using System.Data.Common;
using EntitlementBLL.Common;
using EntitlementBLL.Implementations;
using EntitlementBLL.Interfaces;
using EntitlementBLL.Options;
using EntitlementDAL.DTOs;
using EntitlementDAL.Interfaces;
using GB5Shared.DTO.Framework.CommonConfig;
using GB5Shared.DTO.Framework.Login;
using GB5Shared.GenerateAutoNumber;
using GB5Shared.QueryExecutor;
using Microsoft.Extensions.Logging.Abstractions;
using Microsoft.Extensions.Options;
using Moq;
using Xunit;

namespace EntitlementTests;

/// <summary>
/// ECDSA bundle sign/verify round-trip — all repos mocked, no real DB/Redis. Uses the
/// dev-fallback ephemeral key path (EcdsaKeyOptions left empty) since no real key is committed.
/// </summary>
public class EntitlementBundleTests
{
    private static (EntitlementBundleService svc, Mock<IBundleDAL> bundleDal) BuildService()
    {
        var entitlementService = new Mock<IEntitlementService>();
        entitlementService
            .Setup(s => s.GetResolvedBundleAsync(It.IsAny<int>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(new EntitlementBundleDto
            {
                TenantId      = 42,
                Subscriptions = new List<int> { 1 },
                Entitlements  = new List<BundleEntitlementItemDto>
                {
                    new() { Feature = "MOD.INVENTORY", Enabled = true }
                },
                Licenses     = new Dictionary<string, BundleLicenseItemDto>(),
                BetaPrograms = new List<string>(),
                ValidUntil   = DateTime.UtcNow.AddHours(1),
                IssuedAt     = DateTime.UtcNow
            });

        var bundleDal = new Mock<IBundleDAL>();
        bundleDal.Setup(b => b.ExpirePriorCurrentAsync(It.IsAny<int>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);
        bundleDal.Setup(b => b.SaveAsync(It.IsAny<BundleDTO>(), It.IsAny<LoginDTO>(), It.IsAny<DbTransaction>(), It.IsAny<CancellationToken>()))
            .Returns(Task.CompletedTask);

        // Real AutoNumber wired to a mocked IQueryExecutor — AutoNumber.GetNumberAsync is not
        // virtual, so it can't be mocked directly; instead mock the QueryAsync<long> call it makes
        // internally to simulate the MAUTONUMBER increment round-trip.
        var queryExecutor = new Mock<IQueryExecutor>();
        queryExecutor
            .Setup(q => q.QueryAsync<long>(It.IsAny<LoginDTO>(), It.IsAny<string>(), It.IsAny<object>(),
                It.IsAny<DbTransaction>(), It.IsAny<bool>(), It.IsAny<CancellationToken>()))
            .ReturnsAsync(new List<long> { 100 });
        queryExecutor
            .Setup(q => q.BeginTransactionAsync(It.IsAny<LoginDTO>()))
            .ReturnsAsync((DbTransaction)null!);
        queryExecutor.Setup(q => q.CommitAsync(It.IsAny<DbTransaction>())).Returns(Task.CompletedTask);
        queryExecutor.Setup(q => q.RollbackAsync(It.IsAny<DbTransaction>())).Returns(Task.CompletedTask);

        var dbConfig = new Mock<IOptionsSnapshot<Gb5SystemDTO>>();
        dbConfig.Setup(o => o.Value).Returns(new Gb5SystemDTO { DataBaseType = 0 });
        var autoNumber = new AutoNumber(queryExecutor.Object, dbConfig.Object);

        var loginFactory = new Mock<IEntitlementLoginFactory>();
        loginFactory.Setup(f => f.Create(It.IsAny<int>(), It.IsAny<int>()))
            .Returns((int clientId, int userId) => new LoginDTO { ClientId = clientId, UserId = userId });

        // Empty EcdsaKeyOptions — exercises the dev-fallback ephemeral key path deliberately,
        // matching how this module runs before a real key is configured.
        var keyOptions = Microsoft.Extensions.Options.Options.Create(new EcdsaKeyOptions { KeyId = "test-key-1" });

        var svc = new EntitlementBundleService(
            entitlementService.Object, bundleDal.Object, autoNumber, queryExecutor.Object,
            loginFactory.Object, keyOptions, NullLogger<EntitlementBundleService>.Instance);

        return (svc, bundleDal);
    }

    [Fact]
    public async Task Test_BundleSignVerify_RoundTrip()
    {
        var (svc, _) = BuildService();

        var signed = await svc.IssueSignedBundleAsync(42, CancellationToken.None);

        Assert.NotNull(signed);
        Assert.NotEmpty(signed.Sig);
        Assert.Equal("test-key-1", signed.Kid);
        Assert.True(svc.VerifyBundle(signed));
    }

    [Fact]
    public async Task Test_BundleExpired_VerifyFails()
    {
        var (svc, _) = BuildService();

        var signed = await svc.IssueSignedBundleAsync(42, CancellationToken.None);

        // Simulate an expired bundle by rewriting ValidUntil into the past — VerifyBundle must
        // reject on expiry alone, before even re-checking the signature.
        signed.Payload.ValidUntil = DateTime.UtcNow.AddDays(-1);

        Assert.False(svc.VerifyBundle(signed));
    }
}