using Microsoft.AspNetCore.Components.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Options;
using NSubstitute;
using ZB.MOM.WW.Auth.Abstractions.Roles;
using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
using ZB.MOM.WW.ScadaBridge.Security;

namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Auth;

/// <summary>
/// Review 2026-10-21 07/P-3: a non-authoritative <see cref="CookieAuthenticationStateProvider.GetAuthenticationStateAsync"/>
/// no longer re-runs the role mapping on every read — it reuses the circuit's last revalidation
/// for <see cref="CookieAuthenticationStateProvider.NonAuthoritativeRefreshInterval"/> — while
/// <see cref="CookieAuthenticationStateProvider.GetAuthoritativeStateAsync"/> (mutation gates)
/// still re-maps every time.
/// </summary>
public class CookieAuthenticationStateMemoTests
{
    private sealed class MutableClock : TimeProvider
    {
        public DateTimeOffset Now { get; set; } = DateTimeOffset.UtcNow;

        public override DateTimeOffset GetUtcNow() => Now;
    }

    private static (CookieAuthenticationStateProvider Auth, IGroupRoleMapper<string> Mapper, MutableClock Clock, ServiceProvider Provider) Create()
    {
        var clock = new MutableClock();
        var mapping = new RoleMappingResult([Roles.Designer], [], false);
        var mapper = Substitute.For<IGroupRoleMapper<string>>();
        mapper.MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>())
            .Returns(_ => new GroupRoleMapping<string>(mapping.Roles, Scope: mapping));
        var initial = SessionClaimBuilder.Build("alice", "Alice", ["group"], mapping, clock.Now);
        var services = new ServiceCollection().AddLogging();
        services.AddSingleton(mapper);
        services.AddSingleton<TimeProvider>(clock);
        services.AddSingleton(Options.Create(new SecurityOptions()));
        services.AddScoped<CookieSessionValidator>();
        services.AddSingleton<IHttpContextAccessor>(new HttpContextAccessor { HttpContext = new DefaultHttpContext { User = initial } });
        services.AddScoped<AuthenticationStateProvider, CookieAuthenticationStateProvider>();
        var provider = services.BuildServiceProvider();
        var auth = (CookieAuthenticationStateProvider)provider.CreateScope().ServiceProvider.GetRequiredService<AuthenticationStateProvider>();
        return (auth, mapper, clock, provider);
    }

    /// <summary>Repeated display reads within the window run the role mapping once.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task NonAuthoritativeReads_WithinWindow_MapOnce()
    {
        var (auth, mapper, _, provider) = Create();
        using var _p = provider;

        for (var i = 0; i < 5; i++)
            Assert.Equal("alice", (await auth.GetCurrentUsernameAsync()));

        await mapper.Received(1).MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>());
    }

    /// <summary>After the window the next display read revalidates again.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task NonAuthoritativeRead_AfterWindow_Revalidates()
    {
        var (auth, mapper, clock, provider) = Create();
        using var _p = provider;

        await auth.GetAuthenticationStateAsync();
        clock.Now += CookieAuthenticationStateProvider.NonAuthoritativeRefreshInterval + TimeSpan.FromSeconds(1);
        await auth.GetAuthenticationStateAsync();

        await mapper.Received(2).MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>());
    }

    /// <summary>Authoritative reads (mutation gates) always re-map, even inside the window.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task AuthoritativeReads_AlwaysRemap()
    {
        var (auth, mapper, _, provider) = Create();
        using var _p = provider;

        await auth.GetAuthenticationStateAsync();
        await auth.GetAuthoritativeStateAsync();
        await auth.GetAuthoritativeStateAsync();

        await mapper.Received(3).MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>());
    }
}