(40m, budgets.GetProperty("total").GetProperty("spent").GetDecimal());
        var expenseBudget = Assert.Single(
            budgets.GetProperty("categories").EnumerateArray(),
            item => item.GetProperty("categoryId").GetInt64() == expenseCategoryId);
        Assert.Equal(40m, expenseBudget.GetProperty("spent").GetDecimal());
    }

    [Fact]
    public async Task AdminSessions_EnforceCsrfViewerRevocationAndAudit()
    {
        using var superAdmin = await fixture.AdminAsync();
        var suffix = Guid.NewGuid().ToString("N")[..10];
        var username = $"viewer_{suffix}";
        const string initialPassword = "init06";
        const string permanentPassword = "new006";
        var shortPasswordResponse = await superAdmin.PostAsJsonAsync(
            "/api/admin/security/accounts",
            new { username = $"{username}_short", password = "12345", role = "viewer" });
        Assert.Equal(HttpStatusCode.BadRequest, shortPasswordResponse.StatusCode);
        var createdResponse = await superAdmin.PostAsJsonAsync(
            "/api/admin/security/accounts",
            new { username, password = initialPassword, role = "viewer" });
        createdResponse.EnsureSuccessStatusCode();
        var created = await createdResponse.Content.ReadFromJsonAsync<JsonElement>();
        var viewerId = created.GetProperty("id").GetInt64();

        using var viewer = fixture.Factory.CreateClient();
        var login = await viewer.PostAsJsonAsync(
            "/api/admin/auth/login",
            new { username, password = initialPassword });
        login.EnsureSuccessStatusCode();
        var loginPayload = await login.Content.ReadFromJsonAsync<JsonElement>();
        Assert.True(loginPayload.GetProperty("mustChangePassword").GetBoolean());

        var missingCsrf = await viewer.PutAsJsonAsync(
            "/api/admin/auth/password",
            new { currentPassword = initialPassword, newPassword = permanentPassword });
        Assert.Equal(HttpStatusCode.Unauthorized, missingCsrf.StatusCode);

        viewer.DefaultRequestHeaders.Add(
            AdminSessionService.CsrfHeader,
            loginPayload.GetProperty("csrfToken").GetString());
        var changed = await viewer.PutAsJsonAsync(
            "/api/admin/auth/password",
            new { currentPassword = initialPassword, newPassword = permanentPassword });
        changed.EnsureSuccessStatusCode();
        var changedPayload = await changed.Content.ReadFromJsonAsync<JsonElement>();
        viewer.DefaultRequestHeaders.Remove(AdminSessionService.CsrfHeader);
        viewer.DefaultRequestHeaders.Add(
            AdminSessionService.CsrfHeader,
            changedPayload.GetProperty("csrfToken").GetString());

        Assert.Equal(
            HttpStatusCode.OK,
            (await viewer.GetAsync("/api/admin/dashboard")).StatusCode);
        var writeDenied = await viewer.PostAsJsonAsync(
            "/api/admin/configs",
            new { key = $"viewer.denied.{suffix}", value = "no" });
        Assert.Equal(HttpStatusCode.Forbidden, writeDenied.StatusCode);

        var revoked = await superAdmin.PostAsync(
            $"/api/admin/security/accounts/{viewerId}/revoke-sessions",
            null);
        Assert.Equal(HttpStatusCode.NoContent, revoked.StatusCode);
        Assert.Equal(
            HttpStatusCode.Unauthorized,
            (await viewer.GetAsync("/api/admin/dashboard")).StatusCode);

        var audit = await superAdmin.GetFromJsonAsync<JsonElement>(
            $"/api/admin/security/audit?username={username}");
        Assert.True(audit.GetProperty("total").GetInt32() >= 3);
        var entries = audit.GetProperty("list").EnumerateArray().ToList();
        Assert.Contains(entries, entry =>
            entry.GetProperty("action").GetString() == "post.api.admin.auth.login" &&
            entry.GetProperty("success").GetBoolean());
        Assert.Contains(entries, entry =>
            entry.GetProperty("path").GetString() == "/api/admin/configs" &&
            !entry.GetProperty("success").GetBoolean());
    }
}

public sealed class ChinaClockTests
{
    [Fact]
    public void ShanghaiMonthRange_MapsUtcBoundaryCorrectly()
    {
        var (start, end) = ChinaClock.MonthRangeUtc(2026, 7);
        Assert.Equal(
            new DateTime(2026, 6, 30, 16, 0, 0, DateTimeKind.Utc),
            start);
        Assert.Equal(
            new DateTime(2026, 7, 31, 16, 0, 0, DateTimeKind.Utc),
            end);
    }
    [Fact]
    public void ShanghaiWeekAndYearRanges_UseLocalCalendarBoundaries()
    {
        var (weekStart, weekEnd) = ChinaClock.WeekRangeUtc(
            new DateTime(2026, 7, 19));
        Assert.Equal(
            new DateTime(2026, 7, 12, 16, 0, 0, DateTimeKind.Utc),
            weekStart);
        Assert.Equal(
            new DateTime(2026, 7, 19, 16, 0, 0, DateTimeKind.Utc),
            weekEnd);

        var (yearStart, yearEnd) = ChinaClock.YearRangeUtc(2026);
        Assert.Equal(
            new DateTime(2025, 12, 31, 16, 0, 0, DateTimeKind.Utc),
            yearStart);
        Assert.Equal(
            new DateTime(2026, 12, 31, 16, 0, 0, DateTimeKind.Utc),
            yearEnd);
    }
}
public sealed class ImageParseResultTests
{
    private static readonly MethodInfo ParseMethod =
        typeof(OpenAiVisionClient).GetMethod(
            "ParseImageResults",
            BindingFlags.NonPublic | BindingFlags.Static)
        ?? throw new InvalidOperationException("Image parser not found");

    [Fact]
    public void FullTimes_AreParsedPerBill_AndDateOnlyFallsBack()
    {
        const string payload =
            """
            {
              "bills": [
                {
                  "type": "expense",
                  "amount": 18,
                  "categoryName": "饮品",
                  "note": "奶茶",
                  "occurredAt": "2026-07-18T14:30:00+08:00"
                },
                {
                  "type": "income",
                  "amount": 100,
                  "categoryName": "兼职",
                  "note": "稿费",
                  "occurredAt": "2026-07-17T09:15:00+08:00"
                },
                {
                  "type": "expense",
                  "amount": 30,
                  "categoryName": "餐饮",
                  "note": "午饭",
                  "occurredAt": "2026-07-16"
                }
              ]
            }
            """;

        var results = Assert.IsAssignableFrom<IReadOnlyList<ImageParseResult>>(
            ParseMethod.Invoke(null, [payload]));

        Assert.Equal(3, results.Count);
        Assert.Equal(
            new DateTime(2026, 7, 18, 6, 30, 0, DateTimeKind.Utc),
            results[0].OccurredAt);
        Assert.Equal(
            new DateTime(2026, 7, 17, 1, 15, 0, DateTimeKind.Utc),
            results[1].OccurredAt);
        Assert.Null(results[2].OccurredAt);
    }
}

public sealed class RecognitionBatchActionParserTests
{
    private static readonly MethodInfo ParseMethod =
        typeof(OpenAiVisionClient).GetMethod(
            "ParseRecognitionBatchActions",
            BindingFlags.NonPublic | BindingFlags.Static)
        ?? throw new InvalidOperationException("Recognition batch parser not found");

    [Fact]
    public void Actions_AreParsedFromFencedJson_AndInvalidActionsAreIgnored()
    {
        const string payload =
            """
            result:
            ```json
            {
              "actions": [
                {
                  "action": "update",
                  "actionId": "a1",
                  "candidateId": "candidate-1",
                  "amount": 20,
                  "confidence": 1.4,
                  "reason": "修正金额"
                },
                {
                  "action": "merge",
                  "candidateId": "candidate-2"
                }
              ]
            }
            ```
            """;

        var actions = Assert.IsAssignableFrom<IReadOnlyList<RecognitionBatchModelAction>>(
            ParseMethod.Invoke(null, [payload]));

        var action = Assert.Single(actions);
        Assert.Equal("update", action.Action);
        Assert.Equal("candidate-1", action.CandidateId);
        Assert.Equal(20m, action.Amount);
        Assert.Equal(1, action.Confidence);
    }
}

public sealed class RecognitionAmountUpdateEvidenceTests
{
    private static readonly IReadOnlyDictionary<string, string?> EvidenceOwners =
        new Dictionary<string, string?>
        {
            ["evidence-a"] = "candidate-a",
            ["evidence-b"] = "candidate-b"
        };

    [Fact]
    public void AmountUpdateRequiresLinkedEvidenceAndHighConfidence()
    {
        Assert.False(ParseController.CanApplyAmountUpdate(
            "candidate-a", null, 0.99, EvidenceOwners));
        Assert.False(ParseController.CanApplyAmountUpdate(
            "candidate-a", "evidence-a", 0.89, EvidenceOwners));
        Assert.False(ParseController.CanApplyAmountUpdate(
            "candidate-a", "evidence-b", 0.99, EvidenceOwners));
        Assert.True(ParseController.CanApplyAmountUpdate(
            "candidate-a", "evidence-a", 0.9, EvidenceOwners));
    }
}

public sealed class BudgetRecommendationValidationTests
{
    [Fact]
    public void Draft_IsClampedToSpent_AndKeepsUnmentionedCategories()
    {
        var contexts =
            new Dictionary<long, BudgetRecommendationService.CategoryContext>
            {
                [1] = new(1, "餐饮", "food", "coral", 80, 120, "high"),
                [2] = new(2, "交通", "transport", "teal", 20, 60, "medium"),
            };
        var request = new MiaoJiZhang.Api.Contracts.RefineBudgetRecommendationRequest(
            null,
            2026,
            7,
            "餐饮降到十元，其他不变",
            new MiaoJiZhang.Api.Contracts.BudgetDraftRequest(
                150,
                [
                    new(1, 100),
                    new(2, 50),
                ]));
        const string arguments =
            """
            {
              "suggestedTotal": 20,
              "items": [
                { "categoryId": 1, "amount": 10 }
              ],
              "summary": "已降低餐饮预算"
            }
            """;

        var result = BudgetRecommendationService.ValidateToolDraft(
            request,
            contexts,
            new Dictionary<long, decimal> { [1] = 100, [2] = 50 },
            100,
            arguments,
            out var summary);

        Assert.Equal("已降低餐饮预算", summary);
        Assert.Equal(130, result.SuggestedTotal);
        Assert.Equal(80, result.Items.Single(item => item.CategoryId == 1).SuggestedAmount);
        Assert.Equal(50, result.Items.Single(item => item.CategoryId == 2).SuggestedAmount);
        Assert.Contains(result.Warnings!, warning => warning.Contains("不能低于已花"));
        Assert.Contains(result.Warnings!, warning => warning.Contains("保留原值"));
    }
}