using System.Data.Common;
using Dapr.Client;
using EntitlementBLL.Auth;
using EntitlementBLL.Legal;
using EntitlementBLL.Options;
using EntitlementDAL.DTOs;
using EntitlementDAL.Enums;
using EntitlementDAL.Interfaces;
using GB5Shared.DirectAction;
using GB5Shared.DTO.DirectAction;
using GB5Shared.ActionProcessor;
using GB5Shared.DTO.Framework.CommonConfig;
using GB5Shared.DTO.Framework.Login;
using GB5Shared.EncryptionHelper;
using GB5Shared.EventLogPublish;
using GB5Shared.GenerateAutoNumber;
using GB5Shared.QueryExecutor;
using Microsoft.Extensions.Logging.Abstractions;
using Microsoft.Extensions.Options;
using Moq;
using Xunit;

namespace EntitlementTests;

/// <summary>
/// Covers EntitlementBLL.Auth.ClientAuthBLL.ForgotPasswordAsync/ResetPasswordAsync — the
/// forgot/reset-password flow built on the repo's existing signed-link-email mechanism
/// (IDirectActionTokenService/IDirectActionTokenDAL + TEVENTACTIONRUN/TACTIONOUTBOX direct-insert,
/// mirroring CorrespondenceBLL.QueueDeliveryAsync). ForgotPasswordAsync never reveals whether an
/// account was found (queue calls happen or don't — the caller never sees a difference).
/// ResetPasswordAsync's rejection paths (bad signature, wrong actionCode, already-used token,
/// ClientUserId not found/wrong-tenant/deleted) all collapse to the same InvalidOrExpiredToken
/// status. A successful reset both updates the password hash and clears/reactivates lockout state.
/// </summary>
public class ClientPasswordResetTests
{
    private const int ClientId = 42;
    private const string Email = "user@example.com";
    private const string RawToken = "signed-token-abc";

    private static (ClientAuthBLL Svc, Mock<IClientUserDAL> ClientUserDal, Mock<IDirectActionTokenService> TokenService,
        Mock<IDirectActionTokenDAL> DirectActionTokenDal, Mock<IEventActionRunDAL> EventActionRunDal,
        Mock<IActionOutboxDAL> ActionOutboxDal) BuildService()
    {
        var clientUserDal        = new Mock<IClientUserDAL>();
        var clientUserRoleDal    = new Mock<IClientUserRoleDAL>();
        clientUserRoleDal
            .Setup(d => d.GetActiveRoleCodesAsync(It.IsAny<int>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(Enumerable.Empty<string>());
        var refreshTokenDal      = new Mock<IClientRefreshTokenDAL>();
        var jwtService           = new Mock<IClientJwtService>();
        var tokenService         = new Mock<IDirectActionTokenService>();
        var directActionTokenDal = new Mock<IDirectActionTokenDAL>();
        var eventActionRunDal    = new Mock<IEventActionRunDAL>();
        var actionOutboxDal      = new Mock<IActionOutboxDAL>();

        eventActionRunDal
            .Setup(d => d.InsertAsync(It.IsAny<EventActionRunDTO>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(1001);
        actionOutboxDal
            .Setup(d => d.InsertAsync(It.IsAny<ActionOutboxDTO>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);

        clientUserDal
            .Setup(d => d.UpdatePasswordHashAsync(It.IsAny<int>(), It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);
        clientUserDal
            .Setup(d => d.UpdateStatusAndFailedLoginCountAsync(It.IsAny<int>(), It.IsAny<byte>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);

        var queryExecutor = new Mock<IQueryExecutor>();
        queryExecutor.Setup(q => q.BeginTransactionAsync(It.IsAny<LoginDTO>())).ReturnsAsync((DbTransaction)null!);
        queryExecutor.Setup(q => q.CommitAsync(It.IsAny<DbTransaction>())).Returns(Task.CompletedTask);
        queryExecutor.Setup(q => q.RollbackAsync(It.IsAny<DbTransaction>())).Returns(Task.CompletedTask);

        var dbConfig = new Mock<IOptionsSnapshot<Gb5SystemDTO>>();
        dbConfig.Setup(o => o.Value).Returns(new Gb5SystemDTO { DataBaseType = 0 });
        var autoNumber = new AutoNumber(queryExecutor.Object, dbConfig.Object);

        var lockoutOptions       = Options.Create(new ClientAccountLockoutOptions());
        var passwordResetOptions = Options.Create(new ClientPasswordResetOptions
        {
            TokenExpiryMinutes   = 30,
            ResetPasswordBaseUrl = "https://app.example.test/public/reset-password"
        });

        // EventLogPublish.PublishEventLogAsync is not virtual, so Moq can't intercept it — a real
        // instance is constructed instead. Its own internal try/catch swallows any failure to
        // reach a Dapr sidecar (never running in this sandbox) as a logged warning, never a thrown
        // exception, so this is safe to use as-is in every test.
        var eventLog = new EventLogPublish(new DaprClientBuilder().Build(), NullLogger<EventLogPublish>.Instance);

        var svc = new ClientAuthBLL(
            clientUserDal.Object, clientUserRoleDal.Object, refreshTokenDal.Object, jwtService.Object, autoNumber, queryExecutor.Object,
            lockoutOptions, tokenService.Object, directActionTokenDal.Object, eventActionRunDal.Object,
            actionOutboxDal.Object, passwordResetOptions, eventLog, new Mock<IAgreementConsentProvider>().Object, new Mock<IClientProvisioningDAL>().Object, NullLogger<ClientAuthBLL>.Instance);

        return (svc, clientUserDal, tokenService, directActionTokenDal, eventActionRunDal, actionOutboxDal);
    }

    private static LoginDTO TestLogin() => new() { ClientId = ClientId, UserId = -1, DatabaseName = "TestDb" };

    private static ClientUserDTO ActiveUser(int clientUserId = 1, byte status = 1) => new()
    {
        ClientUserId = clientUserId,
        ClientId     = ClientId,
        Email        = Email,
        FullName     = "Test User",
        PasswordHash = PasswordHasher.Hash("old-password"),
        Role         = (byte)ClientUserRoleEnum.ClientUser,
        Status       = status
    };

    // ── ForgotPasswordAsync ──────────────────────────────────────────────────────────

    [Fact]
    public async Task Test_ForgotPasswordAsync_UnknownEmail_QueuesNothing()
    {
        var (svc, clientUserDal, tokenService, _, eventActionRunDal, actionOutboxDal) = BuildService();
        clientUserDal.Setup(d => d.GetByClientAndEmailAsync(ClientId, Email, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync((ClientUserDTO?)null);

        await svc.ForgotPasswordAsync(ClientId, Email, TestLogin(), CancellationToken.None);

        tokenService.Verify(t => t.Generate(It.IsAny<string>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<string>(), It.IsAny<TimeSpan>()), Times.Never);
        eventActionRunDal.Verify(d => d.InsertAsync(It.IsAny<EventActionRunDTO>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()), Times.Never);
        actionOutboxDal.Verify(d => d.InsertAsync(It.IsAny<ActionOutboxDTO>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()), Times.Never);
    }

    [Fact]
    public async Task Test_ForgotPasswordAsync_DeletedAccount_QueuesNothing()
    {
        var (svc, clientUserDal, tokenService, _, _, _) = BuildService();
        clientUserDal.Setup(d => d.GetByClientAndEmailAsync(ClientId, Email, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(ActiveUser(status: (byte)ClientUserStatusEnum.Deleted));

        await svc.ForgotPasswordAsync(ClientId, Email, TestLogin(), CancellationToken.None);

        tokenService.Verify(t => t.Generate(It.IsAny<string>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<string>(), It.IsAny<TimeSpan>()), Times.Never);
    }

    [Fact]
    public async Task Test_ForgotPasswordAsync_ActiveAccount_QueuesResetEmail()
    {
        var (svc, clientUserDal, tokenService, _, eventActionRunDal, actionOutboxDal) = BuildService();
        clientUserDal.Setup(d => d.GetByClientAndEmailAsync(ClientId, Email, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(ActiveUser());
        tokenService.Setup(t => t.Generate(It.IsAny<string>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<string>(), It.IsAny<TimeSpan>()))
            .Returns(RawToken);

        await svc.ForgotPasswordAsync(ClientId, Email, TestLogin(), CancellationToken.None);

        tokenService.Verify(t => t.Generate("ENTITLEMENT_PWRESET", 1, ClientId, 1, It.IsAny<string>(), TimeSpan.FromMinutes(30)), Times.Once);
        eventActionRunDal.Verify(d => d.InsertAsync(It.IsAny<EventActionRunDTO>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()), Times.Once);
        actionOutboxDal.Verify(d => d.InsertAsync(It.IsAny<ActionOutboxDTO>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()), Times.Once);
    }

    [Fact]
    public async Task Test_ForgotPasswordAsync_LockedAccount_StillQueuesResetEmail_SelfServiceUnlockPath()
    {
        // Locked is NOT excluded — forgot-password is the self-service unlock path (see
        // ResetPasswordAsync's reactivation logic), so a locked account must still be able to
        // request a reset link.
        var (svc, clientUserDal, tokenService, _, _, _) = BuildService();
        clientUserDal.Setup(d => d.GetByClientAndEmailAsync(ClientId, Email, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(ActiveUser(status: (byte)ClientUserStatusEnum.Locked));
        tokenService.Setup(t => t.Generate(It.IsAny<string>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<string>(), It.IsAny<TimeSpan>()))
            .Returns(RawToken);

        await svc.ForgotPasswordAsync(ClientId, Email, TestLogin(), CancellationToken.None);

        tokenService.Verify(t => t.Generate(It.IsAny<string>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<string>(), It.IsAny<TimeSpan>()), Times.Once);
    }

    // ── ResetPasswordAsync ───────────────────────────────────────────────────────────

    private static void SetupValidToken(Mock<IDirectActionTokenService> tokenService, int contextId = 1, int tenantId = ClientId,
        string actionCode = "ENTITLEMENT_PWRESET", DateTime? expiresAt = null)
    {
        var resolvedExpiresAt = expiresAt ?? DateTime.UtcNow.AddMinutes(29);
        tokenService
            .Setup(t => t.TryValidate(RawToken, out It.Ref<string>.IsAny, out It.Ref<int>.IsAny, out It.Ref<int>.IsAny,
                out It.Ref<int>.IsAny, out It.Ref<string>.IsAny, out It.Ref<DateTime>.IsAny))
            .Returns(new TryValidateDelegate((string _, out string ac, out int ctxId, out int tid, out int assignee, out string db, out DateTime exp) =>
            {
                ac       = actionCode;
                ctxId    = contextId;
                tid      = tenantId;
                assignee = contextId;
                db       = "TestDb";
                exp      = resolvedExpiresAt;
                return true;
            }));
    }

    private delegate bool TryValidateDelegate(string token, out string actionCode, out int contextId, out int tenantId,
        out int assigneeUserId, out string databaseName, out DateTime expiresAt);

    [Fact]
    public async Task Test_ResetPasswordAsync_BadSignature_IsInvalid_NoDbCalls()
    {
        var (svc, clientUserDal, tokenService, directActionTokenDal, _, _) = BuildService();
        // Default Mock<IDirectActionTokenService> TryValidate returns false (out params default).

        var result = await svc.ResetPasswordAsync(RawToken, "New-Password-123", TestLogin(), CancellationToken.None);

        Assert.Equal(ClientPasswordResetResultStatus.InvalidOrExpiredToken, result.Status);
        directActionTokenDal.Verify(d => d.GetByHashAsync(It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()), Times.Never);
        clientUserDal.Verify(d => d.GetByIdAsync(It.IsAny<int>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()), Times.Never);
    }

    [Fact]
    public async Task Test_ResetPasswordAsync_WrongActionCode_IsInvalid()
    {
        var (svc, _, tokenService, directActionTokenDal, _, _) = BuildService();
        SetupValidToken(tokenService, actionCode: "SOME_OTHER_ACTION");

        var result = await svc.ResetPasswordAsync(RawToken, "New-Password-123", TestLogin(), CancellationToken.None);

        Assert.Equal(ClientPasswordResetResultStatus.InvalidOrExpiredToken, result.Status);
        directActionTokenDal.Verify(d => d.GetByHashAsync(It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()), Times.Never);
    }

    [Fact]
    public async Task Test_ResetPasswordAsync_AlreadyUsedToken_IsInvalid_NoPasswordChange()
    {
        var (svc, clientUserDal, tokenService, directActionTokenDal, _, _) = BuildService();
        SetupValidToken(tokenService);
        directActionTokenDal.Setup(d => d.GetByHashAsync(It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(new DirectActionTokenDTO { TokenHash = "already-used-hash", Status = 1 });

        var result = await svc.ResetPasswordAsync(RawToken, "New-Password-123", TestLogin(), CancellationToken.None);

        Assert.Equal(ClientPasswordResetResultStatus.InvalidOrExpiredToken, result.Status);
        directActionTokenDal.Verify(d => d.InsertUsedAsync(It.IsAny<DirectActionTokenDTO>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()), Times.Never);
        clientUserDal.Verify(d => d.UpdatePasswordHashAsync(It.IsAny<int>(), It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()), Times.Never);
    }

    [Fact]
    public async Task Test_ResetPasswordAsync_ClientUserNotFound_IsInvalid()
    {
        var (svc, clientUserDal, tokenService, directActionTokenDal, _, _) = BuildService();
        SetupValidToken(tokenService, contextId: 999);
        directActionTokenDal.Setup(d => d.GetByHashAsync(It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync((DirectActionTokenDTO?)null);
        clientUserDal.Setup(d => d.GetByIdAsync(999, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync((ClientUserDTO?)null);

        var result = await svc.ResetPasswordAsync(RawToken, "New-Password-123", TestLogin(), CancellationToken.None);

        Assert.Equal(ClientPasswordResetResultStatus.InvalidOrExpiredToken, result.Status);
        directActionTokenDal.Verify(d => d.InsertUsedAsync(It.IsAny<DirectActionTokenDTO>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()), Times.Never);
    }

    [Fact]
    public async Task Test_ResetPasswordAsync_TenantMismatch_IsInvalid()
    {
        var (svc, clientUserDal, tokenService, directActionTokenDal, _, _) = BuildService();
        // Token names contextId=1/tenantId=ClientId, but the ClientUser row actually belongs to a
        // DIFFERENT client — should never happen for a genuine token, but defended against anyway.
        SetupValidToken(tokenService, contextId: 1, tenantId: ClientId);
        directActionTokenDal.Setup(d => d.GetByHashAsync(It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync((DirectActionTokenDTO?)null);
        var mismatchedUser = ActiveUser(clientUserId: 1);
        mismatchedUser.ClientId = ClientId + 1;
        clientUserDal.Setup(d => d.GetByIdAsync(1, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(mismatchedUser);

        var result = await svc.ResetPasswordAsync(RawToken, "New-Password-123", TestLogin(), CancellationToken.None);

        Assert.Equal(ClientPasswordResetResultStatus.InvalidOrExpiredToken, result.Status);
    }

    [Fact]
    public async Task Test_ResetPasswordAsync_Success_UpdatesPasswordHash_AndConsumesToken()
    {
        var (svc, clientUserDal, tokenService, directActionTokenDal, _, _) = BuildService();
        SetupValidToken(tokenService, contextId: 1);
        directActionTokenDal.Setup(d => d.GetByHashAsync(It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync((DirectActionTokenDTO?)null);
        clientUserDal.Setup(d => d.GetByIdAsync(1, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(ActiveUser(clientUserId: 1));

        string? capturedHash = null;
        clientUserDal
            .Setup(d => d.UpdatePasswordHashAsync(1, It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Callback<int, string, LoginDTO, DbTransaction, CancellationToken>((_, hash, _, _, _) => capturedHash = hash)
            .Returns(Task.CompletedTask);

        const string newPassword = "Brand-New-Password-456";
        var result = await svc.ResetPasswordAsync(RawToken, newPassword, TestLogin(), CancellationToken.None);

        Assert.Equal(ClientPasswordResetResultStatus.Success, result.Status);
        Assert.NotNull(capturedHash);
        Assert.True(PasswordHasher.Verify(newPassword, capturedHash!));

        directActionTokenDal.Verify(d => d.InsertUsedAsync(
            It.Is<DirectActionTokenDTO>(t => t.ContextId == 1 && t.ActionCode == "ENTITLEMENT_PWRESET" && t.Status == 1),
            It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()), Times.Once);
    }

    [Fact]
    public async Task Test_ResetPasswordAsync_Success_OnLockedAccount_ReactivatesAndClearsFailedLoginCount()
    {
        var (svc, clientUserDal, tokenService, directActionTokenDal, _, _) = BuildService();
        SetupValidToken(tokenService, contextId: 1);
        directActionTokenDal.Setup(d => d.GetByHashAsync(It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync((DirectActionTokenDTO?)null);
        clientUserDal.Setup(d => d.GetByIdAsync(1, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(ActiveUser(clientUserId: 1, status: (byte)ClientUserStatusEnum.Locked));

        byte? capturedStatus = null;
        short? capturedCount = null;
        clientUserDal
            .Setup(d => d.UpdateStatusAndFailedLoginCountAsync(1, It.IsAny<byte>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Callback<int, byte, short, LoginDTO, DbTransaction, CancellationToken>((_, status, count, _, _, _) =>
            {
                capturedStatus = status;
                capturedCount  = count;
            })
            .Returns(Task.CompletedTask);

        var result = await svc.ResetPasswordAsync(RawToken, "Brand-New-Password-456", TestLogin(), CancellationToken.None);

        Assert.Equal(ClientPasswordResetResultStatus.Success, result.Status);
        Assert.Equal((byte)ClientUserStatusEnum.Active, capturedStatus);
        Assert.Equal((short)0, capturedCount);
    }

    [Fact]
    public async Task Test_ResetPasswordAsync_Success_OnActiveAccount_KeepsActive_ClearsFailedLoginCount()
    {
        var (svc, clientUserDal, tokenService, directActionTokenDal, _, _) = BuildService();
        SetupValidToken(tokenService, contextId: 1);
        directActionTokenDal.Setup(d => d.GetByHashAsync(It.IsAny<string>(), It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync((DirectActionTokenDTO?)null);
        clientUserDal.Setup(d => d.GetByIdAsync(1, It.IsAny<LoginDTO>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(ActiveUser(clientUserId: 1, status: (byte)ClientUserStatusEnum.Active));

        byte? capturedStatus = null;
        clientUserDal
            .Setup(d => d.UpdateStatusAndFailedLoginCountAsync(1, It.IsAny<byte>(), It.IsAny<short>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Callback<int, byte, short, LoginDTO, DbTransaction, CancellationToken>((_, status, _, _, _, _) => capturedStatus = status)
            .Returns(Task.CompletedTask);

        var result = await svc.ResetPasswordAsync(RawToken, "Brand-New-Password-456", TestLogin(), CancellationToken.None);

        Assert.Equal(ClientPasswordResetResultStatus.Success, result.Status);
        Assert.Equal((byte)ClientUserStatusEnum.Active, capturedStatus);
    }
}