using System.Data.Common;
using Dapr.Client;
using EntitlementBLL.Auth;
using EntitlementBLL.Legal;
using EntitlementBLL.Options;
using EntitlementDAL.DTOs;
using EntitlementDAL.Enums;
using EntitlementDAL.Interfaces;
using GB5Shared.DirectAction;
using GB5Shared.DTO.DirectAction;
using GB5Shared.ActionProcessor;
using GB5Shared.DTO.Framework.CommonConfig;
using GB5Shared.DTO.Framework.Login;
using GB5Shared.EventLogPublish;
using GB5Shared.GenerateAutoNumber;
using GB5Shared.QueryExecutor;
using Microsoft.Extensions.Logging.Abstractions;
using Microsoft.Extensions.Options;
using Moq;
using Xunit;

namespace EntitlementTests;

/// <summary>
/// Covers the Thread 8 capability-grant claim wiring: MENTITLEMENTCLIENTUSERROLE grants
/// (TECH_ADMIN/COMMERCIAL_ADMIN) are resolved once at login and carried on the JWT's Capabilities
/// claim, so an endpoint (e.g. RequestChangePlan) can check capability membership with no DB
/// round-trip. Covers both the claim serialization itself (ClientAccessTokenClaims.ToClaims) and
/// ClientAuthBLL.LoginAsync actually populating it from IClientUserRoleDAL.
/// </summary>
public class ClientCapabilityTests
{
    [Fact]
    public void Test_ToClaims_WithCapabilities_ProducesCommaJoinedClaim()
    {
        var claims = new ClientAccessTokenClaims
        {
            ClientUserId = 1,
            ClientId     = 42,
            Role         = ClientRoleCodes.ClientAdmin,
            Capabilities = new List<string> { EntitlementClientCapabilityCodes.TechAdmin, EntitlementClientCapabilityCodes.CommercialAdmin }
        };

        var capabilitiesClaim = claims.ToClaims().Single(c => c.Type == ClientJwtClaimTypes.Capabilities);

        Assert.Equal("TECH_ADMIN,COMMERCIAL_ADMIN", capabilitiesClaim.Value);
    }

    [Fact]
    public void Test_ToClaims_NoCapabilities_ProducesEmptyClaim()
    {
        var claims = new ClientAccessTokenClaims { ClientUserId = 1, ClientId = 42, Role = ClientRoleCodes.ClientUser };

        var capabilitiesClaim = claims.ToClaims().Single(c => c.Type == ClientJwtClaimTypes.Capabilities);

        Assert.Equal(string.Empty, capabilitiesClaim.Value);
    }

    private static (ClientAuthBLL Svc, Mock<IClientUserDAL> ClientUserDal, Mock<IClientUserRoleDAL> ClientUserRoleDal,
        Mock<IClientJwtService> JwtService) BuildService()
    {
        var clientUserDal     = new Mock<IClientUserDAL>();
        var clientUserRoleDal = new Mock<IClientUserRoleDAL>();
        var refreshTokenDal   = new Mock<IClientRefreshTokenDAL>();
        var jwtService        = new Mock<IClientJwtService>();

        jwtService.Setup(j => j.IssueTokenPairAsync(It.IsAny<ClientAccessTokenClaims>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(new ClientTokenPair
            {
                AccessToken = "access-token", AccessTokenExpiresOn = DateTime.UtcNow.AddMinutes(15),
                RefreshToken = "raw-refresh-token", RefreshTokenHash = "HASH-raw-refresh-token",
                RefreshTokenExpiresOn = DateTime.UtcNow.AddDays(30)
            });

        clientUserDal.Setup(d => d.UpdateFailedLoginCountAsync(It.IsAny<int>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);
        clientUserDal.Setup(d => d.UpdateLastLoginOnAsync(It.IsAny<int>(), It.IsAny<DateTime>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);
        refreshTokenDal.Setup(d => d.SaveAsync(It.IsAny<ClientRefreshTokenDTO>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);

        var queryExecutor = new Mock<IQueryExecutor>();
        queryExecutor
            .Setup(q => q.QueryAsync<long>(It.IsAny<LoginDTO>(), It.IsAny<string>(), It.IsAny<object>(),
                It.IsAny<DbTransaction>(), It.IsAny<bool>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(new List<long> { 101 });
        queryExecutor.Setup(q => q.BeginTransactionAsync(It.IsAny<LoginDTO>())).ReturnsAsync((DbTransaction)null!);
        queryExecutor.Setup(q => q.CommitAsync(It.IsAny<DbTransaction>())).Returns(Task.CompletedTask);
        queryExecutor.Setup(q => q.RollbackAsync(It.IsAny<DbTransaction>())).Returns(Task.CompletedTask);

        var dbConfig = new Mock<IOptionsSnapshot<Gb5SystemDTO>>();
        dbConfig.Setup(o => o.Value).Returns(new Gb5SystemDTO { DataBaseType = 0 });
        var autoNumber = new AutoNumber(queryExecutor.Object, dbConfig.Object);

        var lockoutOptions       = Options.Create(new ClientAccountLockoutOptions());
        var passwordResetOptions = Options.Create(new ClientPasswordResetOptions());
        var tokenService         = new Mock<IDirectActionTokenService>();
        var directActionTokenDal = new Mock<IDirectActionTokenDAL>();
        var eventActionRunDal    = new Mock<IEventActionRunDAL>();
        var actionOutboxDal      = new Mock<IActionOutboxDAL>();
        var eventLog = new EventLogPublish(new DaprClientBuilder().Build(), NullLogger<EventLogPublish>.Instance);

        var svc = new ClientAuthBLL(
            clientUserDal.Object, clientUserRoleDal.Object, refreshTokenDal.Object, jwtService.Object, autoNumber, queryExecutor.Object,
            lockoutOptions, tokenService.Object, directActionTokenDal.Object, eventActionRunDal.Object,
            actionOutboxDal.Object, passwordResetOptions, eventLog, new Mock<IAgreementConsentProvider>().Object, new Mock<IClientProvisioningDAL>().Object, NullLogger<ClientAuthBLL>.Instance);

        return (svc, clientUserDal, clientUserRoleDal, jwtService);
    }

    [Fact]
    public async Task Test_LoginAsync_ResolvesCapabilities_AndIncludesThemOnIssuedClaims()
    {
        var (svc, clientUserDal, clientUserRoleDal, jwtService) = BuildService();
        const string password = "Correct-Horse-Battery-Staple";

        clientUserDal.Setup(d => d.GetByClientAndEmailAsync(42, "admin@example.com", It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(new ClientUserDTO
            {
                ClientUserId = 1, ClientId = 42, Role = (byte)ClientUserRoleEnum.ClientAdmin,
                Status = (byte)ClientUserStatusEnum.Active,
                PasswordHash = GB5Shared.EncryptionHelper.PasswordHasher.Hash(password)
            });
        clientUserRoleDal.Setup(d => d.GetActiveRoleCodesAsync(1, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(new List<string> { EntitlementClientCapabilityCodes.CommercialAdmin });

        var result = await svc.LoginAsync(42, "admin@example.com", password, new LoginDTO { ClientId = 42, UserId = -1 }, CancellationToken.None);

        Assert.Equal(ClientLoginResultStatus.Success, result.Status);
        jwtService.Verify(j => j.IssueTokenPairAsync(
            It.Is<ClientAccessTokenClaims>(c => c.Capabilities.Count == 1 && c.Capabilities[0] == EntitlementClientCapabilityCodes.CommercialAdmin),
            It.IsAny<CancellationToken>()), Times.Once);
    }
}