using Microsoft.Extensions.Logging.Abstractions;
using Microsoft.Extensions.Options;
using Shouldly;
using Xunit;
using ZB.MOM.WW.OtOpcUa.Cluster;
using ZB.MOM.WW.OtOpcUa.ControlPlane.Communication;
using ZB.MOM.WW.Secrets.Abstractions;

namespace ZB.MOM.WW.OtOpcUa.ControlPlane.Tests.Communication;

/// <summary>
///     ClusterClient→gRPC Phase 0 — central's per-cluster PSK lookup. Central talks to N site
///     clusters, each with its own key, so every outbound dial and every inbound ack verification
///     goes through here.
/// </summary>
/// <remarks>
///     The tests that matter are the adversarial ones: the store being down, the key being absent
///     or blank, and the cache handing back a value the store no longer agrees with. Every one of
///     those must end in "no key" — the caller then denies or skips, never proceeds unauthenticated.
/// </remarks>
public sealed class MeshPskProviderTests
{
    private static MeshPskProvider CreateProvider(
        ISecretResolver resolver,
        Dictionary<string, string>? clusterPsks = null)
    {
        var options = new MeshTransportOptions();
        if (clusterPsks is not null)
        {
            foreach (var (key, value) in clusterPsks)
                options.ClusterPsks[key] = value;
        }

        return new MeshPskProvider(
            Options.Create(options), resolver, NullLogger<MeshPskProvider>.Instance);
    }

    [Fact]
    public void ConfigMapEntry_IsReturned_WithoutConsultingTheSecretStore()
    {
        var resolver = new FakeSecretResolver();
        var provider = CreateProvider(
            resolver, new Dictionary<string, string> { ["SITE-A"] = "rig-psk-site-a" });

        provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();

        psk.ShouldBe("rig-psk-site-a");
        resolver.CallCount.ShouldBe(0);
    }

    [Fact]
    public void ConfigMapEntry_WinsOverTheSecretStore()
    {
        // The map exists so a rig can supply literals without standing up a KEK. If the store also
        // holds a key for that cluster the map must still win, or a stale store row would silently
        // beat the value the operator just set.
        var resolver = new FakeSecretResolver { Value = "stored-psk" };
        var provider = CreateProvider(
            resolver, new Dictionary<string, string> { ["SITE-A"] = "rig-psk-site-a" });

        provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();

        psk.ShouldBe("rig-psk-site-a");
        resolver.CallCount.ShouldBe(0);
    }

    [Fact]
    public void ConfigMapLookup_IsCaseInsensitive()
    {
        // MeshTransport__ClusterPsks__site-a and __SITE-A are the same cluster. The map's comparer
        // (set on MeshTransportOptions) is what makes that true; this pins the pairing.
        var resolver = new FakeSecretResolver();
        var provider = CreateProvider(
            resolver, new Dictionary<string, string> { ["SITE-A"] = "rig-psk-site-a" });

        provider.TryGetPsk("site-a", out var psk).ShouldBeTrue();

        psk.ShouldBe("rig-psk-site-a");
    }

    [Fact]
    public void BlankConfigMapEntry_FallsThroughToTheSecretStore()
    {
        // A blank map entry is an empty environment variable, not a decision. Treat it as absent
        // rather than as an empty key that an empty bearer would satisfy.
        var resolver = new FakeSecretResolver { Value = "stored-psk" };
        var provider = CreateProvider(
            resolver, new Dictionary<string, string> { ["SITE-A"] = "   " });

        provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();

        psk.ShouldBe("stored-psk");
        resolver.CallCount.ShouldBe(1);
    }

    [Fact]
    public void SecretStoreValue_IsReturned_UnderTheConventionalName()
    {
        var resolver = new FakeSecretResolver { Value = "stored-psk" };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();

        psk.ShouldBe("stored-psk");
        // SecretName normalizes to lowercase — the same normalization ${secret:OT-MESH-PSK-SITE-A}
        // goes through in the pre-host expander, so both paths address one row.
        resolver.LastName.ShouldBe("ot-mesh-psk-site-a");
    }

    [Fact]
    public void UnknownCluster_FailsClosed()
    {
        // Absent secret + no map entry. The caller denies; it must never fall back to "no auth".
        var resolver = new FakeSecretResolver { Value = null };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk("SITE-Z", out var psk).ShouldBeFalse();

        psk.ShouldBeNull();
    }

    [Fact]
    public void BlankSecretValue_FailsClosed()
    {
        // A row that decrypts to whitespace is a broken seed, not a key. Accepting it would make
        // "Bearer    " a valid credential for the whole cluster.
        var resolver = new FakeSecretResolver { Value = "   " };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk("SITE-A", out var psk).ShouldBeFalse();

        psk.ShouldBeNull();
    }

    [Fact]
    public void ResolverThrow_FailsClosed()
    {
        // The store is a local SQLite file with an env KEK; a missing KEK throws rather than
        // returning null. Any failure is "no key", never an exception escaping into the gRPC gate.
        var resolver = new FakeSecretResolver { Throw = new InvalidOperationException("KEK unavailable") };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk("SITE-A", out var psk).ShouldBeFalse();

        psk.ShouldBeNull();
    }

    [Fact]
    public void ResolverThrow_IsNotCached_SoRecoveryNeedsNoInvalidate()
    {
        // Caching a negative would turn a transient store fault into a permanent outage for that
        // cluster, recoverable only by a restart or a hook nothing calls yet.
        var resolver = new FakeSecretResolver { Throw = new InvalidOperationException("KEK unavailable") };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk("SITE-A", out _).ShouldBeFalse();

        resolver.Throw = null;
        resolver.Value = "stored-psk";

        provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
        psk.ShouldBe("stored-psk");
    }

    [Fact]
    public void ResolvedValue_IsCached_SoTheStoreIsHitOnce()
    {
        var resolver = new FakeSecretResolver { Value = "stored-psk" };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
        provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
        provider.TryGetPsk("site-a", out _).ShouldBeTrue();

        resolver.CallCount.ShouldBe(1);
    }

    [Fact]
    public void Cache_ServesTheStaleValue_UntilInvalidated()
    {
        // Both directions matter: stale-until-invalidated is the whole reason Invalidate exists, and
        // an invalidate that did not actually re-read would be indistinguishable from a no-op.
        var resolver = new FakeSecretResolver { Value = "first-psk" };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk("SITE-A", out var first).ShouldBeTrue();
        first.ShouldBe("first-psk");

        resolver.Value = "rotated-psk";

        provider.TryGetPsk("SITE-A", out var stale).ShouldBeTrue();
        stale.ShouldBe("first-psk");

        provider.Invalidate("SITE-A");

        provider.TryGetPsk("SITE-A", out var fresh).ShouldBeTrue();
        fresh.ShouldBe("rotated-psk");
    }

    [Fact]
    public void Invalidate_IsCaseInsensitive_AndScopedToOneCluster()
    {
        var resolver = new FakeSecretResolver { Value = "first-psk" };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
        provider.TryGetPsk("SITE-B", out _).ShouldBeTrue();

        resolver.Value = "rotated-psk";
        provider.Invalidate("site-a");

        provider.TryGetPsk("SITE-A", out var a).ShouldBeTrue();
        a.ShouldBe("rotated-psk");

        provider.TryGetPsk("SITE-B", out var b).ShouldBeTrue();
        b.ShouldBe("first-psk");
    }

    [Fact]
    public void Invalidate_OnACacheMiss_IsANoOp()
    {
        var resolver = new FakeSecretResolver { Value = "stored-psk" };
        var provider = CreateProvider(resolver);

        Should.NotThrow(() => provider.Invalidate("never-seen"));

        provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
        psk.ShouldBe("stored-psk");
    }

    [Fact]
    public void InvalidateAll_DropsEveryCluster()
    {
        var resolver = new FakeSecretResolver { Value = "first-psk" };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
        provider.TryGetPsk("SITE-B", out _).ShouldBeTrue();

        resolver.Value = "rotated-psk";
        provider.InvalidateAll();

        provider.TryGetPsk("SITE-A", out var a).ShouldBeTrue();
        provider.TryGetPsk("SITE-B", out var b).ShouldBeTrue();

        a.ShouldBe("rotated-psk");
        b.ShouldBe("rotated-psk");
    }

    [Theory]
    [InlineData("")]
    [InlineData("   ")]
    public void BlankClusterId_FailsClosed(string clusterId)
    {
        var resolver = new FakeSecretResolver { Value = "stored-psk" };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk(clusterId, out var psk).ShouldBeFalse();

        psk.ShouldBeNull();
        resolver.CallCount.ShouldBe(0);
    }

    [Fact]
    public void ClusterIdThatCannotFormASecretName_FailsClosed()
    {
        // Cluster ids are operator-authored; SecretName's allow-list is [a-z0-9._/-]. A '$' throws
        // out of the SecretName ctor, and that throw must become "no key", not a 500 in the gate.
        var resolver = new FakeSecretResolver { Value = "stored-psk" };
        var provider = CreateProvider(resolver);

        provider.TryGetPsk("SITE$A", out var psk).ShouldBeFalse();

        psk.ShouldBeNull();
        resolver.CallCount.ShouldBe(0);
    }

    [Fact]
    public async Task ConcurrentCallers_ResolveOnce_AndAllSeeTheSameValue()
    {
        // The gRPC gate calls this from every inbound ack, on arbitrary thread-pool threads. A
        // non-atomic fill would stampede the store and could hand two callers different keys.
        var gate = new SemaphoreSlim(0, 1);
        var resolver = new FakeSecretResolver { Value = "stored-psk", Gate = gate };
        var provider = CreateProvider(resolver);

        var callers = Enumerable.Range(0, 16).Select(_ => Task.Run(() =>
        {
            provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
            return psk;
        })).ToArray();

        gate.Release();
        var results = await Task.WhenAll(callers);

        results.ShouldAllBe(r => r == "stored-psk");
        resolver.CallCount.ShouldBe(1);
    }

    /// <summary>
    ///     An <see cref="ISecretResolver"/> whose answer the test controls between calls, so cache
    ///     staleness and invalidation are observable without a real store.
    /// </summary>
    private sealed class FakeSecretResolver : ISecretResolver
    {
        private int _callCount;

        /// <summary>What <see cref="GetAsync"/> returns when <see cref="Throw"/> is null.</summary>
        public string? Value { get; set; }

        /// <summary>When set, <see cref="GetAsync"/> throws it instead of returning.</summary>
        public Exception? Throw { get; set; }

        /// <summary>When set, the first call waits on it — used to force a concurrent stampede.</summary>
        public SemaphoreSlim? Gate { get; set; }

        /// <summary>How many times the store was consulted.</summary>
        public int CallCount => Volatile.Read(ref _callCount);

        /// <summary>The name of the most recently requested secret.</summary>
        public string? LastName { get; private set; }

        public async Task<string?> GetAsync(SecretName name, CancellationToken ct)
        {
            LastName = name.Value;
            Interlocked.Increment(ref _callCount);

            if (Gate is not null)
                await Gate.WaitAsync(ct).ConfigureAwait(false);

            if (Throw is not null)
                throw Throw;

            return Value;
        }
    }
}