using System.Security.Claims;
using Microsoft.AspNetCore.Components.Authorization;
using NSubstitute;
using ZB.MOM.WW.ScadaBridge.CentralUI.Services;
using ZB.MOM.WW.ScadaBridge.Security;

namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Services;

public class AuthorizedManualFailoverTests
{
    /// <summary>Verifies that an administrator whose role has been revoked cannot dispatch a manual failover to central or a site.</summary>
    /// <param name="site">True to target a site failover, or false to target the central cluster.</param>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Theory]
    [InlineData(false)]
    [InlineData(true)]
    public async Task RevokedAdmin_CannotDispatchCentralOrSite(bool site)
    {
        var auth = Substitute.For<AuthenticationStateProvider>();
        var identity = new ClaimsIdentity([new Claim(JwtTokenService.RoleClaimType, Roles.Administrator)], "test");
        auth.GetAuthenticationStateAsync().Returns(new AuthenticationState(new ClaimsPrincipal(identity)));
        var backend = Substitute.For<IManualFailoverService>();
        var service = new AuthorizedManualFailoverService(auth, backend);
        identity.RemoveClaim(identity.FindFirst(JwtTokenService.RoleClaimType)!);
        if (site) await Assert.ThrowsAsync<UnauthorizedAccessException>(() => service.FailOverSiteAsync("plant"));
        else await Assert.ThrowsAsync<UnauthorizedAccessException>(() => service.FailOverCentralAsync());
        await backend.DidNotReceiveWithAnyArgs().FailOverCentralAsync(default!);
        await backend.DidNotReceiveWithAnyArgs().FailOverSiteAsync(default!, default!);
    }
}