using Microsoft.EntityFrameworkCore;
using ZB.MOM.WW.OtOpcUa.Configuration;
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;

namespace ZB.MOM.WW.OtOpcUa.Host.OpcUa;

/// <summary>
///     <see cref="IApiKeyStore"/> reading the config database directly (#520, stage 2). Usable on a node
///     that has a ConfigDb — i.e. one carrying the <c>admin</c> role, including a fused admin+driver node.
/// </summary>
/// <remarks>
///     <b>A driver-only node has no ConfigDb since per-cluster mesh Phase 4</b>, so this store cannot be
///     registered there; that node uses <see cref="ArtifactApiKeyStore"/> instead (#520 stage 4).
///     <para>
///         Reading per request is what makes revocation immediate here, which is why this store is
///         preferred wherever a ConfigDb exists — including on a fused admin+driver node.
///     </para>
/// </remarks>
public sealed class ConfigDbApiKeyStore : IApiKeyStore
{
    private readonly IDbContextFactory<OtOpcUaConfigDbContext> _factory;

    /// <summary>Initializes a new instance of the <see cref="ConfigDbApiKeyStore"/> class.</summary>
    /// <param name="factory">The config DB context factory.</param>
    public ConfigDbApiKeyStore(IDbContextFactory<OtOpcUaConfigDbContext> factory) => _factory = factory;

    /// <inheritdoc />
    public async Task<ApiKeyLookup?> FindAsync(string apiKeyId, DateTime utcNow, CancellationToken ct)
    {
        await using var db = await _factory.CreateDbContextAsync(ct).ConfigureAwait(false);

        // Enabled + expiry are filtered in SQL rather than in memory so a disabled key never
        // materialises into a process where something might later treat it as a match.
        var key = await db.ApiKeys
            .AsNoTracking()
            .SingleOrDefaultAsync(
                k => k.ApiKeyId == apiKeyId
                     && k.Enabled
                     && (k.ExpiresUtc == null || k.ExpiresUtc > utcNow),
                ct)
            .ConfigureAwait(false);

        if (key is null) return null;

        return new ApiKeyLookup(key, await LoadClusterGrantsAsync(db, key.Principal, ct).ConfigureAwait(false));
    }

    /// <inheritdoc />
    public async Task<IReadOnlyList<NodeAcl>> FindGrantsAsync(string principal, CancellationToken ct)
    {
        await using var db = await _factory.CreateDbContextAsync(ct).ConfigureAwait(false);
        return await LoadClusterGrantsAsync(db, principal, ct).ConfigureAwait(false);
    }

    private static async Task<IReadOnlyList<NodeAcl>> LoadClusterGrantsAsync(
        OtOpcUaConfigDbContext db, string principal, CancellationToken ct)
    {
        // Only cluster-scoped rows can confer an interim role (see ApiKeyInterimRoleMapper), so only
        // those are fetched. Stage 5 widens this to the full grant set for per-node evaluation.
        return await db.NodeAcls
            .AsNoTracking()
            .Where(a => a.Principal == principal && a.ScopeKind == NodeAclScopeKind.Cluster)
            .ToListAsync(ct)
            .ConfigureAwait(false);
    }
}