using System.Net.Sockets;

namespace ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests;

/// <summary>
///     Environment gate + reachability probe for the Mosquitto fixture defined in
///     <c>Docker/docker-compose.yml</c> (auth + TLS on <c>:8883</c>, authenticated plaintext on
///     <c>:1883</c>, plus a JSON publisher emitting retained messages).
///     <para>
///         <b>Unset env ⇒ skip, never fail.</b> Unlike the Modbus / S7 fixtures — which default to
///         the shared Docker host and probe it unconditionally — this one has <b>no default
///         endpoint</b>: without <c>MQTT_FIXTURE_ENDPOINT</c> the whole suite reports
///         <see cref="NotConfigured"/> and every test calls <c>Assert.Skip</c>. That is deliberate.
///         The fixture needs credentials that are generated per machine and never committed, so
///         "probe a well-known host and hope" would produce auth failures rather than a clean skip
///         on a dev box that never provisioned it. `dotnet test` on macOS with no Docker therefore
///         stays green.
///     </para>
/// </summary>
/// <remarks>
///     <para>
///         Env vars, all read once at fixture construction:
///     </para>
///     <list type="bullet">
///         <item>
///             <c>MQTT_FIXTURE_ENDPOINT</c> — <c>host:port</c> of the <b>TLS</b> listener, e.g.
///             <c>10.100.0.35:8883</c>. <b>The gate</b>: absent ⇒ the whole suite skips.
///         </item>
///         <item>
///             <c>MQTT_FIXTURE_PLAIN_ENDPOINT</c> — <c>host:port</c> of the plaintext listener.
///             Defaults to the TLS host on port 1883.
///         </item>
///         <item>
///             <c>MQTT_FIXTURE_USERNAME</c> / <c>MQTT_FIXTURE_PASSWORD</c> — the broker credentials
///             <c>gen-fixture-material.sh</c> was run with. The password has no default and is
///             never committed; without it the suite skips.
///         </item>
///         <item>
///             <c>MQTT_FIXTURE_CA_CERT</c> — path to the fixture CA (<c>secrets/ca.crt</c>).
///             Optional: supplied, the TLS legs pin to it and the CA-pin test runs; absent, the
///             connect legs fall back to <c>AllowUntrustedServerCertificate</c> and the pin test
///             skips.
///         </item>
///         <item>
///             <c>MQTT_FIXTURE_TOPIC_PREFIX</c> — must match the publisher's. Default
///             <c>otopcua/fixture</c>.
///         </item>
///     </list>
///     <para>
///         The probe is one-shot and its socket is closed immediately: tests open their own real
///         <see cref="MqttConnection"/> / <see cref="MqttDriver"/> sessions, and sharing a socket
///         would serialise them.
///     </para>
/// </remarks>
public sealed class MqttFixture
{
    /// <summary>The gate: absent ⇒ the whole suite skips.</summary>
    public const string EndpointEnvVar = "MQTT_FIXTURE_ENDPOINT";

    /// <summary>Optional override for the plaintext listener; defaults to the TLS host on 1883.</summary>
    public const string PlainEndpointEnvVar = "MQTT_FIXTURE_PLAIN_ENDPOINT";

    /// <summary>Broker username; defaults to the generator script's own default.</summary>
    public const string UsernameEnvVar = "MQTT_FIXTURE_USERNAME";

    /// <summary>Broker password. No default — a defaulted fixture password is a committed secret.</summary>
    public const string PasswordEnvVar = "MQTT_FIXTURE_PASSWORD";

    /// <summary>Path to the fixture CA PEM, for the CA-pin legs.</summary>
    public const string CaCertEnvVar = "MQTT_FIXTURE_CA_CERT";

    /// <summary>Topic prefix the fixture publisher emits under.</summary>
    public const string TopicPrefixEnvVar = "MQTT_FIXTURE_TOPIC_PREFIX";

    private const string DefaultUsername = "otopcua";
    private const string DefaultTopicPrefix = "otopcua/fixture";
    private const int DefaultPlainPort = 1883;

    private static readonly TimeSpan ProbeTimeout = TimeSpan.FromSeconds(3);

    /// <summary>Initializes a new instance of the <see cref="MqttFixture"/> class.</summary>
    public MqttFixture()
    {
        Username = Environment.GetEnvironmentVariable(UsernameEnvVar) is { Length: > 0 } u ? u : DefaultUsername;
        Password = Environment.GetEnvironmentVariable(PasswordEnvVar);
        TopicPrefix = Environment.GetEnvironmentVariable(TopicPrefixEnvVar) is { Length: > 0 } p
            ? p.TrimEnd('/')
            : DefaultTopicPrefix;

        var caPath = Environment.GetEnvironmentVariable(CaCertEnvVar);
        CaCertificatePath = string.IsNullOrWhiteSpace(caPath) ? null : caPath;

        var tlsRaw = Environment.GetEnvironmentVariable(EndpointEnvVar);
        if (string.IsNullOrWhiteSpace(tlsRaw))
        {
            SkipReason =
                $"Skipped: set {EndpointEnvVar} (e.g. 10.100.0.35:8883) plus {UsernameEnvVar}/{PasswordEnvVar} to run "
                + "the MQTT fixture live suite. Bring the fixture up first — see "
                + "tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/docker-compose.yml.";
            return;
        }

        (TlsHost, TlsPort) = ParseEndpoint(tlsRaw, defaultPort: 8883);

        var plainRaw = Environment.GetEnvironmentVariable(PlainEndpointEnvVar);
        (PlainHost, PlainPort) = string.IsNullOrWhiteSpace(plainRaw)
            ? (TlsHost, DefaultPlainPort)
            : ParseEndpoint(plainRaw, DefaultPlainPort);

        if (string.IsNullOrEmpty(Password))
        {
            // A blank password is NOT a valid "anonymous" configuration for this fixture — the
            // broker runs allow_anonymous false — so treat it as unconfigured rather than letting
            // every test fail with an indistinguishable "not authorized".
            SkipReason =
                $"Skipped: {EndpointEnvVar} is set but {PasswordEnvVar} is not. The fixture broker runs "
                + "allow_anonymous=false; supply the password gen-fixture-material.sh was run with.";
            return;
        }

        // Probe the TLS listener: it is the endpoint the gate names, and a broker that is up serves
        // both listeners from one process.
        SkipReason = Probe(TlsHost, TlsPort);
    }

    /// <summary>Gets the TLS listener host.</summary>
    public string TlsHost { get; } = string.Empty;

    /// <summary>Gets the TLS listener port.</summary>
    public int TlsPort { get; }

    /// <summary>Gets the plaintext listener host.</summary>
    public string PlainHost { get; } = string.Empty;

    /// <summary>Gets the plaintext listener port.</summary>
    public int PlainPort { get; }

    /// <summary>Gets the broker username.</summary>
    public string Username { get; }

    /// <summary>Gets the broker password, or <see langword="null"/> when unconfigured.</summary>
    public string? Password { get; }

    /// <summary>Gets the fixture CA PEM path, or <see langword="null"/> when not supplied.</summary>
    public string? CaCertificatePath { get; }

    /// <summary>Gets the topic prefix the fixture publisher emits under (no trailing slash).</summary>
    public string TopicPrefix { get; }

    /// <summary>
    ///     Gets the reason every test in the suite must skip, or <see langword="null"/> when the
    ///     fixture is configured and reachable.
    /// </summary>
    public string? SkipReason { get; }

    /// <summary>Gets a value indicating whether the suite must skip.</summary>
    public bool NotConfigured => SkipReason is not null;

    /// <summary>Composes a fixture topic under <see cref="TopicPrefix"/>.</summary>
    /// <param name="suffix">The topic suffix, e.g. <c>line1/temperature</c>.</param>
    /// <returns>The full topic.</returns>
    public string Topic(string suffix) => $"{TopicPrefix}/{suffix.TrimStart('/')}";

    private static (string Host, int Port) ParseEndpoint(string raw, int defaultPort)
    {
        var parts = raw.Trim().Split(':', 2);
        var port = parts.Length == 2 && int.TryParse(parts[1], out var parsed) ? parsed : defaultPort;
        return (parts[0], port);
    }

    private static string? Probe(string host, int port)
    {
        try
        {
            using var client = new TcpClient();
            var connect = client.ConnectAsync(host, port);
            if (!connect.Wait(ProbeTimeout) || !client.Connected)
            {
                return Unreachable(host, port, $"no TCP connection within {ProbeTimeout.TotalSeconds:0}s");
            }
        }
        catch (Exception ex)
        {
            return Unreachable(host, port, $"{ex.GetType().Name}: {ex.Message}");
        }

        return null;
    }

    private static string Unreachable(string host, int port, string detail) =>
        $"Skipped: the MQTT fixture broker at {host}:{port} is configured but unreachable ({detail}). "
        + "Bring the stack up on the Docker host: "
        + "`ssh dohertj2@10.100.0.35 'cd /opt/otopcua-mqtt && MQTT_FIXTURE_USERNAME=... MQTT_FIXTURE_PASSWORD=... docker compose up -d'`.";
}

/// <summary>
///     Collection definition so the reachability probe runs once per test session rather than once
///     per test — probing a firewalled endpoint per test would burn the probe timeout each time.
/// </summary>
[Xunit.CollectionDefinition(Name)]
public sealed class MqttFixtureCollection : Xunit.ICollectionFixture<MqttFixture>
{
    /// <summary>The collection name.</summary>
    public const string Name = "MqttFixture";
}