using System.Data.Common;
using Dapr.Client;
using EntitlementBLL.Auth;
using EntitlementBLL.Legal;
using EntitlementBLL.Options;
using EntitlementDAL.DTOs;
using EntitlementDAL.Enums;
using EntitlementDAL.Interfaces;
using GB5Shared.DirectAction;
using GB5Shared.DTO.DirectAction;
using GB5Shared.ActionProcessor;
using GB5Shared.DTO.Framework.CommonConfig;
using GB5Shared.DTO.Framework.Login;
using GB5Shared.EncryptionHelper;
using GB5Shared.EventLogPublish;
using GB5Shared.GenerateAutoNumber;
using GB5Shared.QueryExecutor;
using Microsoft.Extensions.Logging.Abstractions;
using Microsoft.Extensions.Options;
using Moq;
using Xunit;

namespace EntitlementTests;

/// <summary>
/// Covers EntitlementBLL.Auth.ClientAuthBLL.LoginAsync's account-lockout wiring and
/// SetClientUserStatusAsync's admin-unlock path — the real fix for the gap DXP shipped with:
/// DXP's MDXPUSER.FAILEDLOGINCOUNT increments on every wrong password and a Status==2 check
/// exists in code, but no threshold is ever read or enforced, so that check never fires. Here,
/// FailedLoginCount increments on a wrong password against an Active account, and once it reaches
/// ClientAccountLockoutOptions.FailedLoginThreshold, STATUS flips to Locked in the SAME update
/// (verified by capturing the exact (status, count) pair passed to
/// UpdateStatusAndFailedLoginCountAsync).
/// </summary>
public class ClientLoginLockoutTests
{
    private const int ClientId = 42;
    private const string Email = "user@example.com";
    private const string CorrectPassword = "Correct-Horse-Battery-Staple";

    private static (ClientAuthBLL Svc, Mock<IClientUserDAL> ClientUserDal) BuildService(int failedLoginThreshold = 5)
    {
        var clientUserDal   = new Mock<IClientUserDAL>();
        var clientUserRoleDal = new Mock<IClientUserRoleDAL>();
        clientUserRoleDal
            .Setup(d => d.GetActiveRoleCodesAsync(It.IsAny<int>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(Enumerable.Empty<string>());
        var refreshTokenDal = new Mock<IClientRefreshTokenDAL>();
        var jwtService      = new Mock<IClientJwtService>();

        jwtService.Setup(j => j.HashRefreshToken(It.IsAny<string>())).Returns((string raw) => $"HASH-{raw}");
        jwtService.Setup(j => j.IssueTokenPairAsync(It.IsAny<ClientAccessTokenClaims>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(new ClientTokenPair
            {
                AccessToken           = "access-token",
                AccessTokenExpiresOn  = DateTime.UtcNow.AddMinutes(15),
                RefreshToken          = "raw-refresh-token",
                RefreshTokenHash      = "HASH-raw-refresh-token",
                RefreshTokenExpiresOn = DateTime.UtcNow.AddDays(30)
            });

        refreshTokenDal
            .Setup(d => d.SaveAsync(It.IsAny<ClientRefreshTokenDTO>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);

        clientUserDal
            .Setup(d => d.UpdateFailedLoginCountAsync(It.IsAny<int>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);
        clientUserDal
            .Setup(d => d.UpdateLastLoginOnAsync(It.IsAny<int>(), It.IsAny<DateTime>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);
        clientUserDal
            .Setup(d => d.UpdateStatusAndFailedLoginCountAsync(It.IsAny<int>(), It.IsAny<byte>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);
        clientUserDal
            .Setup(d => d.UpdateStatusAsync(It.IsAny<int>(), It.IsAny<byte>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);

        // Real AutoNumber wired to a mocked IQueryExecutor — only exercised on a successful login
        // (IssueAndPersistTokenPairAsync's refresh-token id allocation).
        var queryExecutor = new Mock<IQueryExecutor>();
        queryExecutor
            .Setup(q => q.QueryAsync<long>(It.IsAny<LoginDTO>(), It.IsAny<string>(), It.IsAny<object>(),
                It.IsAny<DbTransaction>(), It.IsAny<bool>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(new List<long> { 101 });
        queryExecutor.Setup(q => q.BeginTransactionAsync(It.IsAny<LoginDTO>())).ReturnsAsync((DbTransaction)null!);
        queryExecutor.Setup(q => q.CommitAsync(It.IsAny<DbTransaction>())).Returns(Task.CompletedTask);
        queryExecutor.Setup(q => q.RollbackAsync(It.IsAny<DbTransaction>())).Returns(Task.CompletedTask);

        var dbConfig = new Mock<IOptionsSnapshot<Gb5SystemDTO>>();
        dbConfig.Setup(o => o.Value).Returns(new Gb5SystemDTO { DataBaseType = 0 });
        var autoNumber = new AutoNumber(queryExecutor.Object, dbConfig.Object);

        var lockoutOptions       = Options.Create(new ClientAccountLockoutOptions { FailedLoginThreshold = failedLoginThreshold });
        var passwordResetOptions = Options.Create(new ClientPasswordResetOptions());

        // Not exercised by LoginAsync/SetClientUserStatusAsync — trivial mocks, no setups needed.
        var tokenService         = new Mock<IDirectActionTokenService>();
        var directActionTokenDal = new Mock<IDirectActionTokenDAL>();
        var eventActionRunDal    = new Mock<IEventActionRunDAL>();
        var actionOutboxDal      = new Mock<IActionOutboxDAL>();

        // EventLogPublish.PublishEventLogAsync is not virtual, so Moq can't intercept it — a real
        // instance is constructed instead. Its own internal try/catch swallows any failure to
        // reach a Dapr sidecar (never running in this sandbox) as a logged warning, never a thrown
        // exception, so this is safe to use as-is in every test.
        var eventLog = new EventLogPublish(new DaprClientBuilder().Build(), NullLogger<EventLogPublish>.Instance);

        var svc = new ClientAuthBLL(
            clientUserDal.Object, clientUserRoleDal.Object, refreshTokenDal.Object, jwtService.Object, autoNumber, queryExecutor.Object,
            lockoutOptions, tokenService.Object, directActionTokenDal.Object, eventActionRunDal.Object,
            actionOutboxDal.Object, passwordResetOptions, eventLog, new Mock<IAgreementConsentProvider>().Object, new Mock<IClientProvisioningDAL>().Object, NullLogger<ClientAuthBLL>.Instance);

        return (svc, clientUserDal);
    }

    private static ClientUserDTO ActiveUser(short failedLoginCount = 0) => new()
    {
        ClientUserId     = 1,
        ClientId         = ClientId,
        Email            = Email,
        PasswordHash     = PasswordHasher.Hash(CorrectPassword),
        Role             = (byte)ClientUserRoleEnum.ClientUser,
        FailedLoginCount = failedLoginCount,
        Status           = (byte)ClientUserStatusEnum.Active
    };

    private static LoginDTO TestLogin() => new() { ClientId = ClientId, UserId = -1 };

    [Fact]
    public async Task Test_LoginAsync_WrongPassword_BelowThreshold_IncrementsCount_StaysActive()
    {
        var (svc, clientUserDal) = BuildService(failedLoginThreshold: 5);
        clientUserDal.Setup(d => d.GetByClientAndEmailAsync(ClientId, Email, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(ActiveUser(failedLoginCount: 2));   // this will be the 3rd attempt

        byte? capturedStatus = null;
        short? capturedCount = null;
        clientUserDal
            .Setup(d => d.UpdateStatusAndFailedLoginCountAsync(1, It.IsAny<byte>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Callback<int, byte, short, LoginDTO, DbTransaction, CancellationToken>((_, status, count, _, _, _) =>
            {
                capturedStatus = status;
                capturedCount  = count;
            })
            .Returns(Task.CompletedTask);

        var result = await svc.LoginAsync(ClientId, Email, "wrong-password", TestLogin(), CancellationToken.None);

        Assert.Equal(ClientLoginResultStatus.Invalid, result.Status);
        Assert.Equal((short)3, capturedCount);
        Assert.Equal((byte)ClientUserStatusEnum.Active, capturedStatus);   // 3 < threshold(5) — not locked yet
    }

    [Fact]
    public async Task Test_LoginAsync_WrongPassword_ReachesThreshold_SetsLocked_InSameUpdate()
    {
        var (svc, clientUserDal) = BuildService(failedLoginThreshold: 5);
        clientUserDal.Setup(d => d.GetByClientAndEmailAsync(ClientId, Email, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(ActiveUser(failedLoginCount: 4));   // this will be the 5th attempt — hits the threshold

        byte? capturedStatus = null;
        short? capturedCount = null;
        clientUserDal
            .Setup(d => d.UpdateStatusAndFailedLoginCountAsync(1, It.IsAny<byte>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Callback<int, byte, short, LoginDTO, DbTransaction, CancellationToken>((_, status, count, _, _, _) =>
            {
                capturedStatus = status;
                capturedCount  = count;
            })
            .Returns(Task.CompletedTask);

        var result = await svc.LoginAsync(ClientId, Email, "wrong-password", TestLogin(), CancellationToken.None);

        Assert.Equal(ClientLoginResultStatus.Invalid, result.Status);
        Assert.Equal((short)5, capturedCount);
        // The actual point of this item: STATUS is genuinely flipped to Locked in the SAME UPDATE
        // as the incremented count — unlike DXP, where nothing ever set Status from this counter.
        Assert.Equal((byte)ClientUserStatusEnum.Locked, capturedStatus);
    }

    [Fact]
    public async Task Test_LoginAsync_LockedAccount_RejectsEvenWithCorrectPassword_NoCounterChange()
    {
        var (svc, clientUserDal) = BuildService();
        var lockedUser = ActiveUser(failedLoginCount: 5);
        lockedUser.Status = (byte)ClientUserStatusEnum.Locked;
        clientUserDal.Setup(d => d.GetByClientAndEmailAsync(ClientId, Email, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(lockedUser);

        var result = await svc.LoginAsync(ClientId, Email, CorrectPassword, TestLogin(), CancellationToken.None);

        Assert.Equal(ClientLoginResultStatus.Invalid, result.Status);
        Assert.Null(result.TokenPair);

        // Already locked — nothing to gain from counting this attempt further.
        clientUserDal.Verify(d => d.UpdateStatusAndFailedLoginCountAsync(
            It.IsAny<int>(), It.IsAny<byte>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()), Times.Never);
        clientUserDal.Verify(d => d.UpdateFailedLoginCountAsync(
            It.IsAny<int>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()), Times.Never);
    }

    [Fact]
    public async Task Test_LoginAsync_SuccessfulLogin_ResetsFailedLoginCountToZero()
    {
        var (svc, clientUserDal) = BuildService();
        clientUserDal.Setup(d => d.GetByClientAndEmailAsync(ClientId, Email, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(ActiveUser(failedLoginCount: 3));   // some prior failures, then a correct login

        var result = await svc.LoginAsync(ClientId, Email, CorrectPassword, TestLogin(), CancellationToken.None);

        Assert.Equal(ClientLoginResultStatus.Success, result.Status);
        Assert.NotNull(result.TokenPair);

        clientUserDal.Verify(d => d.UpdateFailedLoginCountAsync(
            1, 0, It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()), Times.Once);
    }

    [Fact]
    public async Task Test_LoginAsync_UnknownEmail_RejectsWithoutAnyCounterUpdate()
    {
        var (svc, clientUserDal) = BuildService();
        clientUserDal.Setup(d => d.GetByClientAndEmailAsync(ClientId, Email, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync((ClientUserDTO?)null);

        var result = await svc.LoginAsync(ClientId, Email, "whatever", TestLogin(), CancellationToken.None);

        Assert.Equal(ClientLoginResultStatus.Invalid, result.Status);
        clientUserDal.Verify(d => d.UpdateStatusAndFailedLoginCountAsync(
            It.IsAny<int>(), It.IsAny<byte>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()), Times.Never);
    }

    [Fact]
    public async Task Test_SetClientUserStatusAsync_ReactivatingAccount_ResetsFailedLoginCountToZero()
    {
        var (svc, clientUserDal) = BuildService();

        byte? capturedStatus = null;
        short? capturedCount = null;
        clientUserDal
            .Setup(d => d.UpdateStatusAndFailedLoginCountAsync(5, It.IsAny<byte>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Callback<int, byte, short, LoginDTO, DbTransaction, CancellationToken>((_, status, count, _, _, _) =>
            {
                capturedStatus = status;
                capturedCount  = count;
            })
            .Returns(Task.CompletedTask);

        await svc.SetClientUserStatusAsync(5, (byte)ClientUserStatusEnum.Active, TestLogin(), CancellationToken.None);

        Assert.Equal((byte)ClientUserStatusEnum.Active, capturedStatus);
        Assert.Equal((short)0, capturedCount);
    }

    [Fact]
    public async Task Test_SetClientUserStatusAsync_InvalidStatusValue_Throws()
    {
        var (svc, _) = BuildService();

        await Assert.ThrowsAsync<ArgumentException>(() =>
            svc.SetClientUserStatusAsync(5, 99, TestLogin(), CancellationToken.None));
    }
}