cargo-upkeep 0.3.8

use reqwest::Client;
use serde::Deserialize;
use std::collections::{BTreeMap, BTreeSet, HashMap};
use std::sync::Arc;
use tokio::sync::{Mutex, Semaphore};
use tokio::time::{sleep, Duration};

use crate::core::error::{ErrorCode, Result, UpkeepError};
#[derive(Debug, Clone)]
pub struct VersionInfo {
    /// The crate name (kept for debugging and future use).
    #[allow(dead_code)]
    pub name: String,
    pub latest: Option<String>,
    /// The latest stable version (kept for future prerelease filtering).
    #[allow(dead_code)]
    pub latest_stable: Option<String>,
}

/// Per-crate outcomes from a registry lookup batch.
///
/// HTTP, status, decoding, and shared-infrastructure errors affect only the
/// names that were not already resolved. The outer [`Result`] is retained for
/// API compatibility; normal lookup and limiter failures are represented here.
#[derive(Debug)]
pub struct VersionLookupBatch {
    pub versions: HashMap<String, VersionInfo>,
    pub failures: BTreeMap<String, UpkeepError>,
}

#[derive(Clone)]
pub struct CratesIoClient {
    http: Client,
    cache: Arc<Mutex<HashMap<(String, bool), VersionInfo>>>,
    limiter: Arc<Semaphore>,
    base_url: String,
    rate_limit_delay: Duration,
}

impl CratesIoClient {
    pub fn new() -> Result<Self> {
        let http = Client::builder().user_agent("cargo-upkeep").build()?;

        Ok(Self {
            http,
            cache: Arc::new(Mutex::new(HashMap::new())),
            // crates.io rate limit: 1 request per second
            limiter: Arc::new(Semaphore::new(1)),
            base_url: "https://crates.io/api/v1".to_string(),
            rate_limit_delay: Duration::from_secs(1),
        })
    }

    #[cfg(test)]
    fn new_with_base_url(base_url: String, rate_limit_delay: Duration) -> Result<Self> {
        let http = Client::builder().user_agent("cargo-upkeep").build()?;

        Ok(Self {
            http,
            cache: Arc::new(Mutex::new(HashMap::new())),
            limiter: Arc::new(Semaphore::new(1)),
            base_url,
            rate_limit_delay,
        })
    }

    pub async fn fetch_latest_versions(
        &self,
        names: &[String],
        allow_prerelease: bool,
    ) -> Result<VersionLookupBatch> {
        let mut versions = HashMap::new();
        let mut failures = BTreeMap::new();
        let mut pending = Vec::new();
        let unique_names: BTreeSet<&String> = names.iter().collect();

        {
            let cache = self.cache.lock().await;
            for name in unique_names {
                let key = (name.clone(), allow_prerelease);
                if let Some(info) = cache.get(&key) {
                    versions.insert(name.clone(), info.clone());
                } else {
                    pending.push(name.clone());
                }
            }
        }

        let mut pending = pending.into_iter();
        while let Some(name) = pending.next() {
            // Acquire semaphore first to serialize API access
            let _permit = match self.limiter.acquire().await {
                Ok(permit) => permit,
                Err(err) => {
                    let detail = format!(
                        "rate limiter semaphore closed unexpectedly (this is a bug, please report it): {err}"
                    );
                    for failed_name in std::iter::once(name).chain(pending) {
                        failures.insert(
                            failed_name,
                            UpkeepError::message(ErrorCode::Concurrency, detail.clone()),
                        );
                    }
                    break;
                }
            };

            // Re-check cache after acquiring semaphore to avoid TOCTOU race condition:
            // Another task may have populated the cache while we were waiting
            {
                let cache = self.cache.lock().await;
                let key = (name.clone(), allow_prerelease);
                if let Some(info) = cache.get(&key) {
                    versions.insert(name.clone(), info.clone());
                    continue;
                }
            }

            match self.fetch_from_api_inner(&name, allow_prerelease).await {
                Ok(info) => {
                    versions.insert(name.clone(), info.clone());
                    let mut cache = self.cache.lock().await;
                    cache.insert((name, allow_prerelease), info);
                }
                Err(err) => {
                    failures.insert(name, err);
                }
            }
        }

        Ok(VersionLookupBatch { versions, failures })
    }

    /// Internal helper that fetches from API. Caller must hold the semaphore permit.
    async fn fetch_from_api_inner(
        &self,
        name: &str,
        allow_prerelease: bool,
    ) -> Result<VersionInfo> {
        // Rate limit: wait 1 second before making the request
        // This ensures we don't exceed crates.io rate limits (1 req/sec)
        sleep(self.rate_limit_delay).await;

        let url = format!("{}/crates/{name}", self.base_url);
        let response = self.http.get(&url).send().await.map_err(|err| {
            UpkeepError::context(
                ErrorCode::Http,
                format!("failed to fetch crate info from {url}"),
                err,
            )
        })?;
        let payload: CratesIoResponse = response
            .error_for_status()
            .map_err(|err| {
                UpkeepError::context(
                    ErrorCode::Http,
                    format!("HTTP error fetching {name} from crates.io"),
                    err,
                )
            })?
            .json()
            .await
            .map_err(|err| {
                UpkeepError::context(
                    ErrorCode::Json,
                    format!("failed to parse JSON response for {name}"),
                    err,
                )
            })?;

        let max_version = payload.krate.max_version;
        let max_stable_version = payload.krate.max_stable_version;

        // Determine the version to recommend based on prerelease preference
        let selected = if allow_prerelease {
            // When prereleases are allowed, prefer max_version (which includes prereleases),
            // falling back to max_stable_version if max_version is somehow missing
            max_version.clone().or_else(|| max_stable_version.clone())
        } else {
            // When prereleases are not allowed, prefer max_stable_version.
            // If no stable version exists (crate only has prereleases), fall back to
            // the prerelease version rather than returning None - this allows users
            // to see that an update exists, even if it's a prerelease.
            max_stable_version.clone().or_else(|| max_version.clone())
        };

        Ok(VersionInfo {
            name: name.to_string(),
            latest: selected,
            latest_stable: max_stable_version,
        })
    }
}

#[derive(Debug, Deserialize)]
struct CratesIoResponse {
    #[serde(rename = "crate")]
    krate: CratesIoCrate,
}

#[derive(Debug, Deserialize)]
struct CratesIoCrate {
    max_version: Option<String>,
    max_stable_version: Option<String>,
}

#[cfg(test)]
mod tests {
    use super::*;
    use httpmock::Method::GET;
    use httpmock::MockServer;
    use serde_json::json;

    fn test_client(base_url: String) -> CratesIoClient {
        CratesIoClient::new_with_base_url(base_url, Duration::from_secs(0)).expect("client")
    }

    #[tokio::test]
    async fn fetch_latest_versions_prefers_prerelease_when_allowed() {
        let server = MockServer::start();
        let mock = server.mock(|when, then| {
            when.method(GET).path("/crates/serde");
            then.status(200).json_body(json!({
                "crate": {
                    "max_version": "2.0.0-beta.1",
                    "max_stable_version": "1.0.190"
                }
            }));
        });

        let client = test_client(server.url(""));
        let result = client
            .fetch_latest_versions(&["serde".to_string()], true)
            .await
            .expect("fetch");

        let info = result.versions.get("serde").expect("serde info");
        assert_eq!(info.latest.as_deref(), Some("2.0.0-beta.1"));
        assert_eq!(info.latest_stable.as_deref(), Some("1.0.190"));
        mock.assert_calls(1);
    }

    #[tokio::test]
    async fn fetch_latest_versions_prefers_stable_when_prerelease_not_allowed() {
        let server = MockServer::start();
        let mock = server.mock(|when, then| {
            when.method(GET).path("/crates/tokio");
            then.status(200).json_body(json!({
                "crate": {
                    "max_version": "2.0.0-beta.1",
                    "max_stable_version": "1.35.1"
                }
            }));
        });

        let client = test_client(server.url(""));
        let result = client
            .fetch_latest_versions(&["tokio".to_string()], false)
            .await
            .expect("fetch");

        let info = result.versions.get("tokio").expect("tokio info");
        assert_eq!(info.latest.as_deref(), Some("1.35.1"));
        assert_eq!(info.latest_stable.as_deref(), Some("1.35.1"));
        mock.assert_calls(1);
    }

    #[tokio::test]
    async fn fetch_latest_versions_falls_back_to_prerelease_when_stable_missing() {
        let server = MockServer::start();
        let mock = server.mock(|when, then| {
            when.method(GET).path("/crates/alpha-only");
            then.status(200).json_body(json!({
                "crate": {
                    "max_version": "1.2.3-beta.1",
                    "max_stable_version": null
                }
            }));
        });

        let client = test_client(server.url(""));
        let result = client
            .fetch_latest_versions(&["alpha-only".to_string()], false)
            .await
            .expect("fetch");

        let info = result.versions.get("alpha-only").expect("alpha-only info");
        assert_eq!(info.latest.as_deref(), Some("1.2.3-beta.1"));
        assert_eq!(info.latest_stable, None);
        mock.assert_calls(1);
    }

    #[tokio::test]
    async fn fetch_latest_versions_falls_back_when_versions_missing() {
        let server = MockServer::start();
        let mock = server.mock(|when, then| {
            when.method(GET).path("/crates/empty");
            then.status(200).json_body(json!({
                "crate": {
                    "max_version": null,
                    "max_stable_version": null
                }
            }));
        });

        let client = test_client(server.url(""));
        let result = client
            .fetch_latest_versions(&["empty".to_string()], true)
            .await
            .expect("fetch");

        let info = result.versions.get("empty").expect("empty info");
        assert!(info.latest.is_none());
        assert!(info.latest_stable.is_none());
        mock.assert_calls(1);
    }

    #[tokio::test]
    async fn fetch_latest_versions_uses_cache() {
        let server = MockServer::start();
        let mock = server.mock(|when, then| {
            when.method(GET).path("/crates/cached");
            then.status(200).json_body(json!({
                "crate": {
                    "max_version": "1.2.3",
                    "max_stable_version": "1.2.3"
                }
            }));
        });

        let client = test_client(server.url(""));
        let names = vec!["cached".to_string()];

        let first = client.fetch_latest_versions(&names, false).await.unwrap();
        assert_eq!(
            first.versions.get("cached").unwrap().latest.as_deref(),
            Some("1.2.3")
        );

        let second = client
            .clone()
            .fetch_latest_versions(&names, false)
            .await
            .unwrap();
        assert_eq!(
            second.versions.get("cached").unwrap().latest.as_deref(),
            Some("1.2.3")
        );

        mock.assert_calls(1);
    }

    #[tokio::test]
    async fn fetch_latest_versions_handles_404_response() {
        let server = MockServer::start();
        let mock = server.mock(|when, then| {
            when.method(GET).path("/crates/nonexistent");
            then.status(404).body("Not Found");
        });

        let client = test_client(server.url(""));
        let result = client
            .fetch_latest_versions(&["nonexistent".to_string()], false)
            .await
            .expect("batch continues");

        let err = result.failures.get("nonexistent").expect("failure");
        assert_eq!(err.code(), crate::core::error::ErrorCode::Http);
        assert!(err.to_string().contains("HTTP error"));
        mock.assert_calls(1);
    }

    #[tokio::test]
    async fn fetch_latest_versions_handles_500_response() {
        let server = MockServer::start();
        let mock = server.mock(|when, then| {
            when.method(GET).path("/crates/broken");
            then.status(500).body("Internal Server Error");
        });

        let client = test_client(server.url(""));
        let result = client
            .fetch_latest_versions(&["broken".to_string()], false)
            .await
            .expect("batch continues");

        let err = result.failures.get("broken").expect("failure");
        assert_eq!(err.code(), crate::core::error::ErrorCode::Http);
        mock.assert_calls(1);
    }

    #[tokio::test]
    async fn fetch_latest_versions_handles_invalid_json() {
        let server = MockServer::start();
        let mock = server.mock(|when, then| {
            when.method(GET).path("/crates/badjson");
            then.status(200).body("not valid json");
        });

        let client = test_client(server.url(""));
        let result = client
            .fetch_latest_versions(&["badjson".to_string()], false)
            .await
            .expect("batch continues");

        let err = result.failures.get("badjson").expect("failure");
        assert_eq!(err.code(), crate::core::error::ErrorCode::Json);
        assert!(err.to_string().contains("failed to parse JSON"));
        mock.assert_calls(1);
    }

    #[tokio::test]
    async fn fetch_latest_versions_handles_network_error() {
        // Use a port that is not listening to simulate network error
        let client = test_client("http://127.0.0.1:1".to_string());
        let result = client
            .fetch_latest_versions(&["anypackage".to_string()], false)
            .await
            .expect("batch continues");

        let err = result.failures.get("anypackage").expect("failure");
        assert_eq!(err.code(), crate::core::error::ErrorCode::Http);
        assert!(err.to_string().contains("failed to fetch crate info"));
    }

    #[tokio::test]
    async fn fetch_latest_versions_keeps_successful_siblings_after_http_failure() {
        let server = MockServer::start();
        let good = server.mock(|when, then| {
            when.method(GET).path("/crates/zeta");
            then.status(200).json_body(json!({
                "crate": {
                    "max_version": "2.0.0",
                    "max_stable_version": "2.0.0"
                }
            }));
        });
        let bad = server.mock(|when, then| {
            when.method(GET).path("/crates/alpha");
            then.status(500).body("Internal Server Error");
        });

        let client = test_client(server.url(""));
        let result = client
            .fetch_latest_versions(
                &["zeta".to_string(), "alpha".to_string(), "alpha".to_string()],
                false,
            )
            .await
            .expect("batch continues");

        assert_eq!(result.versions["zeta"].latest.as_deref(), Some("2.0.0"));
        assert_eq!(result.failures.keys().collect::<Vec<_>>(), vec!["alpha"]);
        good.assert_calls(1);
        bad.assert_calls(1);
    }

    #[tokio::test]
    async fn fetch_latest_versions_keeps_successful_siblings_after_invalid_json() {
        let server = MockServer::start();
        let good = server.mock(|when, then| {
            when.method(GET).path("/crates/zeta");
            then.status(200).json_body(json!({
                "crate": {
                    "max_version": "1.2.3",
                    "max_stable_version": "1.2.3"
                }
            }));
        });
        let bad = server.mock(|when, then| {
            when.method(GET).path("/crates/alpha");
            then.status(200).body("not json");
        });

        let client = test_client(server.url(""));
        let result = client
            .fetch_latest_versions(&["zeta".to_string(), "alpha".to_string()], false)
            .await
            .expect("batch continues");

        assert!(result.versions.contains_key("zeta"));
        assert_eq!(result.failures.keys().collect::<Vec<_>>(), vec!["alpha"]);
        good.assert_calls(1);
        bad.assert_calls(1);
    }

    #[tokio::test]
    async fn cache_separates_prerelease_selection_policy() {
        let server = MockServer::start();
        let mock = server.mock(|when, then| {
            when.method(GET).path("/crates/policy");
            then.status(200).json_body(json!({
                "crate": {
                    "max_version": "2.0.0-beta.1",
                    "max_stable_version": "1.9.0"
                }
            }));
        });
        let client = test_client(server.url(""));
        let names = vec!["policy".to_string()];

        let stable = client.fetch_latest_versions(&names, false).await.unwrap();
        let prerelease = client.fetch_latest_versions(&names, true).await.unwrap();

        assert_eq!(stable.versions["policy"].latest.as_deref(), Some("1.9.0"));
        assert_eq!(
            prerelease.versions["policy"].latest.as_deref(),
            Some("2.0.0-beta.1")
        );
        mock.assert_calls(2);
    }

    #[tokio::test]
    async fn concurrent_clones_separate_prerelease_policy() {
        let server = MockServer::start();
        let mock = server.mock(|when, then| {
            when.method(GET).path("/crates/concurrent");
            then.status(200).json_body(json!({
                "crate": {
                    "max_version": "2.0.0-beta.1",
                    "max_stable_version": "1.9.0"
                }
            }));
        });
        let client = test_client(server.url(""));
        let stable_client = client.clone();
        let prerelease_client = client.clone();
        let stable_names = vec!["concurrent".to_string()];
        let prerelease_names = stable_names.clone();

        let (stable, prerelease) = tokio::join!(
            stable_client.fetch_latest_versions(&stable_names, false),
            prerelease_client.fetch_latest_versions(&prerelease_names, true)
        );

        assert_eq!(
            stable.unwrap().versions["concurrent"].latest.as_deref(),
            Some("1.9.0")
        );
        assert_eq!(
            prerelease.unwrap().versions["concurrent"].latest.as_deref(),
            Some("2.0.0-beta.1")
        );
        mock.assert_calls(2);
    }

    #[tokio::test]
    async fn closed_limiter_retains_cached_success_and_fails_only_pending_names() {
        let server = MockServer::start();
        let cached = server.mock(|when, then| {
            when.method(GET).path("/crates/cached");
            then.status(200).json_body(json!({
                "crate": { "max_version": "1.2.3", "max_stable_version": "1.2.3" }
            }));
        });
        let client = test_client(server.url(""));
        client
            .fetch_latest_versions(&["cached".to_string()], false)
            .await
            .unwrap();
        client.limiter.close();

        let result = client
            .fetch_latest_versions(&["pending".to_string(), "cached".to_string()], false)
            .await
            .expect("partial batch");

        assert!(result.versions.contains_key("cached"));
        assert_eq!(result.failures.keys().collect::<Vec<_>>(), vec!["pending"]);
        assert_eq!(result.failures["pending"].code(), ErrorCode::Concurrency);
        cached.assert_calls(1);
    }
}