using Microsoft.Extensions.Configuration;

namespace ZB.MOM.WW.ScadaBridge.Host.Tests;

/// <summary>
/// Tests for StartupValidator configuration validation.
/// </summary>
public class StartupValidatorTests
{
    private static IConfiguration BuildConfig(Dictionary<string, string?> values)
    {
        return new ConfigurationBuilder()
            .AddInMemoryCollection(values)
            .Build();
    }

    private static Dictionary<string, string?> ValidCentralConfig() => new()
    {
        ["ScadaBridge:Node:Role"] = "Central",
        ["ScadaBridge:Node:NodeHostname"] = "central-node1",
        ["ScadaBridge:Node:RemotingPort"] = "8081",
        ["ScadaBridge:Database:ConfigurationDb"] = "Server=localhost;Database=Config;",
        ["ScadaBridge:Database:MachineDataDb"] = "Server=localhost;Database=MachineData;",
        ["ScadaBridge:Security:Ldap:Server"] = "ldap.example.com",
        ["ScadaBridge:Security:JwtSigningKey"] = "test-signing-key-at-least-32-chars-long",
        ["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@central-node1:8081",
        ["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@central-node2:8081",
        // 1fcc4f5: Central requires a pepper (≥16 chars) for the inbound-API peppered-HMAC verifier.
        ["ScadaBridge:InboundApi:ApiKeyPepper"] = "test-pepper-01234567890",
    };

    private static Dictionary<string, string?> ValidSiteConfig() => new()
    {
        ["ScadaBridge:Node:Role"] = "Site",
        ["ScadaBridge:Node:NodeHostname"] = "site-a-node1",
        ["ScadaBridge:Node:SiteId"] = "SiteA",
        ["ScadaBridge:Node:RemotingPort"] = "8082",
        ["ScadaBridge:Database:SiteDbPath"] = "./data/scadabridge.db",
        ["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@site-a-node1:8082",
        ["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@site-a-node2:8082",
        // The gRPC control plane is fail-closed, so a Site node without a preshared
        // key serves nothing while still looking healthy. Required at boot for that reason.
        ["ScadaBridge:Communication:GrpcPsk"] = "test-site-control-plane-key",
        // Phase 4: gRPC (CentralControlService) is the only site→central transport, so a Site
        // node must list at least one central gRPC endpoint to dial (no Akka fallback remains).
        ["ScadaBridge:Communication:CentralGrpcEndpoints:0"] = "http://central-a:8083",
        // The site hot-path audit writer's SQLite file has no
        // default path (mirrors LocalDb:Path) — required so it lands on the mounted data volume,
        // not the container's ephemeral overlayfs.
        ["AuditLog:SiteWriter:DatabasePath"] = "/app/data/auditlog.db",
    };

    /// <summary>Verifies that a valid central config passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void ValidCentralConfig_PassesValidation()
    {
        var config = BuildConfig(ValidCentralConfig());
        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that a valid site config passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void ValidSiteConfig_PassesValidation()
    {
        var config = BuildConfig(ValidSiteConfig());
        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that a site without gRPC PSK fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void SiteWithoutGrpcPsk_FailsValidation()
    {
        // The failure this prevents is silent: ControlPlaneAuthInterceptor refuses every
        // SiteStream call without a key, so the node boots, joins its pair, reports healthy —
        // and serves no live streams, no audit pulls and no cached-telemetry ingest. Central
        // sees a site that is up and answering heartbeats but never sends anything.
        var values = ValidSiteConfig();
        values.Remove("ScadaBridge:Communication:GrpcPsk");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("GrpcPsk", ex.Message);
    }

    /// <summary>Verifies that a site with a blank gRPC PSK fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void SiteWithBlankGrpcPsk_FailsValidation()
    {
        // Whitespace is not a key. An empty-string value would otherwise satisfy a
        // key-present check while leaving the interceptor in its fail-closed state.
        var values = ValidSiteConfig();
        values["ScadaBridge:Communication:GrpcPsk"] = "   ";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("GrpcPsk", ex.Message);
    }

    /// <summary>Verifies that a central node without gRPC PSK passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CentralWithoutGrpcPsk_PassesValidation()
    {
        // Central holds one key PER SITE (SitePsks / the secret store), not a single key of
        // its own, so this setting is meaningless there and must not be required.
        var config = BuildConfig(ValidCentralConfig());

        Assert.Null(Record.Exception(() => StartupValidator.Validate(config)));
    }

    /// <summary>Verifies that a site without central gRPC endpoints fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void SiteWithoutCentralGrpcEndpoints_FailsValidation()
    {
        // Phase 4: gRPC (CentralControlService) is the only site→central transport, so a Site
        // node with no central gRPC endpoint has nothing to dial — heartbeats, health, notification
        // forwards and audit ingest all silently fail. Fail fast at boot instead.
        var values = ValidSiteConfig();
        values.Remove("ScadaBridge:Communication:CentralGrpcEndpoints:0");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("CentralGrpcEndpoints", ex.Message);
    }

    /// <summary>Verifies that a central node without central gRPC endpoints passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CentralWithoutCentralGrpcEndpoints_PassesValidation()
    {
        // A central node hosts CentralControlService; it does not dial it, so it declares no
        // endpoints. The site-only requirement must not fire for Central.
        var config = BuildConfig(ValidCentralConfig());

        Assert.Null(Record.Exception(() => StartupValidator.Validate(config)));
    }

    /// <summary>Verifies that a site without audit log database path fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void SiteWithoutAuditLogDatabasePath_FailsValidation()
    {
        // SqliteAuditWriterOptions.DatabasePath has no default
        // (mirrors LocalDb:Path). An unset value used to fall back to a bare "auditlog.db"
        // resolved relative to CWD — on the docker rig, the container's ephemeral overlayfs —
        // so the node booted, looked healthy, and lost its pending audit backlog on every
        // recreate. Fail fast at boot instead.
        var values = ValidSiteConfig();
        values.Remove("AuditLog:SiteWriter:DatabasePath");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("DatabasePath", ex.Message);
    }

    /// <summary>Verifies that a site with a blank audit log database path fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void SiteWithBlankAuditLogDatabasePath_FailsValidation()
    {
        var values = ValidSiteConfig();
        values["AuditLog:SiteWriter:DatabasePath"] = "   ";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("DatabasePath", ex.Message);
    }

    /// <summary>Verifies that a central node without audit log database path passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CentralWithoutAuditLogDatabasePath_PassesValidation()
    {
        // AddAuditLog binds SqliteAuditWriterOptions on both roles, but only Site nodes ever
        // resolve the writer — the requirement must not fire for Central.
        var config = BuildConfig(ValidCentralConfig());

        Assert.Null(Record.Exception(() => StartupValidator.Validate(config)));
    }

    /// <summary>Verifies that a missing role fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void MissingRole_FailsValidation()
    {
        var values = ValidCentralConfig();
        values.Remove("ScadaBridge:Node:Role");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("Role must be 'Central' or 'Site'", ex.Message);
    }

    /// <summary>Verifies that an invalid role fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void InvalidRole_FailsValidation()
    {
        var values = ValidCentralConfig();
        values["ScadaBridge:Node:Role"] = "Unknown";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("Role must be 'Central' or 'Site'", ex.Message);
    }

    /// <summary>Verifies that an empty hostname fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void EmptyHostname_FailsValidation()
    {
        var values = ValidCentralConfig();
        values["ScadaBridge:Node:NodeHostname"] = "";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("NodeHostname is required", ex.Message);
    }

    /// <summary>Verifies that a missing hostname fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void MissingHostname_FailsValidation()
    {
        var values = ValidCentralConfig();
        values.Remove("ScadaBridge:Node:NodeHostname");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("NodeHostname is required", ex.Message);
    }

    /// <summary>Verifies that an invalid port fails validation.</summary>
    /// <param name="port">The port.</param>
    /// <returns>The result.</returns>
    [Theory]
    [InlineData("0")]
    [InlineData("-1")]
    [InlineData("65536")]
    [InlineData("abc")]
    [InlineData("")]
    public void InvalidPort_FailsValidation(string port)
    {
        var values = ValidCentralConfig();
        values["ScadaBridge:Node:RemotingPort"] = port;
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("RemotingPort must be 1-65535", ex.Message);
    }

    /// <summary>Verifies that a valid port passes validation.</summary>
    /// <param name="port">The port.</param>
    /// <returns>The result.</returns>
    [Theory]
    [InlineData("1")]
    [InlineData("8081")]
    [InlineData("65535")]
    public void ValidPort_PassesValidation(string port)
    {
        var values = ValidCentralConfig();
        values["ScadaBridge:Node:RemotingPort"] = port;
        // The self-first seed rule (2026-07-22) compares host AND port, so this node's own
        // seed entry moves with its remoting port — otherwise this port-range test would be
        // asserting against a config that is inconsistent for an unrelated reason.
        values["ScadaBridge:Cluster:SeedNodes:0"] = $"akka.tcp://scadabridge@central-node1:{port}";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that a site without a site id fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_MissingSiteId_FailsValidation()
    {
        var values = ValidSiteConfig();
        values.Remove("ScadaBridge:Node:SiteId");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("SiteId is required for Site nodes", ex.Message);
    }

    /// <summary>Verifies that a central node missing configuration database fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Central_MissingConfigurationDb_FailsValidation()
    {
        var values = ValidCentralConfig();
        values.Remove("ScadaBridge:Database:ConfigurationDb");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("ConfigurationDb connection string required for Central", ex.Message);
    }

    /// <summary>Verifies that a central node missing machine data database fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Central_MissingMachineDataDb_FailsValidation()
    {
        // The host requirements require MachineDataDb to be
        // validated at startup for Central nodes, and the shipped docker appsettings
        // (docker/central-node-a/appsettings.Central.json and central-node-b) carry
        // the key. The earlier decision (which removed the Require) is reversed
        // here: a missing MachineDataDb must fail fast with a clear error.
        var values = ValidCentralConfig();
        values.Remove("ScadaBridge:Database:MachineDataDb");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("MachineDataDb connection string required for Central", ex.Message);
    }

    /// <summary>Verifies that a central node missing LDAP server fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Central_MissingLdapServer_FailsValidation()
    {
        // The LDAP server key nests under Security:Ldap now. The pre-host
        // preflight validates the nested key and still fails fast for Central.
        var values = ValidCentralConfig();
        values.Remove("ScadaBridge:Security:Ldap:Server");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("Ldap:Server required for Central", ex.Message);
    }

    /// <summary>Verifies that a central node missing JWT signing key fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Central_MissingJwtSigningKey_FailsValidation()
    {
        var values = ValidCentralConfig();
        values.Remove("ScadaBridge:Security:JwtSigningKey");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("JwtSigningKey required for Central", ex.Message);
    }

    /// <summary>Verifies that a central node missing API key pepper fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Central_MissingApiKeyPepper_FailsValidation()
    {
        // Guard for 1fcc4f5: Central nodes require a pepper (≥16 chars) to back
        // the inbound-API peppered-HMAC verifier. A missing pepper must fail fast
        // so a misconfigured deployment is caught before the actor system starts.
        var values = ValidCentralConfig();
        values.Remove("ScadaBridge:InboundApi:ApiKeyPepper");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("ApiKeyPepper", ex.Message);
    }

    /// <summary>Verifies that a central node with a short API key pepper fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Central_ShortApiKeyPepper_FailsValidation()
    {
        // Guard for 1fcc4f5: a pepper shorter than 16 characters must also be rejected.
        var values = ValidCentralConfig();
        values["ScadaBridge:InboundApi:ApiKeyPepper"] = "tooshort";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("ApiKeyPepper", ex.Message);
    }

    /// <summary>Verifies that a site does not require an API key pepper.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_ApiKeyPepper_NotRequired()
    {
        // Site nodes do not host the inbound API, so the pepper must NOT be required
        // for them — absence must not fail validation.
        var values = ValidSiteConfig();
        // Explicitly ensure no pepper is present
        values.Remove("ScadaBridge:InboundApi:ApiKeyPepper");
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>
    /// The inverse of the rule this replaces. SiteDbPath was mandatory for Site
    /// nodes until LocalDb Phase 2 moved the site tables into the consolidated
    /// LocalDb database; it now names only the legacy file the boot-time migrator
    /// drains, so its absence means "nothing to migrate". Requiring it would make
    /// every already-migrated node carry a dead key forever.
    /// </summary>
    [Fact]
    public void Site_MissingSiteDbPath_IsAccepted_BecauseThePathIsMigrationOnly()
    {
        var values = ValidSiteConfig();
        values.Remove("ScadaBridge:Database:SiteDbPath");
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that fewer than two seed nodes fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void FewerThanTwoSeedNodes_FailsValidation()
    {
        var values = ValidCentralConfig();
        values.Remove("ScadaBridge:Cluster:SeedNodes:1");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("SeedNodes must have at least 2 entries", ex.Message);
    }

    /// <summary>Verifies that having no seed nodes fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void NoSeedNodes_FailsValidation()
    {
        var values = ValidCentralConfig();
        values.Remove("ScadaBridge:Cluster:SeedNodes:0");
        values.Remove("ScadaBridge:Cluster:SeedNodes:1");
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("SeedNodes must have at least 2 entries", ex.Message);
    }

    /// <summary>Verifies that a peer-first seed order fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void PeerFirstSeedOrder_FailsValidation()
    {
        // Decision 2026-07-22: every node must list ITSELF as seed-nodes[0]. Akka only runs
        // FirstSeedNodeProcess (the process that can form a new cluster when no peer answers)
        // when seed-nodes[0] is this node's own address; with the peer first the node can
        // never cold-start alone — the "registered outage gap".
        var values = ValidCentralConfig();
        values["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@central-node2:8081";
        values["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@central-node1:8081";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("SeedNodes", ex.Message);
        Assert.Contains("must list this node itself first", ex.Message);
    }

    /// <summary>Verifies that a self-first seed order on a site node passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void SelfFirstSeedOrder_OnASiteNode_PassesValidation()
    {
        // Positive control for the rule above: the shipped ordering must validate on a Site
        // node too (the rule is unconditional, not Central-only).
        var config = BuildConfig(ValidSiteConfig());

        var ex = Record.Exception(() => StartupValidator.Validate(config));

        Assert.Null(ex);
    }

    /// <summary>Verifies that the self-first seed check matches on host and port, not just host.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void SelfFirstSeed_MatchedOnHostAndPort_NotJustHost()
    {
        // Both nodes of a pair can share a hostname when they differ by port (a two-node
        // dev/loopback install). The rule must compare host AND port, or such a node passes
        // while actually being the non-first seed.
        var values = ValidCentralConfig();
        values["ScadaBridge:Node:NodeHostname"] = "localhost";
        values["ScadaBridge:Node:RemotingPort"] = "8082";
        values["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@localhost:8081";
        values["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@localhost:8082";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("must list this node itself first", ex.Message);
    }

    /// <summary>Verifies that a site with an invalid gRPC port fails validation.</summary>
    /// <param name="grpcPort">The grpc port.</param>
    /// <returns>The result.</returns>
    [Theory]
    [InlineData("0")]
    [InlineData("-1")]
    [InlineData("65536")]
    [InlineData("abc")]
    public void Site_InvalidGrpcPort_FailsValidation(string grpcPort)
    {
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:GrpcPort"] = grpcPort;
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("GrpcPort must be 1-65535", ex.Message);
    }

    /// <summary>Verifies that a site with a valid gRPC port passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_ValidGrpcPort_PassesValidation()
    {
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:GrpcPort"] = "8083";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that an invalid gRPC port is not validated on a central node.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Central_InvalidGrpcPort_NotValidated()
    {
        var values = ValidCentralConfig();
        values["ScadaBridge:Node:GrpcPort"] = "0";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that a site seed node on the gRPC port fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_SeedNodeOnGrpcPort_FailsValidation()
    {
        // Regression: a site seed node must reference an Akka remoting
        // endpoint, never the Kestrel HTTP/2 gRPC port. A seed node whose port
        // equals this node's GrpcPort would make a joining node attempt an
        // Akka.Remote TCP association against the gRPC listener and fail.
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:GrpcPort"] = "8083";
        values["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@site-a-node1:8083";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("must not target the gRPC port", ex.Message);
    }

    /// <summary>Verifies that a site seed node on the metrics port fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_SeedNodeOnMetricsPort_FailsValidation()
    {
        // Review 01 [Medium]: appsettings.Site.json shipped a seed pointing at the
        // Kestrel HTTP/1.1 metrics listener (8084) — a doomed Akka.Remote
        // association. The validator guarded GrpcPort but not MetricsPort.
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:GrpcPort"] = "8083";
        values["ScadaBridge:Node:MetricsPort"] = "8084";
        values["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@site-a-node1:8084";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("must not target the metrics port", ex.Message);
    }

    /// <summary>Verifies that a site seed node on the default metrics port fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_SeedNodeOnDefaultMetricsPort_FailsValidation()
    {
        // MetricsPort absent => NodeOptions default 8084. A seed on 8084 must
        // still be rejected. Keep GrpcPort distinct so only the metrics rule fires.
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:GrpcPort"] = "8083";
        values["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@site-a-node2:8084";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("must not target the metrics port", ex.Message);
    }

    /// <summary>Verifies that a site seed node on the default gRPC port fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_SeedNodeOnDefaultGrpcPort_FailsValidation()
    {
        // GrpcPort is absent here, so the NodeOptions default of 8083 applies.
        // A seed node on 8083 must still be rejected.
        var values = ValidSiteConfig();
        values["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@site-a-node2:8083";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("must not target the gRPC port", ex.Message);
    }

    /// <summary>Verifies that site seed nodes on the remoting port pass validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_SeedNodesOnRemotingPort_PassesValidation()
    {
        // Two distinct site nodes, both seed entries on the remoting port (8082).
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:GrpcPort"] = "8083";
        values["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@site-a-node1:8082";
        values["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@site-a-node2:8082";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that a central seed node on port 8083 passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Central_SeedNodeOnPort8083_PassesValidation()
    {
        // The gRPC-port rule applies to Site nodes only. A Central node has no
        // GrpcPort, so a seed node on 8083 must not be rejected.
        var values = ValidCentralConfig();
        values["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@central-node2:8083";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that a site gRPC port equal to the remoting port fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_GrpcPortEqualsRemotingPort_FailsValidation()
    {
        // Regression: the host requirements require GrpcPort to differ from
        // RemotingPort. Identical values cause Kestrel and Akka.Remote to
        // contend for the same port at runtime.
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:RemotingPort"] = "8082";
        values["ScadaBridge:Node:GrpcPort"] = "8082";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("GrpcPort must differ from RemotingPort", ex.Message);
    }

    /// <summary>Verifies that a site default gRPC port equal to the remoting port fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_DefaultGrpcPortEqualsRemotingPort_FailsValidation()
    {
        // GrpcPort absent => NodeOptions default 8083. A site whose RemotingPort
        // is also 8083 must still be rejected.
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:RemotingPort"] = "8083";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("GrpcPort must differ from RemotingPort", ex.Message);
    }

    /// <summary>Verifies that a site gRPC port that differs from the remoting port passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_GrpcPortDiffersFromRemotingPort_PassesValidation()
    {
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:RemotingPort"] = "8082";
        values["ScadaBridge:Node:GrpcPort"] = "8083";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that a site with an invalid metrics port fails validation.</summary>
    /// <param name="metricsPort">The metrics port.</param>
    /// <returns>The result.</returns>
    [Theory]
    [InlineData("0")]
    [InlineData("-1")]
    [InlineData("65536")]
    [InlineData("abc")]
    public void Site_InvalidMetricsPort_FailsValidation(string metricsPort)
    {
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:MetricsPort"] = metricsPort;
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("MetricsPort must be 1-65535", ex.Message);
    }

    /// <summary>Verifies that a site with a valid metrics port passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_ValidMetricsPort_PassesValidation()
    {
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:MetricsPort"] = "8084";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that a site metrics port equal to the remoting port fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_MetricsPortEqualsRemotingPort_FailsValidation()
    {
        // Regression: the Kestrel metrics (HTTP/1.1) listener port must
        // differ from RemotingPort. Identical values cause the metrics listener
        // and Akka.Remote to contend for the same port at runtime.
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:RemotingPort"] = "8082";
        values["ScadaBridge:Node:MetricsPort"] = "8082";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("MetricsPort must differ from RemotingPort", ex.Message);
    }

    /// <summary>Verifies that a site metrics port equal to the gRPC port fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_MetricsPortEqualsGrpcPort_FailsValidation()
    {
        // Regression: the metrics listener port must differ from GrpcPort.
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:GrpcPort"] = "8083";
        values["ScadaBridge:Node:MetricsPort"] = "8083";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("MetricsPort must differ from GrpcPort", ex.Message);
    }

    /// <summary>Verifies that a site default metrics port equal to the remoting port fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_DefaultMetricsPortEqualsRemotingPort_FailsValidation()
    {
        // MetricsPort absent => NodeOptions default 8084. A site whose RemotingPort
        // is also 8084 must still be rejected.
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:RemotingPort"] = "8084";
        // Keep GrpcPort distinct so only the metrics-vs-remoting rule fires.
        values["ScadaBridge:Node:GrpcPort"] = "8083";
        // Seed nodes default to the remoting port (8082) in ValidSiteConfig; realign
        // them to 8084 so the seed-vs-grpc rule is not what trips here.
        values["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@site-a-node1:8084";
        values["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@site-a-node2:8084";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("MetricsPort must differ from RemotingPort", ex.Message);
    }

    /// <summary>Verifies that a site metrics port that differs from the remoting and gRPC ports passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Site_MetricsPortDiffersFromRemotingAndGrpc_PassesValidation()
    {
        var values = ValidSiteConfig();
        values["ScadaBridge:Node:RemotingPort"] = "8082";
        values["ScadaBridge:Node:GrpcPort"] = "8083";
        values["ScadaBridge:Node:MetricsPort"] = "8084";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that an invalid metrics port is not validated on a central node.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Central_InvalidMetricsPort_NotValidated()
    {
        // The metrics-port rules apply to Site nodes only; a Central node runs no
        // metrics listener, so an out-of-range MetricsPort must not fail startup.
        var values = ValidCentralConfig();
        values["ScadaBridge:Node:MetricsPort"] = "0";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that collecting warnings warns for a two-seed central node on SQLite.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CollectWarnings_WarnsForTwoSeedCentralOnSqlite()
    {
        // Design 2026-09-02: the inbound API key store is per-node SQLite by default, so a
        // 2+-node central cluster is one failover away from rejecting every inbound client.
        // Secrets:Store:Provider is set to SqlServer here to isolate this warning from the
        // independent one added for task 5 (ClusteredCentral_SqliteSecretStore_Warns below).
        var values = ValidCentralConfig();
        values["Secrets:Store:Provider"] = "SqlServer";
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        var warning = Assert.Single(warnings);
        Assert.Contains("2-node", warning);
        Assert.Contains("SQLite", warning);
        Assert.Contains("Provider=SqlServer", warning);
    }

    /// <summary>Verifies that collecting warnings warns when the provider is explicitly SQLite.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CollectWarnings_WarnsWhenProviderExplicitlySqlite()
    {
        var values = ValidCentralConfig();
        values["ScadaBridge:InboundApi:ApiKeyStore:Provider"] = "sqlite";
        values["Secrets:Store:Provider"] = "SqlServer";
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        Assert.Single(warnings);
    }

    /// <summary>Verifies that collecting warnings is silent for SQL Server.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CollectWarnings_SilentForSqlServer()
    {
        var values = ValidCentralConfig();
        values["ScadaBridge:InboundApi:ApiKeyStore:Provider"] = "SqlServer";
        values["Secrets:Store:Provider"] = "SqlServer";
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        Assert.Empty(warnings);
    }

    /// <summary>Verifies that a clustered central node on a SQLite secret store produces a warning.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void ClusteredCentral_SqliteSecretStore_Warns()
    {
        // A clustered central left on the per-node SQLite secret store silently drifts
        // the moment anyone edits a secret on only one node, then ships an inconsistent set to
        // sites. ApiKeyStore:Provider is set to SqlServer here to isolate this warning from the
        // pre-existing one above.
        var values = ValidCentralConfig();
        values["ScadaBridge:InboundApi:ApiKeyStore:Provider"] = "SqlServer";
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        var warning = Assert.Single(warnings);
        Assert.Contains("clustered central", warning);
        Assert.Contains("SQLite", warning);
        Assert.Contains("Secrets:Store:Provider=SqlServer", warning);
    }

    /// <summary>Verifies that a clustered central node on a SQL Server secret store produces no warning.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void ClusteredCentral_SqlServerSecretStore_Silent()
    {
        var values = ValidCentralConfig();
        values["ScadaBridge:InboundApi:ApiKeyStore:Provider"] = "SqlServer";
        values["Secrets:Store:Provider"] = "SqlServer";
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        Assert.Empty(warnings);
    }

    /// <summary>
    /// Secrets replication (the gRPC hub, and the SQL-Server ReplicatingSecretStore mode
    /// that preceded it) is retired in ScadaBridge — sites receive secrets exclusively via Deploy
    /// Artifacts, and a replicated site store would publish DeployedSecretsMirror's local deletes
    /// fleet-wide. Checked on BOTH roles: a Site used to be the gRPC hub's follower half, so the
    /// flag was never Central-only. Replaces the old warning-suppression test
    /// (ClusteredCentral_ReplicationEnabled_NoSecretsStoreWarning) — that suppression is gone too,
    /// because CollectWarnings never runs with this flag true on a config that also passed
    /// Validate.
    /// </summary>
    /// <param name="value">The rejected replication flag value.</param>
    [Theory]
    [InlineData("true")]
    [InlineData("True")]
    // These are not valid booleans. GetValue<bool> used to throw a raw
    // OptionsValidationException-style binder crash on them instead of the designed message; the
    // key is read as a raw string now, so any non-"false" value is "set" and rejected the same way.
    [InlineData("yes")]
    [InlineData("1")]
    public void ReplicationEnabled_IsRejected_OnCentral(string value)
    {
        var values = ValidCentralConfig();
        values["Secrets:Replication:Enabled"] = value;
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));

        Assert.Contains(
            "Secrets replication (the gRPC hub) is retired in ScadaBridge", ex.Message);
        Assert.Contains("sites receive secrets with Deploy Artifacts", ex.Message);
        Assert.Contains("central uses Secrets:Store:Provider=SqlServer", ex.Message);
    }

    /// <summary>Verifies that enabling secrets replication is rejected on a site.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void ReplicationEnabled_IsRejected_OnSite()
    {
        var values = ValidSiteConfig();
        values["Secrets:Replication:Enabled"] = "true";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));

        Assert.Contains(
            "Secrets replication (the gRPC hub) is retired in ScadaBridge", ex.Message);
    }

    /// <summary>Verifies that disabling secrets replication passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void ReplicationDisabled_PassesValidation()
    {
        // Explicit false must not be confused with "set" — the default posture every existing
        // deployment ships stays valid.
        var values = ValidCentralConfig();
        values["Secrets:Replication:Enabled"] = "false";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));

        Assert.Null(ex);
    }

    /// <summary>Verifies that a case-insensitive replication-disabled value passes validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void ReplicationDisabled_CaseInsensitive_PassesValidation()
    {
        var values = ValidCentralConfig();
        values["Secrets:Replication:Enabled"] = "FALSE";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));

        Assert.Null(ex);
    }

    /// <summary>
    /// Deliberately stricter than <c>bool</c> parsing (review feedback): only an absent
    /// key or exactly (case-insensitively) <c>"false"</c> is safe. <c>"0"</c> is a legal
    /// <c>bool.TryParse</c>-adjacent falsy spelling in some conventions but is NOT exempted here —
    /// a leftover key this malformed should surface the retirement message, not silently pass.
    /// </summary>
    [Fact]
    public void ReplicationEnabled_Zero_IsRejected()
    {
        var values = ValidCentralConfig();
        values["Secrets:Replication:Enabled"] = "0";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));

        Assert.Contains(
            "Secrets replication (the gRPC hub) is retired in ScadaBridge", ex.Message);
    }

    /// <summary>
    /// A leftover <c>Secrets:Replication</c>/<c>Secrets:GrpcHub</c> key
    /// from before secrets replication was retired is not itself a boot failure (Validate already rejects Enabled=true
    /// outright), but every OTHER key under either section is now silently ignored — worth a
    /// Warning so an operator cleans up QA/prod appsettings.
    /// </summary>
    [Fact]
    public void CollectWarnings_WarnsForLeftoverReplicationModeKey()
    {
        var values = ValidCentralConfig();
        values["Secrets:Store:Provider"] = "SqlServer";
        values["Secrets:Replication:Mode"] = "SqlServer";
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        Assert.Contains(warnings, w =>
            w.Contains("Secrets:Replication / Secrets:GrpcHub settings are ignored", StringComparison.Ordinal)
            && w.Contains("the secrets hub is retired; remove them", StringComparison.Ordinal));
    }

    /// <summary>Verifies that collecting warnings warns for a leftover gRPC hub key.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CollectWarnings_WarnsForLeftoverGrpcHubKey()
    {
        var values = ValidCentralConfig();
        values["Secrets:Store:Provider"] = "SqlServer";
        values["Secrets:GrpcHub:BearerToken"] = "stale-leftover-token";
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        Assert.Contains(warnings, w =>
            w.Contains("Secrets:Replication / Secrets:GrpcHub settings are ignored", StringComparison.Ordinal));
    }

    /// <summary>Verifies that collecting warnings warns for leftover keys on a site too.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CollectWarnings_WarnsForLeftoverKeys_OnSiteToo()
    {
        // The warning is not central-scoped: a Site config can carry leftover GrpcHub follower
        // settings just as easily.
        var values = ValidSiteConfig();
        values["Secrets:GrpcHub:Endpoint"] = "http://stale-central:8083";
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        Assert.Contains(warnings, w =>
            w.Contains("Secrets:Replication / Secrets:GrpcHub settings are ignored", StringComparison.Ordinal));
    }

    /// <summary>Verifies that collecting warnings is silent for a bare replication-enabled false value.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CollectWarnings_SilentForBareReplicationEnabledFalse()
    {
        // "Enabled: false" alone is the normal, still-valid shape of every existing deployment's
        // config (it is what ships in appsettings.json) — this must NOT warn just because the
        // Secrets:Replication section exists.
        var values = ValidCentralConfig();
        values["Secrets:Store:Provider"] = "SqlServer";
        values["Secrets:Replication:Enabled"] = "false";
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        Assert.DoesNotContain(warnings, w =>
            w.Contains("Secrets:Replication / Secrets:GrpcHub settings are ignored", StringComparison.Ordinal));
    }

    /// <summary>Verifies that collecting warnings is silent when neither section is present.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CollectWarnings_SilentWhenNeitherSectionPresent()
    {
        var values = ValidCentralConfig();
        values["Secrets:Store:Provider"] = "SqlServer";
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        Assert.DoesNotContain(warnings, w =>
            w.Contains("Secrets:Replication / Secrets:GrpcHub settings are ignored", StringComparison.Ordinal));
    }

    /// <summary>Verifies that collecting warnings is silent for a single-seed central node.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CollectWarnings_SilentForSingleSeedCentral()
    {
        // CollectWarnings is independent of Validate's own >=2-seeds requirement — it should
        // simply not fire the failover warning when there is nothing to fail over to.
        var values = ValidCentralConfig();
        values.Remove("ScadaBridge:Cluster:SeedNodes:1");
        var config = BuildConfig(values);

        var warnings = StartupValidator.CollectWarnings(config);

        Assert.Empty(warnings);
    }

    /// <summary>Verifies that collecting warnings is silent for a site.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void CollectWarnings_SilentForSite()
    {
        var config = BuildConfig(ValidSiteConfig());

        var warnings = StartupValidator.CollectWarnings(config);

        Assert.Empty(warnings);
    }

    /// <summary>Verifies that validation rejects an unknown API key store provider.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Validate_RejectsUnknownApiKeyStoreProvider()
    {
        var values = ValidCentralConfig();
        values["ScadaBridge:InboundApi:ApiKeyStore:Provider"] = "Postgres";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("ScadaBridge:InboundApi:ApiKeyStore:Provider", ex.Message);
    }

    /// <summary>Verifies that validation accepts the API key store provider case-insensitively.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Validate_AcceptsProviderCaseInsensitively()
    {
        var values = ValidCentralConfig();
        values["ScadaBridge:InboundApi:ApiKeyStore:Provider"] = "SQLSERVER";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that an unknown secret store provider fails validation.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void UnknownSecretStoreProvider_Fails()
    {
        var values = ValidCentralConfig();
        values["Secrets:Store:Provider"] = "Postgres";
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("Secrets:Store:Provider", ex.Message);
    }

    /// <summary>Verifies that validation accepts the secret store provider case-insensitively.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void Validate_AcceptsSecretStoreProviderCaseInsensitively()
    {
        var values = ValidCentralConfig();
        values["Secrets:Store:Provider"] = "sqlserver";
        var config = BuildConfig(values);

        var ex = Record.Exception(() => StartupValidator.Validate(config));
        Assert.Null(ex);
    }

    /// <summary>Verifies that multiple errors are all reported.</summary>
    /// <returns>The result.</returns>
    [Fact]
    public void MultipleErrors_AllReported()
    {
        var values = new Dictionary<string, string?>
        {
            // Role is missing, hostname is missing, port is missing
        };
        var config = BuildConfig(values);

        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
        Assert.Contains("Role must be 'Central' or 'Site'", ex.Message);
        Assert.Contains("NodeHostname is required", ex.Message);
        Assert.Contains("RemotingPort must be 1-65535", ex.Message);
        Assert.Contains("SeedNodes must have at least 2 entries", ex.Message);
    }
}