const MODULE = 'supplemental-boundaries'
const OPTIONS = { scenario: 'admin-boundary-automation', deploymentBlocker: true }

function id(value) { return value == null ? '' : String(value) }
function codeOf(response) { return response?.body?.code == null ? 'missing' : String(response.body.code) }
function failure(response) {
  return [400, 401, 403, 404, 409].includes(response?.http)
    || (response?.http === 200 && codeOf(response) !== '200')
}
function missingRoute(response) {
  return response?.http === 404 || response?.http === 405
    || /Not Found|No handler|No static resource/i.test(String(response?.raw || response?.body?.message || ''))
}

async function multipart(context, path, bytes, fileName, contentType = 'application/octet-stream') {
  const form = new FormData()
  form.append('file', new Blob([bytes], { type: contentType }), fileName)
  try {
    const response = await fetch(`${context.options.gateway}${path}`, {
      method: 'POST', headers: { Accept: 'application/json', Authorization: `Bearer ${context.token}` },
      body: form, signal: AbortSignal.timeout(60_000),
    })
    const content = await response.text()
    let body = null
    try { body = content ? JSON.parse(content) : null } catch { /* bounded raw evidence below */ }
    return {
      method: 'POST', path, http: response.status, body,
      raw: body === null ? content.slice(0, 500) : null,
      requestId: body?.requestId || response.headers.get('x-request-id'),
      traceId: body?.traceId || response.headers.get('x-trace-id'),
    }
  } catch (error) {
    return { method: 'POST', path, http: 0, body: null, raw: String(error), requestId: null, traceId: null }
  }
}

function warehousePayload(context, suffix) {
  return {
    tenantId: 0, warehouseCode: `BW${suffix}`, warehouseName: `边界验收仓-${suffix}`,
    warehouseType: 'DOMESTIC', countryCode: 'CN', timezone: 'Asia/Shanghai',
    contactName: '边界验收员', contactPhone: '13800000003', contactEmail: `boundary-${suffix}@example.com`,
    status: 'ACTIVE', remark: context.marker,
    address: { addressType: 'WAREHOUSE', countryCode: 'CN', stateProvince: '广东省', city: '深圳市', district: '南山区', postalCode: '518000', addressLine1: '边界验收地址', addressLine2: null, latitude: null, longitude: null },
    capabilities: [{ capabilityCode: 'RECEIVING', capabilityName: '收货', enabled: true, cutoffTime: '16:00:00', description: context.marker }],
  }
}

export async function run(context) {
  const start = context.steps.length
  const suffix = context.marker.replace(/\D/g, '').slice(-12)
  let warehouseId = ''
  let locationId = ''
  let warehousePayloadValue
  let locationPayload
  let locationVersion = 0

  // Create only marker-owned warehouse/location resources for the one
  // executable optimistic-lock scenario. Pallets and master-data records have
  // no version field in the public DTO, so they are not falsely claimed here.
  warehousePayloadValue = warehousePayload(context, suffix)
  const createWarehouse = await context.request('POST', '/api/platform/v1/warehouse-admin', warehousePayloadValue)
  warehouseId = id(context.apiSuccess(MODULE, '创建边界验收隔离仓库', createWarehouse, '', OPTIONS))
  if (warehouseId) {
    locationPayload = {
      warehouseId, zoneCode: `BZ${suffix.slice(-5)}`, zoneName: '边界区',
      locationCode: `BL${suffix}`, locationName: '边界库位', locationType: 'SHELF',
      maxWeightKg: 1000, status: 'AVAILABLE', remark: context.marker,
    }
    const createLocation = await context.request('POST', '/api/platform/v1/locations?tenantId=0', locationPayload)
    locationId = id(context.apiSuccess(MODULE, '创建边界验收隔离库位', createLocation, '', OPTIONS))
  }
  if (locationId) {
    const locationPath = `/api/platform/v1/locations/${locationId}?tenantId=0&warehouseId=${warehouseId}`
    const detail = await context.request('GET', locationPath)
    const data = context.apiSuccess(MODULE, '读取隔离库位版本', detail, '', OPTIONS)
    locationVersion = Number(data?.location?.version)
    const firstUpdate = await context.request('PUT', locationPath, { ...locationPayload, locationName: `${locationPayload.locationName}-编辑`, version: locationVersion })
    context.apiSuccess(MODULE, '更新隔离库位以推进版本', firstUpdate, `version=${locationVersion}`, OPTIONS)
    const stale = await context.request('PUT', locationPath, { ...locationPayload, locationName: `${locationPayload.locationName}-STALE`, version: locationVersion })
    const conflict = stale.http === 200 && ['A0409', '409'].includes(codeOf(stale))
    context.addStep(MODULE, '库位旧 version PUT 返回冲突', stale, conflict, `HTTP=${stale.http}, code=${codeOf(stale)}`, OPTIONS)
    const after = await context.request('GET', locationPath)
    const afterData = context.apiSuccess(MODULE, '冲突后回查库位', after, '', OPTIONS)
    context.assert(MODULE, '库位冲突未造成部分更新', after,
      afterData?.location?.locationName === `${locationPayload.locationName}-编辑`, `name=${afterData?.location?.locationName || 'missing'}`, OPTIONS)
    locationVersion = Number(afterData?.location?.version)
  }

  // phase3-loading has already created and rebound a marker-owned live
  // occupancy. Reuse that exact location to prove deletion protection without
  // touching historical resources or inventing a setup-only API.
  const loading = context.createdResources?.phase3Loading
  const occupiedLocationId = id(loading?.inventoryMutationCleanup?.targetLocationId)
  const occupiedWarehouseId = id(loading?.warehouseId)
  context.assert(MODULE, '取得本轮装柜链真实占用库位', null,
    Boolean(occupiedLocationId && occupiedWarehouseId && loading?.marker === context.marker),
    `locationId=${occupiedLocationId || 'missing'}, warehouseId=${occupiedWarehouseId || 'missing'}`, OPTIONS)
  if (occupiedLocationId && occupiedWarehouseId && loading?.marker === context.marker) {
    const occupiedPath = `/api/platform/v1/locations/${occupiedLocationId}?tenantId=0&warehouseId=${occupiedWarehouseId}`
    const occupiedDetail = await context.request('GET', occupiedPath)
    const occupied = context.apiSuccess(MODULE, '读取本轮真实占用库位版本', occupiedDetail, '', OPTIONS)
    const occupiedVersion = Number(occupied?.location?.version)
    const rejectedDelete = await context.request('DELETE', `${occupiedPath}&version=${occupiedVersion}`)
    context.addStep(MODULE, '真实占用库位删除返回A0409且保留资源', rejectedDelete,
      rejectedDelete.http === 200 && ['A0409', '409'].includes(codeOf(rejectedDelete)),
      `HTTP=${rejectedDelete.http}, code=${codeOf(rejectedDelete)}, version=${occupiedVersion}`, OPTIONS)
    const occupiedAfter = await context.request('GET', occupiedPath)
    const after = context.apiSuccess(MODULE, '删除冲突后回查占用库位', occupiedAfter, '', OPTIONS)
    context.assert(MODULE, '占用删除冲突未造成资源丢失', occupiedAfter,
      id(after?.location?.id) === occupiedLocationId,
      `expected=${occupiedLocationId}, actual=${id(after?.location?.id) || 'missing'}`, OPTIONS)
  }

  // Import boundary probes use only in-memory bytes and dry-run where supported.
  const bogusXlsx = new Uint8Array([0x50, 0x4b, 0x03, 0x04, 0x00, 0x00])
  const empty = new Uint8Array()
  const probes = [
    ['仓库空文件', '/api/platform/v1/warehouse-admin/import?tenantId=0&dryRun=true', empty, `${context.marker}.xlsx`],
    ['仓库缺列伪 XLSX', '/api/platform/v1/warehouse-admin/import?tenantId=0&dryRun=true', bogusXlsx, `${context.marker}-missing.xlsx`],
    ['快递公司错误扩展名', '/api/platform/v1/express-companies/import?tenantId=0', new TextEncoder().encode(context.marker), `${context.marker}.txt`],
    ['往来单位非 XLSX', '/api/platform/v1/partners/import?tenantId=0', new TextEncoder().encode(context.marker), `${context.marker}.txt`],
  ]
  for (const [name, path, bytes, fileName] of probes) {
    const response = await multipart(context, path, bytes, fileName)
    context.addStep(MODULE, `${name}安全失败且不模拟导入成功`, response, failure(response),
      `HTTP=${response.http}, code=${codeOf(response)}, bytes=${bytes.length}`, { scenario: 'import-boundaries', deploymentBlocker: missingRoute(response) })
  }

  // Invalid customer/price routes and authentication boundaries are read-only.
  const invalidFee = await context.request('GET', '/api/platform/v1/iam/tenants/999999999999999999/overseas-storage-fees')
  context.addStep(MODULE, '错误客户海外仓费用 ID 安全失败', invalidFee, failure(invalidFee),
    `HTTP=${invalidFee.http}, code=${codeOf(invalidFee)}`, OPTIONS)
  for (const [name, path] of [
    ['库位列表未授权', '/api/platform/v1/locations?page=1&size=1&tenantId=0'],
    ['下载中心非法页码', '/api/platform/v1/files/export-tasks?page=0&size=1'],
    ['船期价格非法状态', '/api/platform/v1/fba-pricing/carrier-rates/price-books?status=INVALID'],
  ]) {
    const response = await context.request('GET', path, undefined, name.includes('未授权') ? '' : context.token)
    const passed = name.includes('未授权') ? response.http === 401 : failure(response)
    context.addStep(MODULE, `${name}边界响应正确`, response, passed, `HTTP=${response.http}, code=${codeOf(response)}`, OPTIONS)
  }

  if (locationId) {
    const disable = await context.request('PATCH', `/api/platform/v1/locations/${locationId}/status?tenantId=0&warehouseId=${warehouseId}`, { status: 'DISABLED', version: locationVersion })
    context.apiSuccess(MODULE, '停用隔离库位以便清理', disable, '', OPTIONS)
    const remove = await context.request('DELETE', `/api/platform/v1/locations/${locationId}?tenantId=0&warehouseId=${warehouseId}&version=${locationVersion + 1}`)
    context.apiSuccess(MODULE, '删除隔离库位', remove, '', OPTIONS)
  }
  if (warehouseId) {
    const disableWarehouse = await context.request('PATCH', `/api/platform/v1/warehouse-admin/${warehouseId}/status?tenantId=0&status=INACTIVE`)
    context.apiSuccess(MODULE, '停用隔离仓库', disableWarehouse, '', OPTIONS)
  }

  const steps = context.steps.slice(start)
  context.scenarios.push({ name: 'admin-boundary-automation', module: MODULE, success: steps.every((step) => step.passed), deploymentBlocked: steps.some((step) => step.deploymentBlocker), passed: steps.filter((step) => step.passed).length, failed: steps.filter((step) => !step.passed).length })
}