using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Logging.Abstractions;
using Microsoft.Extensions.Options;
using NSubstitute;
using ZB.MOM.WW.Auth.Abstractions.Ldap;
using ZB.MOM.WW.ScadaBridge.Security;
using ZB.MOM.WW.ScadaBridge.Security.Auth;

namespace ZB.MOM.WW.ScadaBridge.ManagementService.Tests;

/// <summary>
/// Bearer-token branch of <see cref="ManagementAuthenticator"/> (review 2026-10-21 05/U1, 05/P1):
/// a JWT minted by <c>/auth/token</c> authenticates the management/audit/debug surfaces without
/// an LDAP bind, and every malformed, expired, tampered, foreign-key or unsigned token is a 401.
/// </summary>
public class ManagementAuthenticatorBearerTests
{
    private const string Key = "this-is-a-test-signing-key-for-hmac-sha256-must-be-long-enough";

    private sealed class FixedClock(DateTimeOffset now) : TimeProvider
    {
        public override DateTimeOffset GetUtcNow() => now;
    }

    private static JwtTokenService Jwt(string key = Key, TimeProvider? clock = null) =>
        new(Options.Create(new SecurityOptions { JwtSigningKey = key, JwtExpiryMinutes = 15 }),
            NullLogger<JwtTokenService>.Instance, clock);

    private static (HttpContext Context, ILdapAuthService Ldap) ContextWithAuthorization(string authorization, string key = Key)
    {
        var ldap = Substitute.For<ILdapAuthService>();
        var services = new ServiceCollection();
        services.AddSingleton<IOptions<AuthDisableLoginOptions>>(
            Options.Create(new AuthDisableLoginOptions { DisableLogin = false }));
        services.AddSingleton<IOptions<SecurityOptions>>(
            Options.Create(new SecurityOptions { JwtSigningKey = key, JwtExpiryMinutes = 15 }));
        services.AddLogging();
        services.AddSingleton(ldap);
        services.AddScoped<JwtTokenService>();
        var context = new DefaultHttpContext { RequestServices = services.BuildServiceProvider() };
        context.Request.Headers.Authorization = authorization;
        return (context, ldap);
    }

    /// <summary>A valid token yields its username, roles and site scope with no LDAP bind.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task ValidBearer_AuthenticatesFromClaims_WithoutLdap()
    {
        var token = Jwt().GenerateToken("Dee Ployer", "deployer", [Roles.Deployer, Roles.Viewer], ["3", "7"]);
        var (context, ldap) = ContextWithAuthorization($"Bearer {token}");

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.Null(outcome.Failure);
        Assert.NotNull(outcome.User);
        Assert.Equal("deployer", outcome.User!.Username);
        Assert.Equal("Dee Ployer", outcome.User.DisplayName);
        Assert.Equal(new[] { Roles.Deployer, Roles.Viewer }, outcome.User.Roles);
        Assert.Equal(new[] { "3", "7" }, outcome.User.PermittedSiteIds);
        await ldap.DidNotReceiveWithAnyArgs().AuthenticateAsync(default!, default!, default);
    }

    /// <summary>A token minted without site ids is system-wide (empty permitted set), like the Basic path.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task ValidBearer_NoSiteClaims_IsSystemWide()
    {
        var token = Jwt().GenerateToken("Admin", "admin", [Roles.Administrator], null);
        var (context, _) = ContextWithAuthorization($"Bearer {token}");

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.NotNull(outcome.User);
        Assert.Empty(outcome.User!.PermittedSiteIds);
    }

    /// <summary>An expired token (past the 30 s skew) is rejected.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task ExpiredBearer_Is401()
    {
        var issuedLongAgo = Jwt(clock: new FixedClock(DateTimeOffset.UtcNow.AddMinutes(-20)));
        var token = issuedLongAgo.GenerateToken("U", "u", [Roles.Administrator], null);
        var (context, _) = ContextWithAuthorization($"Bearer {token}");

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.Null(outcome.User);
        Assert.NotNull(outcome.Failure);
    }

    /// <summary>A token whose payload was edited (privilege escalation attempt) fails the signature check.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task TamperedBearer_Is401()
    {
        var token = Jwt().GenerateToken("V", "viewer", [Roles.Viewer], null);
        var parts = token.Split('.');
        var payload = Encoding.UTF8.GetString(Base64UrlDecode(parts[1]))
            .Replace(Roles.Viewer, Roles.Administrator, StringComparison.Ordinal);
        var tampered = $"{parts[0]}.{Base64UrlEncode(Encoding.UTF8.GetBytes(payload))}.{parts[2]}";
        var (context, _) = ContextWithAuthorization($"Bearer {tampered}");

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.Null(outcome.User);
        Assert.NotNull(outcome.Failure);
    }

    /// <summary>A token signed with a different key (another environment) is rejected.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task WrongKeyBearer_Is401()
    {
        var token = Jwt("a-completely-different-signing-key-for-hmac-sha256-validation")
            .GenerateToken("A", "admin", [Roles.Administrator], null);
        var (context, _) = ContextWithAuthorization($"Bearer {token}");

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.Null(outcome.User);
        Assert.NotNull(outcome.Failure);
    }

    /// <summary>An unsigned <c>alg=none</c> token is rejected.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task UnsignedAlgNoneBearer_Is401()
    {
        var unsigned = new JwtSecurityToken(
            issuer: JwtTokenService.TokenIssuer,
            audience: JwtTokenService.TokenAudience,
            claims: [new Claim(JwtTokenService.UsernameClaimType, "admin"),
                     new Claim(JwtTokenService.RoleClaimType, Roles.Administrator)],
            expires: DateTime.UtcNow.AddMinutes(10));
        var handler = new JwtSecurityTokenHandler();
        handler.OutboundClaimTypeMap.Clear();
        var token = handler.WriteToken(unsigned); // header {"alg":"none"}, empty signature
        var (context, _) = ContextWithAuthorization($"Bearer {token}");

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.Null(outcome.User);
        Assert.NotNull(outcome.Failure);
    }

    /// <summary>Garbage after <c>Bearer</c> is a 401, not an exception.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task GarbageBearer_Is401()
    {
        var (context, _) = ContextWithAuthorization("Bearer not-a-jwt");

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.Null(outcome.User);
        Assert.NotNull(outcome.Failure);
    }

    private static string HandMinted(string key, string algorithm, string issuer, string audience)
    {
        var credentials = new Microsoft.IdentityModel.Tokens.SigningCredentials(
            new Microsoft.IdentityModel.Tokens.SymmetricSecurityKey(Encoding.UTF8.GetBytes(key)), algorithm);
        var jwt = new JwtSecurityToken(
            issuer: issuer,
            audience: audience,
            claims: [new Claim(JwtTokenService.UsernameClaimType, "admin"),
                     new Claim(JwtTokenService.RoleClaimType, Roles.Administrator)],
            expires: DateTime.UtcNow.AddMinutes(10),
            signingCredentials: credentials);
        var handler = new JwtSecurityTokenHandler();
        handler.OutboundClaimTypeMap.Clear();
        return handler.WriteToken(jwt);
    }

    /// <summary>A token signed with the right key but HS512 is rejected: only HS256 is accepted.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task Hs512WithSameKey_Is401()
    {
        // 64+ bytes so HS512 itself is satisfied; only the algorithm allow-list can reject it.
        var longKey = new string('k', 80);
        var token = HandMinted(longKey, Microsoft.IdentityModel.Tokens.SecurityAlgorithms.HmacSha512,
            JwtTokenService.TokenIssuer, JwtTokenService.TokenAudience);
        var (context, _) = ContextWithAuthorization($"Bearer {token}", longKey);

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.Null(outcome.User);
        Assert.NotNull(outcome.Failure);
    }

    /// <summary>The same key and algorithm with a hand-minted HS256 token is accepted (control for the cases below).</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task HandMintedHs256_OwnIssuerAndAudience_IsAccepted()
    {
        var token = HandMinted(Key, Microsoft.IdentityModel.Tokens.SecurityAlgorithms.HmacSha256,
            JwtTokenService.TokenIssuer, JwtTokenService.TokenAudience);
        var (context, _) = ContextWithAuthorization($"Bearer {token}");

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.NotNull(outcome.User);
    }

    /// <summary>A correctly signed token for another issuer or audience is rejected.</summary>
    /// <param name="issuer">The token's issuer.</param>
    /// <param name="audience">The token's audience.</param>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Theory]
    [InlineData("some-other-system", JwtTokenService.TokenAudience)]
    [InlineData(JwtTokenService.TokenIssuer, "some-other-audience")]
    public async Task IssuerOrAudienceMismatch_Is401(string issuer, string audience)
    {
        var token = HandMinted(Key, Microsoft.IdentityModel.Tokens.SecurityAlgorithms.HmacSha256, issuer, audience);
        var (context, _) = ContextWithAuthorization($"Bearer {token}");

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.Null(outcome.User);
        Assert.NotNull(outcome.Failure);
    }

    /// <summary>
    /// nbf is back-dated by the validation skew, so a peer node whose clock lags the issuer by
    /// up to twice the skew accepts a fresh token (review L1).
    /// </summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task FreshToken_FromIssuerAhead_IsAcceptedByLaggingPeer()
    {
        // Issuer clock 45 s ahead of this (validating) node — beyond the 30 s skew alone, within
        // skew + the nbf back-dating.
        var token = Jwt(clock: new FixedClock(DateTimeOffset.UtcNow.AddSeconds(45)))
            .GenerateToken("A", "admin", [Roles.Administrator], null);
        var (context, _) = ContextWithAuthorization($"Bearer {token}");

        var outcome = await ManagementAuthenticator.AuthenticateAsync(context);

        Assert.NotNull(outcome.User);
    }

    private static byte[] Base64UrlDecode(string s)
    {
        var padded = s.Replace('-', '+').Replace('_', '/');
        padded = padded.PadRight(padded.Length + (4 - padded.Length % 4) % 4, '=');
        return Convert.FromBase64String(padded);
    }

    private static string Base64UrlEncode(byte[] bytes) =>
        Convert.ToBase64String(bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_');
}