{
  lib,
  pkgs,
  ...
}:
let
  jfLib = import ./jellyfin-test-lib.nix { inherit pkgs lib; };
  mockGrafana = ./mock-grafana-server.py;
  script = ../services/jellyfin-annotations.py;
  python = pkgs.python3;
in
pkgs.testers.runNixOSTest {
  name = "jellyfin-annotations";

  nodes.machine =
    { pkgs, ... }:
    {
      imports = [ jfLib.jellyfinTestConfig ];
      environment.systemPackages = [ pkgs.python3 ];
    };

  testScript = ''
    import json
    import time

    import importlib.util
    _spec = importlib.util.spec_from_file_location("jf_helpers", "${jfLib.helpers}")
    assert _spec and _spec.loader
    _jf = importlib.util.module_from_spec(_spec)
    _spec.loader.exec_module(_jf)
    setup_jellyfin = _jf.setup_jellyfin
    jellyfin_api = _jf.jellyfin_api

    GRAFANA_PORT  = 13000
    ANNOTS_FILE   = "/tmp/annotations.json"
    STATE_FILE    = "/tmp/annotations-state.json"
    CREDS_DIR     = "/tmp/test-creds"
    PYTHON        = "${python}/bin/python3"
    MOCK_GRAFANA  = "${mockGrafana}"
    SCRIPT        = "${script}"

    auth_header  = 'MediaBrowser Client="Infuse", DeviceId="test-dev-1", Device="iPhone", Version="1.0"'
    auth_header2 = 'MediaBrowser Client="Jellyfin Web", DeviceId="test-dev-2", Device="Chrome", Version="1.0"'

    def read_annotations():
        out = machine.succeed(f"cat {ANNOTS_FILE} 2>/dev/null || echo '[]'")
        return json.loads(out.strip())

    start_all()
    token, user_id, movie_id, media_source_id = setup_jellyfin(
        machine, retry, auth_header,
        "${jfLib.payloads.auth}", "${jfLib.payloads.empty}",
    )

    with subtest("Setup mock Grafana and credentials"):
        machine.succeed(f"mkdir -p {CREDS_DIR}")
        machine.succeed(f"echo '{token}' > {CREDS_DIR}/jellyfin-api-key")
        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
        machine.succeed(
            f"systemd-run --unit=mock-grafana {PYTHON} {MOCK_GRAFANA} {GRAFANA_PORT} {ANNOTS_FILE}"
        )
        machine.wait_until_succeeds(
            f"curl -sf -X POST http://127.0.0.1:{GRAFANA_PORT}/api/annotations "
            f"-H 'Content-Type: application/json' -d '{{\"text\":\"ping\",\"tags\":[]}}' | grep -q id",
            timeout=10,
        )
        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")

    with subtest("Start annotation service"):
        machine.succeed(
            f"systemd-run --unit=annotations-svc "
            f"--setenv=JELLYFIN_URL=http://127.0.0.1:8096 "
            f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
            f"--setenv=CREDENTIALS_DIRECTORY={CREDS_DIR} "
            f"--setenv=STATE_FILE={STATE_FILE} "
            f"--setenv=POLL_INTERVAL=3 "
            f"{PYTHON} {SCRIPT}"
        )
        time.sleep(2)

    with subtest("No annotations when no streams active"):
        time.sleep(4)
        annots = read_annotations()
        assert annots == [], f"Expected no annotations, got: {annots}"

    with subtest("Annotation created when playback starts"):
        playback_start = json.dumps({
            "ItemId": movie_id,
            "MediaSourceId": media_source_id,
            "PlaySessionId": "test-play-1",
            "CanSeek": True,
            "IsPaused": False,
        })
        machine.succeed(
            f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing' "
            f"-d '{playback_start}' -H 'Content-Type:application/json' "
            f"-H 'X-Emby-Authorization:{auth_header}, Token={token}'"
        )
        machine.wait_until_succeeds(
            f"cat {ANNOTS_FILE} | python3 -c \"import sys,json; a=json.load(sys.stdin); exit(0 if a else 1)\"",
            timeout=15,
        )
        annots = read_annotations()
        assert len(annots) == 1, f"Expected 1 annotation, got: {annots}"
        text = annots[0]["text"]
        assert "jellyfin" in annots[0].get("tags", []), f"Missing jellyfin tag: {annots[0]}"
        assert "Test Movie" in text, f"Missing title in: {text}"
        assert "Infuse" in text, f"Missing client in: {text}"
        assert "iPhone" in text, f"Missing device in: {text}"
        assert "timeEnd" not in annots[0], f"timeEnd should not be set yet: {annots[0]}"

    with subtest("Annotation closed when playback stops"):
        playback_stop = json.dumps({
            "ItemId": movie_id,
            "MediaSourceId": media_source_id,
            "PlaySessionId": "test-play-1",
            "PositionTicks": 50000000,
        })
        machine.succeed(
            f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing/Stopped' "
            f"-d '{playback_stop}' -H 'Content-Type:application/json' "
            f"-H 'X-Emby-Authorization:{auth_header}, Token={token}'"
        )
        machine.wait_until_succeeds(
            f"cat {ANNOTS_FILE} | python3 -c \"import sys,json; a=json.load(sys.stdin); exit(0 if a and 'timeEnd' in a[0] else 1)\"",
            timeout=15,
        )
        annots = read_annotations()
        assert len(annots) == 1, f"Expected 1 annotation, got: {annots}"
        assert "timeEnd" in annots[0], f"timeEnd should be set: {annots[0]}"
        assert annots[0]["timeEnd"] > annots[0]["time"], "timeEnd should be after time"

    with subtest("Multiple concurrent streams each get their own annotation"):
        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")

        auth_result2 = json.loads(machine.succeed(
            f"curl -sf -X POST 'http://localhost:8096/Users/AuthenticateByName' "
            f"-d '@${jfLib.payloads.auth}' -H 'Content-Type:application/json' "
            f"-H 'X-Emby-Authorization:{auth_header2}'"
        ))
        token2 = auth_result2["AccessToken"]

        playback1 = json.dumps({
            "ItemId": movie_id,
            "MediaSourceId": media_source_id,
            "PlaySessionId": "test-play-multi-1",
            "CanSeek": True,
            "IsPaused": False,
        })
        machine.succeed(
            f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing' "
            f"-d '{playback1}' -H 'Content-Type:application/json' "
            f"-H 'X-Emby-Authorization:{auth_header}, Token={token}'"
        )
        playback2 = json.dumps({
            "ItemId": movie_id,
            "MediaSourceId": media_source_id,
            "PlaySessionId": "test-play-multi-2",
            "CanSeek": True,
            "IsPaused": False,
        })
        machine.succeed(
            f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing' "
            f"-d '{playback2}' -H 'Content-Type:application/json' "
            f"-H 'X-Emby-Authorization:{auth_header2}, Token={token2}'"
        )
        machine.wait_until_succeeds(
            f"cat {ANNOTS_FILE} | python3 -c \"import sys,json; a=json.load(sys.stdin); exit(0 if len(a)==2 else 1)\"",
            timeout=15,
        )
        annots = read_annotations()
        assert len(annots) == 2, f"Expected 2 annotations, got: {annots}"

    with subtest("State survives service restart (no duplicate annotations)"):
        machine.succeed("systemctl stop annotations-svc || true")
        time.sleep(1)
        machine.succeed(
            f"systemd-run --unit=annotations-svc-2 "
            f"--setenv=JELLYFIN_URL=http://127.0.0.1:8096 "
            f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
            f"--setenv=CREDENTIALS_DIRECTORY={CREDS_DIR} "
            f"--setenv=STATE_FILE={STATE_FILE} "
            f"--setenv=POLL_INTERVAL=3 "
            f"{PYTHON} {SCRIPT}"
        )
        time.sleep(6)
        annots = read_annotations()
        assert len(annots) == 2, f"Restart should not create duplicates, got: {annots}"
  '';
}