using System.Security.Cryptography;
using Microsoft.AspNetCore.DataProtection;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using ZB.MOM.WW.ScadaBridge.Commons.Entities.ExternalSystems;
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances;
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Notifications;
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Scripts;
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites;
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Templates;
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Transport;
using ZB.MOM.WW.ScadaBridge.Commons.Types.Transport;
using ZB.MOM.WW.ScadaBridge.ConfigurationDatabase;
using ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Repositories;
using ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Services;
using ZB.MOM.WW.ScadaBridge.Transport;
using ZB.MOM.WW.ScadaBridge.Transport.Encryption;
using ZB.MOM.WW.ScadaBridge.Transport.Serialization;
using ZB.MOM.WW.ScadaBridge.Commons.Types.Templates;

namespace ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests.Export;

/// <summary>
/// Integration tests for <see cref="ZB.MOM.WW.ScadaBridge.Transport.Export.BundleExporter"/>.
/// Builds a self-contained DI container (in-memory EF + the repositories +
/// AddTransport's pipeline) and asserts the exporter round-trips a real bundle
/// + writes the matching audit row. Using <see cref="ServiceCollection"/>
/// directly rather than <c>WebApplicationFactory</c> keeps the test focused on
/// the exporter — no HTTP, no Akka, no LDAP.
/// </summary>
public sealed class BundleExporterTests : IDisposable
{
    private readonly ServiceProvider _provider;

    public BundleExporterTests()
    {
        var services = new ServiceCollection();

        // AddTransport's BindConfiguration call needs an IConfiguration in the
        // container — an empty one is fine for these tests because the defaults
        // baked into TransportOptions are exactly what we want.
        services.AddSingleton<IConfiguration>(
            new ConfigurationBuilder().AddInMemoryCollection().Build());

        // In-memory EF — fresh database per test instance so seeded ids are
        // predictable and the audit assertions can scan the whole table. The
        // db name has to be resolved ONCE (outside the lambda) so every scope
        // resolves the same underlying InMemoryStore — otherwise each scope's
        // DbContext gets a new GUID and the seeded rows vanish between scopes.
        var dbName = $"BundleExporterTests_{Guid.NewGuid()}";
        services.AddDbContext<ScadaBridgeDbContext>(opts =>
            opts.UseInMemoryDatabase(dbName));

        // S10b: secret-bearing columns (SmsConfiguration.AuthToken, SmtpConfiguration
        // .Credentials, …) require the context's encrypting two-arg ctor with a Data
        // Protection key ring. Register an ephemeral provider and override the
        // AddDbContext registration to construct the encrypting context — mirrors the
        // production AddConfigurationDatabase wiring (and BundleImporterRollbackFailureTests).
        services.AddSingleton<IDataProtectionProvider>(new EphemeralDataProtectionProvider());
        services.AddScoped(sp => new ScadaBridgeDbContext(
            sp.GetRequiredService<DbContextOptions<ScadaBridgeDbContext>>(),
            sp.GetRequiredService<IDataProtectionProvider>()));

        // Repositories the resolver pulls from. M8 (B4): the resolver now injects
        // ISiteRepository to walk the site/data-connection/instance closure, so it
        // must be registered or the BuildServiceProvider-time graph resolution for
        // DependencyResolver fails.
        services.AddSingleton<ITemplateGraphWatermark, TemplateGraphWatermark>();
        services.AddScoped<ITemplateEngineRepository, TemplateEngineRepository>();
        services.AddScoped<IExternalSystemRepository, ExternalSystemRepository>();
        services.AddScoped<INotificationRepository, NotificationRepository>();
        services.AddScoped<IInboundApiRepository, InboundApiRepository>();
        services.AddScoped<ISiteRepository, SiteRepository>();

        // Audit pipeline — AuditService writes via the EF context + reads the
        // bundle-import correlation id from the scoped context (null here, since
        // export is not part of an import session).
        services.AddScoped<IAuditCorrelationContext, AuditCorrelationContext>();
        services.AddScoped<IAuditService, AuditService>();

        // Add the transport pipeline itself.
        services.AddTransport();

        _provider = services.BuildServiceProvider();
    }

    public void Dispose() => _provider.Dispose();

    [Fact]
    public async Task ExportAsync_writes_audit_event_and_returns_valid_bundle()
    {
        // Arrange: seed two templates (one composing the other), a shared
        // script referenced from the parent template, one external system, one
        // notification list. Names live in the script bodies / DataSourceReference
        // so the dependency resolver's substring scan picks them up.
        await using (var scope = _provider.CreateAsyncScope())
        {
            var ctx = scope.ServiceProvider.GetRequiredService<ScadaBridgeDbContext>();

            var helper = new SharedScript("HelperFn", "return 1;");
            ctx.SharedScripts.Add(helper);

            var erp = new ExternalSystemDefinition("ErpSystem", "https://erp.example", "ApiKey");
            ctx.ExternalSystemDefinitions.Add(erp);

            var list = new NotificationList("OnCall");
            ctx.NotificationLists.Add(list);
            await ctx.SaveChangesAsync();

            var baseTemplate = new Template("BaseDevice")
            {
                Description = "shared base",
            };
            // Attribute body references the helper + external system, so
            // IncludeDependencies=true pulls them in automatically.
            baseTemplate.Scripts.Add(new TemplateScript("init",
                "var x = HelperFn(); ErpSystem.Call(\"x\");"));
            ctx.Templates.Add(baseTemplate);
            await ctx.SaveChangesAsync();

            var composing = new Template("Pump")
            {
                Description = "composes BaseDevice",
            };
            ctx.Templates.Add(composing);
            await ctx.SaveChangesAsync();

            composing.Compositions.Add(new TemplateComposition("base")
            {
                TemplateId = composing.Id,
                ComposedTemplateId = baseTemplate.Id,
            });
            await ctx.SaveChangesAsync();
        }

        // Act
        Stream bundleStream;
        await using (var scope = _provider.CreateAsyncScope())
        {
            var exporter = scope.ServiceProvider.GetRequiredService<IBundleExporter>();
            var ctx = scope.ServiceProvider.GetRequiredService<ScadaBridgeDbContext>();
            var templateIds = await ctx.Templates.Select(t => t.Id).ToListAsync();

            var selection = new ExportSelection(
                TemplateIds: templateIds,
                SharedScriptIds: Array.Empty<int>(),
                ExternalSystemIds: Array.Empty<int>(),
                DatabaseConnectionIds: Array.Empty<int>(),
                NotificationListIds: Array.Empty<int>(),
                SmtpConfigurationIds: Array.Empty<int>(),
                ApiMethodIds: Array.Empty<int>(),
                IncludeDependencies: true);

            bundleStream = await exporter.ExportAsync(
                selection, user: "alice", sourceEnvironment: "dev",
                passphrase: null, cancellationToken: CancellationToken.None);
        }

        // Copy to byte[] so we can re-open the zip multiple times below.
        byte[] bundleBytes;
        using (var ms = new MemoryStream())
        {
            await bundleStream.CopyToAsync(ms);
            bundleBytes = ms.ToArray();
        }

        // Assert: non-empty, valid zip with the expected manifest + content.
        Assert.NotEmpty(bundleBytes);

        var serializer = _provider.GetRequiredService<BundleSerializer>();
        BundleManifest manifest;
        using (var ms = new MemoryStream(bundleBytes, writable: false))
        {
            manifest = serializer.ReadManifest(ms);
        }
        Assert.Equal("dev", manifest.SourceEnvironment);
        Assert.Equal("alice", manifest.ExportedBy);
        Assert.Null(manifest.Encryption);
        Assert.Equal(2, manifest.Summary.Templates);
        Assert.Equal(1, manifest.Summary.SharedScripts);
        Assert.Equal(1, manifest.Summary.ExternalSystems);

        byte[] rawContent;
        using (var ms = new MemoryStream(bundleBytes, writable: false))
        {
            rawContent = serializer.ReadContentBytes(ms, manifest);
        }
        var content = serializer.UnpackContent(rawContent, manifest, passphrase: null, encryptor: null);
        Assert.Equal(2, content.Templates.Count);
        Assert.Contains(content.Templates, t => t.Name == "BaseDevice");
        Assert.Contains(content.Templates, t => t.Name == "Pump");
        Assert.Single(content.SharedScripts);
        Assert.Equal("HelperFn", content.SharedScripts[0].Name);
        Assert.Single(content.ExternalSystems);
        Assert.Equal("ErpSystem", content.ExternalSystems[0].Name);

        // Audit row landed with the expected shape — Action discriminates the
        // unencrypted export path, EntityId is the SHA-256 of the zip bytes.
        await using (var scope = _provider.CreateAsyncScope())
        {
            var ctx = scope.ServiceProvider.GetRequiredService<ScadaBridgeDbContext>();
            var entry = await ctx.AuditLogEntries.SingleAsync();
            Assert.Equal("UnencryptedBundleExport", entry.Action);
            Assert.Equal("alice", entry.User);
            Assert.Equal("Bundle", entry.EntityType);
            Assert.Equal("dev", entry.EntityName);

            var expectedHash = "sha256:" + Convert.ToHexString(SHA256.HashData(bundleBytes))
                .ToLowerInvariant();
            Assert.Equal(expectedHash, entry.EntityId);
        }
    }

    [Fact]
    public async Task ExportAsync_emits_selected_sms_config_with_secret_and_summary_count()
    {
        // Arrange: seed one SMS provider config with a secret auth token.
        int smsId;
        await using (var scope = _provider.CreateAsyncScope())
        {
            var ctx = scope.ServiceProvider.GetRequiredService<ScadaBridgeDbContext>();
            var sms = new SmsConfiguration("AC_export_sid", "+15557654321")
            {
                AuthToken = "super-secret-token",
                MessagingServiceSid = "MG_svc",
                ApiBaseUrl = "https://api.twilio.example",
            };
            ctx.Set<SmsConfiguration>().Add(sms);
            await ctx.SaveChangesAsync();
            smsId = sms.Id;
        }

        // Act: export selecting only the SMS config.
        Stream bundleStream;
        await using (var scope = _provider.CreateAsyncScope())
        {
            var exporter = scope.ServiceProvider.GetRequiredService<IBundleExporter>();
            var selection = new ExportSelection(
                TemplateIds: Array.Empty<int>(),
                SharedScriptIds: Array.Empty<int>(),
                ExternalSystemIds: Array.Empty<int>(),
                DatabaseConnectionIds: Array.Empty<int>(),
                NotificationListIds: Array.Empty<int>(),
                SmtpConfigurationIds: Array.Empty<int>(),
                ApiMethodIds: Array.Empty<int>(),
                IncludeDependencies: false,
                SmsConfigurationIds: new[] { smsId });

            bundleStream = await exporter.ExportAsync(
                selection, user: "alice", sourceEnvironment: "dev",
                passphrase: null, cancellationToken: CancellationToken.None);
        }

        byte[] bundleBytes;
        using (var ms = new MemoryStream())
        {
            await bundleStream.CopyToAsync(ms);
            bundleBytes = ms.ToArray();
        }

        // Assert: manifest summary counts the SMS config; content carries it with
        // the auth token preserved inside the SecretsBlock.
        var serializer = _provider.GetRequiredService<BundleSerializer>();
        BundleManifest manifest;
        using (var ms = new MemoryStream(bundleBytes, writable: false))
        {
            manifest = serializer.ReadManifest(ms);
        }
        Assert.Equal(1, manifest.Summary.SmsConfigs);

        byte[] rawContent;
        using (var ms = new MemoryStream(bundleBytes, writable: false))
        {
            rawContent = serializer.ReadContentBytes(ms, manifest);
        }
        var content = serializer.UnpackContent(rawContent, manifest, passphrase: null, encryptor: null);
        Assert.Single(content.SmsConfigs);
        var dto = content.SmsConfigs[0];
        Assert.Equal("AC_export_sid", dto.AccountSid);
        Assert.Equal("+15557654321", dto.FromNumber);
        Assert.NotNull(dto.Secrets);
        Assert.True(dto.Secrets!.Values.TryGetValue("AuthToken", out var token));
        Assert.Equal("super-secret-token", token);
    }

    [Fact]
    public async Task ExportAsync_with_passphrase_produces_encrypted_bundle()
    {
        // Arrange: minimal template only — we want to exercise the encryption
        // path, not the dependency resolver.
        await using (var scope = _provider.CreateAsyncScope())
        {
            var ctx = scope.ServiceProvider.GetRequiredService<ScadaBridgeDbContext>();
            ctx.Templates.Add(new Template("Solo") { Description = "alone" });
            await ctx.SaveChangesAsync();
        }

        // Act
        Stream bundleStream;
        await using (var scope = _provider.CreateAsyncScope())
        {
            var exporter = scope.ServiceProvider.GetRequiredService<IBundleExporter>();
            var ctx = scope.ServiceProvider.GetRequiredService<ScadaBridgeDbContext>();
            var ids = await ctx.Templates.Select(t => t.Id).ToListAsync();
            var selection = new ExportSelection(
                TemplateIds: ids,
                SharedScriptIds: Array.Empty<int>(),
                ExternalSystemIds: Array.Empty<int>(),
                DatabaseConnectionIds: Array.Empty<int>(),
                NotificationListIds: Array.Empty<int>(),
                SmtpConfigurationIds: Array.Empty<int>(),
                ApiMethodIds: Array.Empty<int>(),
                IncludeDependencies: true);

            bundleStream = await exporter.ExportAsync(
                selection, user: "bob", sourceEnvironment: "stg",
                passphrase: "correct horse battery staple",
                cancellationToken: CancellationToken.None);
        }

        byte[] bundleBytes;
        using (var ms = new MemoryStream())
        {
            await bundleStream.CopyToAsync(ms);
            bundleBytes = ms.ToArray();
        }

        // Assert: manifest carries fresh encryption metadata; wrong passphrase
        // throws (AES-GCM tag mismatch); audit action is "BundleExported".
        var serializer = _provider.GetRequiredService<BundleSerializer>();
        var encryptor = _provider.GetRequiredService<BundleSecretEncryptor>();
        BundleManifest manifest;
        byte[] rawContent;
        using (var ms = new MemoryStream(bundleBytes, writable: false))
        {
            manifest = serializer.ReadManifest(ms);
        }
        using (var ms = new MemoryStream(bundleBytes, writable: false))
        {
            rawContent = serializer.ReadContentBytes(ms, manifest);
        }
        Assert.NotNull(manifest.Encryption);
        Assert.Equal("AES-256-GCM", manifest.Encryption!.Algorithm);
        Assert.False(string.IsNullOrEmpty(manifest.Encryption.SaltB64));
        Assert.False(string.IsNullOrEmpty(manifest.Encryption.IvB64));

        // Wrong passphrase fails AES-GCM tag verification — the runtime throws
        // the more specific AuthenticationTagMismatchException (a CryptographicException
        // subclass on .NET 10), so ThrowsAny is correct here.
        Assert.ThrowsAny<CryptographicException>(() =>
            serializer.UnpackContent(rawContent, manifest, "wrong", encryptor));

        // Right passphrase unpacks back to the seeded template.
        var content = serializer.UnpackContent(
            rawContent, manifest, "correct horse battery staple", encryptor);
        Assert.Single(content.Templates);
        Assert.Equal("Solo", content.Templates[0].Name);

        await using (var scope = _provider.CreateAsyncScope())
        {
            var ctx = scope.ServiceProvider.GetRequiredService<ScadaBridgeDbContext>();
            var entry = await ctx.AuditLogEntries.SingleAsync();
            Assert.Equal("BundleExported", entry.Action);
            Assert.Equal("bob", entry.User);
            Assert.Equal("stg", entry.EntityName);
        }
    }

    [Fact]
    public async Task ExportAsync_with_site_selection_packs_sites_dataconnections_and_instances()
    {
        // Arrange: a site with one data connection and one instance (on a template)
        // bound to that connection. Selecting the site pulls its data connection +
        // all its instances; the instance's binding edge proves the closure walks
        // the instance's child collections (review item I3 — proves the aggregate
        // wiring actually carries the site/instance arrays into the bundle).
        int siteId;
        await using (var scope = _provider.CreateAsyncScope())
        {
            var ctx = scope.ServiceProvider.GetRequiredService<ScadaBridgeDbContext>();

            var template = new Template("PumpStation") { Description = "for instance" };
            ctx.Templates.Add(template);

            var site = new Site("North Plant", "NORTH-01") { Description = "north site" };
            ctx.Sites.Add(site);
            await ctx.SaveChangesAsync();
            siteId = site.Id;

            var conn = new DataConnection("PlcA", "OpcUa", site.Id);
            ctx.DataConnections.Add(conn);
            await ctx.SaveChangesAsync();

            var instance = new Instance("NORTH-01.Pump1") { TemplateId = template.Id, SiteId = site.Id };
            ctx.Instances.Add(instance);
            await ctx.SaveChangesAsync();

            ctx.InstanceConnectionBindings.Add(new InstanceConnectionBinding("Flow")
            {
                InstanceId = instance.Id,
                DataConnectionId = conn.Id,
            });
            await ctx.SaveChangesAsync();
        }

        // Act: select the site (no central-config entities) with deps on, so the
        // site closure also pulls each instance's owning template — the realistic
        // "export a whole site" path.
        Stream bundleStream;
        await using (var scope = _provider.CreateAsyncScope())
        {
            var exporter = scope.ServiceProvider.GetRequiredService<IBundleExporter>();
            var selection = new ExportSelection(
                TemplateIds: Array.Empty<int>(),
                SharedScriptIds: Array.Empty<int>(),
                ExternalSystemIds: Array.Empty<int>(),
                DatabaseConnectionIds: Array.Empty<int>(),
                NotificationListIds: Array.Empty<int>(),
                SmtpConfigurationIds: Array.Empty<int>(),
                ApiMethodIds: Array.Empty<int>(),
                IncludeDependencies: true,
                SiteIds: new[] { siteId });

            bundleStream = await exporter.ExportAsync(
                selection, user: "carol", sourceEnvironment: "dev",
                passphrase: null, cancellationToken: CancellationToken.None);
        }

        byte[] bundleBytes;
        using (var ms = new MemoryStream())
        {
            await bundleStream.CopyToAsync(ms);
            bundleBytes = ms.ToArray();
        }

        // Assert: manifest summary counts the site/data-connection/instance, and
        // the unpacked content carries the actual arrays (I3 — without the
        // EntityAggregate wiring these would be empty).
        var serializer = _provider.GetRequiredService<BundleSerializer>();
        BundleManifest manifest;
        byte[] rawContent;
        using (var ms = new MemoryStream(bundleBytes, writable: false))
        {
            manifest = serializer.ReadManifest(ms);
        }
        using (var ms = new MemoryStream(bundleBytes, writable: false))
        {
            rawContent = serializer.ReadContentBytes(ms, manifest);
        }

        Assert.Equal(1, manifest.Summary.Sites);
        Assert.Equal(1, manifest.Summary.DataConnections);
        Assert.Equal(1, manifest.Summary.Instances);

        var content = serializer.UnpackContent(rawContent, manifest, passphrase: null, encryptor: null);
        Assert.Single(content.Sites);
        Assert.Equal("NORTH-01", content.Sites[0].SiteIdentifier);
        Assert.Single(content.DataConnections);
        Assert.Equal("PlcA", content.DataConnections[0].Name);
        Assert.Single(content.Instances);
        Assert.Equal("NORTH-01.Pump1", content.Instances[0].UniqueName);
        Assert.Equal("PumpStation", content.Instances[0].TemplateName);
        // The instance carries its binding, and the manifest dep-edge resolves the
        // owning site by identifier (I1) — Site:NORTH-01, never Site:<rawId>.
        Assert.Single(content.Instances[0].ConnectionBindings);
        var instanceEntry = Assert.Single(
            manifest.Contents,
            e => e.Type == "Instance" && e.Name == "NORTH-01.Pump1");
        Assert.Contains($"Site:NORTH-01", instanceEntry.DependsOn);
        Assert.DoesNotContain(instanceEntry.DependsOn, d => d == $"Site:{siteId}");
    }

    [Fact]
    public async Task ExportAsync_directly_selected_instance_records_owning_site_by_identifier()
    {
        // I1: a directly-selected instance with IncludeDependencies=false does NOT
        // pack its owning site, yet the manifest dep-edge must still read
        // Site:<identifier> (resolved via the site-identifier enrichment) rather
        // than degrading to Site:<rawId>.
        int instanceId;
        int siteId;
        await using (var scope = _provider.CreateAsyncScope())
        {
            var ctx = scope.ServiceProvider.GetRequiredService<ScadaBridgeDbContext>();

            var template = new Template("Valve") { Description = "for instance" };
            ctx.Templates.Add(template);
            var site = new Site("South Plant", "SOUTH-09") { Description = "south" };
            ctx.Sites.Add(site);
            await ctx.SaveChangesAsync();
            siteId = site.Id;

            var instance = new Instance("SOUTH-09.Valve1") { TemplateId = template.Id, SiteId = site.Id };
            ctx.Instances.Add(instance);
            await ctx.SaveChangesAsync();
            instanceId = instance.Id;
        }

        Stream bundleStream;
        await using (var scope = _provider.CreateAsyncScope())
        {
            var exporter = scope.ServiceProvider.GetRequiredService<IBundleExporter>();
            var selection = new ExportSelection(
                TemplateIds: Array.Empty<int>(),
                SharedScriptIds: Array.Empty<int>(),
                ExternalSystemIds: Array.Empty<int>(),
                DatabaseConnectionIds: Array.Empty<int>(),
                NotificationListIds: Array.Empty<int>(),
                SmtpConfigurationIds: Array.Empty<int>(),
                ApiMethodIds: Array.Empty<int>(),
                IncludeDependencies: false,
                InstanceIds: new[] { instanceId });

            bundleStream = await exporter.ExportAsync(
                selection, user: "dave", sourceEnvironment: "dev",
                passphrase: null, cancellationToken: CancellationToken.None);
        }

        byte[] bundleBytes;
        using (var ms = new MemoryStream())
        {
            await bundleStream.CopyToAsync(ms);
            bundleBytes = ms.ToArray();
        }

        var serializer = _provider.GetRequiredService<BundleSerializer>();
        BundleManifest manifest;
        using (var ms = new MemoryStream(bundleBytes, writable: false))
        {
            manifest = serializer.ReadManifest(ms);
        }

        // Instance is packed; its owning site is NOT (deps off, site not selected).
        Assert.Equal(1, manifest.Summary.Instances);
        Assert.Equal(0, manifest.Summary.Sites);

        var instanceEntry = Assert.Single(
            manifest.Contents,
            e => e.Type == "Instance" && e.Name == "SOUTH-09.Valve1");
        // I1: the dep-edge reads the portable identifier, not the raw surrogate id.
        Assert.Contains("Site:SOUTH-09", instanceEntry.DependsOn);
        Assert.DoesNotContain(instanceEntry.DependsOn, d => d == $"Site:{siteId}");
    }
}
