using Shouldly;
using Xunit;
using ZB.MOM.WW.OtOpcUa.AdminUI.Deployments;
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
using ZB.MOM.WW.OtOpcUa.Runtime.Drivers;

namespace ZB.MOM.WW.OtOpcUa.AdminUI.Tests.Deployments;

/// <summary>
///     The upgrade preflight / <c>/raw</c> banner lists the configs the deploy gate will now refuse for lmxopcua#835
///     (another instance's secret) and #836 (absolute user-certificate path) — Draft and Deployed alike.
/// </summary>
[Trait("Category", "Unit")]
public sealed class CredentialReferencePreflightInstanceAndPathTests
{
    private static DriverInstance Drv(string id, string name, string type, string config) =>
        new() { DriverInstanceId = id, ClusterId = "c", Name = name, DriverType = type, DriverConfig = config };

    [Fact]
    public void Draft_and_deployed_cross_instance_references_are_listed()
    {
        var drivers = new[]
        {
            Drv("DRV-a", "A", DriverTypeNames.Galaxy, """{"Gateway":{"ApiKeySecretRef":"secret:galaxy/DRV-a/apikey"}}"""),
            Drv("DRV-b", "B", DriverTypeNames.Galaxy, """{"Gateway":{"ApiKeySecretRef":"secret:galaxy/DRV-a/apikey"}}"""),
        };
        var devices = new[] { new Device { DeviceId = "dev-b", DriverInstanceId = "DRV-b", Name = "gw", DeviceConfig = """{"AlarmAck":{"FallbackPasswordSecretRef":"secret:otopcua/galaxy/A/ack"}}""" } };
        var deployed = new[]
        {
            new DriverInstanceSpec(Guid.NewGuid(), "DRV-a", "A", DriverTypeNames.Galaxy, true, "{}"),
            new DriverInstanceSpec(Guid.NewGuid(), "DRV-b", "B", DriverTypeNames.Galaxy, true, """{"Gateway":{"ApiKeySecretRef":"secret:galaxy/A/apikey"}}"""),
        };

        var findings = CredentialReferencePreflight.Scan(drivers, devices, deployed);

        findings.Count.ShouldBe(3);
        findings.ShouldAllBe(f => f.DriverInstanceId == "DRV-b" && f.Problem.Contains("lmxopcua#835"));
        findings.Count(f => f.Source == CredentialFindingSource.Draft).ShouldBe(2);
        findings.Single(f => f.Source == CredentialFindingSource.Deployed).DriverName.ShouldBe("B");
    }

    [Fact]
    public void An_absolute_user_certificate_path_is_listed_without_the_path()
    {
        var findings = CredentialReferencePreflight.Scan(
            [Drv("o", "Upstream", DriverTypeNames.OpcUaClient, """{"AuthType":"Certificate","UserCertificatePath":"C:\\certs\\plant.pfx"}""")],
            [],
            []);

        var f = findings.ShouldHaveSingleItem();
        f.Problem.ShouldContain("lmxopcua#836");
        f.Problem.ShouldNotContain("plant.pfx");
    }
}