param(
    [string]$ApiBaseUrl = "http://192.168.200.61:18121/api/v1",
    [string]$ClusterID = "cfc0743d-d960-49fb-9de8-96e063d5e4aa",
    [string]$ActorUserID = "f67d943f-5397-4b3a-a229-695fe67ad700",
    [string]$EntryNodeName = "test-1",
    [string]$ExitNodeName = "test-2",
    [string]$EntryBaseUrl = "http://192.168.200.61:19131",
    [string]$ResultPath = "artifacts\c19n-remote-workspace-adapter-session-control-guardrails-smoke-result.json"
)

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot "..\..")).ProviderPath
$sourceResultPath = "artifacts\c19n-remote-workspace-adapter-session-source-result.json"

function Invoke-Api {
    param([string]$Method, [string]$Path, [object]$Body = $null)
    $uri = "$ApiBaseUrl$Path"
    if ($null -eq $Body) { return Invoke-RestMethod -Method $Method -Uri $uri -TimeoutSec 30 }
    return Invoke-RestMethod -Method $Method -Uri $uri -ContentType "application/json" -Body ($Body | ConvertTo-Json -Depth 80) -TimeoutSec 30
}

function Get-PropertyValue {
    param([object]$Item, [string]$Name, [object]$Default = $null)
    if ($null -eq $Item) { return $Default }
    $property = $Item.PSObject.Properties[$Name]
    if ($null -eq $property) { return $Default }
    return $property.Value
}

function Get-NodeByName {
    param([string]$Name)
    $nodes = (Invoke-Api -Method GET -Path "/clusters/$ClusterID/nodes?actor_user_id=$ActorUserID").nodes
    $node = @($nodes | Where-Object { $_.name -eq $Name }) | Select-Object -First 1
    if ($null -eq $node) { throw "Node '$Name' was not found in cluster $ClusterID" }
    return $node
}

function Invoke-Control {
    param([string]$SessionID, [string]$Body)
    $url = "$EntryBaseUrl/mesh/v1/remote-workspace/adapter-sessions/$SessionID/control"
    try {
        $response = Invoke-WebRequest -Method POST -Uri $url -ContentType "application/json" -Body $Body -TimeoutSec 30
        $content = $response.Content
        $json = $null
        if ($content) {
            try { $json = $content | ConvertFrom-Json } catch { $json = $null }
        }
        return [ordered]@{ status_code = [int]$response.StatusCode; body = $content; json = $json }
    } catch {
        $statusCode = $null
        if ($_.Exception.Response) { $statusCode = [int]$_.Exception.Response.StatusCode }
        $details = $_.ErrorDetails.Message
        if (-not $details) { $details = $_.Exception.Message }
        return [ordered]@{ status_code = $statusCode; body = $details; json = $null }
    }
}

function Get-RemoteWorkspaceSinkReports {
    param([string]$NodeID)
    $workloadStatus = $null
    $workloadSink = $null
    $telemetry = $null
    $telemetrySink = $null
    $statuses = (Invoke-Api -Method GET -Path "/clusters/$ClusterID/nodes/$NodeID/workloads/status?actor_user_id=$ActorUserID").workload_statuses
    $workloadStatus = @($statuses | Where-Object { $_.service_type -eq "rdp-worker" } | Select-Object -First 1)
    if ($null -ne $workloadStatus) {
        $workloadSink = Get-PropertyValue -Item $workloadStatus.status_payload -Name "remote_workspace_adapter_sink" -Default $null
    }
    $telemetryItems = @((Invoke-Api -Method GET -Path "/clusters/$ClusterID/nodes/$NodeID/telemetry?actor_user_id=$ActorUserID&limit=10").telemetry)
    $telemetry = $telemetryItems | Select-Object -First 1
    if ($null -ne $telemetry) {
        $telemetryPayload = Get-PropertyValue -Item $telemetry -Name "payload" -Default $null
        $telemetrySink = Get-PropertyValue -Item $telemetryPayload -Name "remote_workspace_adapter_sink_report" -Default $null
    }
    return [ordered]@{
        workload_status = $workloadStatus
        workload_sink = $workloadSink
        telemetry = $telemetry
        telemetry_sink = $telemetrySink
    }
}

function Test-GuardrailReport {
    param([object]$Sink, [string]$AdapterSessionID, [int64]$BaselineControl, [int64]$BaselineClosed)
    if ($null -eq $Sink) { return $false }
    return (
        [int64](Get-PropertyValue -Item $Sink -Name "session_control_total" -Default 0) -ge ($BaselineControl + 2) -and
        [int64](Get-PropertyValue -Item $Sink -Name "session_closed_total" -Default 0) -eq ($BaselineClosed + 1) -and
        [string](Get-PropertyValue -Item $Sink -Name "last_controlled_adapter_session_id" -Default "") -eq $AdapterSessionID -and
        [string](Get-PropertyValue -Item $Sink -Name "last_session_control_action" -Default "") -eq "close" -and
        [string](Get-PropertyValue -Item $Sink -Name "last_session_control_state" -Default "") -eq "closed"
    )
}

$entryNode = Get-NodeByName -Name $EntryNodeName
$baseline = Get-RemoteWorkspaceSinkReports -NodeID $entryNode.id
$baselineSink = if ($null -ne $baseline.workload_sink) { $baseline.workload_sink } else { $baseline.telemetry_sink }
$baselineControl = [int64](Get-PropertyValue -Item $baselineSink -Name "session_control_total" -Default 0)
$baselineClosed = [int64](Get-PropertyValue -Item $baselineSink -Name "session_closed_total" -Default 0)

$source = & powershell -ExecutionPolicy Bypass -File (Join-Path $PSScriptRoot "c19i-remote-workspace-adapter-queue-smoke.ps1") `
    -ApiBaseUrl $ApiBaseUrl `
    -ClusterID $ClusterID `
    -ActorUserID $ActorUserID `
    -EntryNodeName $EntryNodeName `
    -ExitNodeName $ExitNodeName `
    -EntryBaseUrl $EntryBaseUrl `
    -ResultPath $sourceResultPath

$sourceFile = Join-Path $repoRoot $sourceResultPath
$sourceResult = Get-Content -Raw -Path $sourceFile | ConvertFrom-Json
$adapterSessionID = [string](Get-PropertyValue -Item $sourceResult.droppable_overflow.body -Name "adapter_session_id" -Default "")

$cases = [ordered]@{
    unknown_action = Invoke-Control -SessionID $adapterSessionID -Body '{"action":"launch"}'
    invalid_id = Invoke-Control -SessionID "rap-rw-adapter-session-nothex" -Body '{"action":"close"}'
    malformed_json = Invoke-Control -SessionID $adapterSessionID -Body '{'
    unknown_session = Invoke-Control -SessionID "rap-rw-adapter-session-bbbbbbbbbbbbbbbbbbbbbbbb" -Body '{"action":"close"}'
    close_once = Invoke-Control -SessionID $adapterSessionID -Body '{"action":"close","reason":"c19n close"}'
    close_repeat = Invoke-Control -SessionID $adapterSessionID -Body '{"action":"close","reason":"c19n repeat close"}'
}

$observed = $null
$deadline = (Get-Date).AddSeconds(90)
while ((Get-Date) -lt $deadline) {
    Start-Sleep -Seconds 5
    $observed = Get-RemoteWorkspaceSinkReports -NodeID $entryNode.id
    if (
        (Test-GuardrailReport -Sink $observed.workload_sink -AdapterSessionID $adapterSessionID -BaselineControl $baselineControl -BaselineClosed $baselineClosed) -and
        (Test-GuardrailReport -Sink $observed.telemetry_sink -AdapterSessionID $adapterSessionID -BaselineControl $baselineControl -BaselineClosed $baselineClosed)
    ) {
        break
    }
}
if ($null -eq $observed) {
    $observed = Get-RemoteWorkspaceSinkReports -NodeID $entryNode.id
}

$checks = [ordered]@{
    source_smoke_passed = ([bool]$sourceResult.passed)
    adapter_session_id_present = ($adapterSessionID -match "^rap-rw-adapter-session-[0-9a-f]{24}$")
    unknown_action_rejected = ([int]$cases.unknown_action.status_code -eq 400 -and [string]$cases.unknown_action.body -match "unsupported")
    invalid_id_rejected = ([int]$cases.invalid_id.status_code -eq 400 -and [string]$cases.invalid_id.body -match "invalid remote workspace adapter session id")
    malformed_json_rejected = ([int]$cases.malformed_json.status_code -eq 400 -and [string]$cases.malformed_json.body -match "invalid remote workspace adapter session control payload")
    unknown_session_rejected = ([int]$cases.unknown_session.status_code -eq 400 -and [string]$cases.unknown_session.body -match "not found")
    close_once_accepted = ([int]$cases.close_once.status_code -eq 200 -and [bool]$cases.close_once.json.accepted -and [string]$cases.close_once.json.previous_state -eq "backpressure" -and [string]$cases.close_once.json.session_state -eq "closed")
    close_repeat_idempotent = ([int]$cases.close_repeat.status_code -eq 200 -and [bool]$cases.close_repeat.json.accepted -and [string]$cases.close_repeat.json.previous_state -eq "closed" -and [string]$cases.close_repeat.json.session_state -eq "closed")
    workload_guardrails_visible = (Test-GuardrailReport -Sink $observed.workload_sink -AdapterSessionID $adapterSessionID -BaselineControl $baselineControl -BaselineClosed $baselineClosed)
    telemetry_guardrails_visible = (Test-GuardrailReport -Sink $observed.telemetry_sink -AdapterSessionID $adapterSessionID -BaselineControl $baselineControl -BaselineClosed $baselineClosed)
}
$failed = @($checks.GetEnumerator() | Where-Object { -not $_.Value } | ForEach-Object { $_.Key })

$result = [ordered]@{
    schema_version = "c19n.remote_workspace_adapter_session_control_guardrails_smoke.v1"
    source_result_path = $sourceFile
    cluster_id = $ClusterID
    entry_node = [ordered]@{ id = $entryNode.id; name = $entryNode.name }
    adapter_session_id = $adapterSessionID
    cases = $cases
    observed = $observed
    checks = $checks
    failed_checks = $failed
    passed = ($failed.Count -eq 0)
}

$fullResultPath = Join-Path $repoRoot $ResultPath
$resultDir = Split-Path -Parent $fullResultPath
if ($resultDir) { New-Item -ItemType Directory -Force -Path $resultDir | Out-Null }
$result | ConvertTo-Json -Depth 100 | Set-Content -Encoding UTF8 -Path $fullResultPath

if (-not $result.passed) {
    throw "C19N remote workspace adapter session control guardrails smoke failed. Result: $fullResultPath Failed: $($failed -join ', ')"
}

Write-Host "C19N remote workspace adapter session control guardrails smoke passed. Result: $fullResultPath"
$result