using System.Security.Claims;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging.Abstractions;
using NSubstitute;
using SIGCM2.Api.Authorization;
using SIGCM2.Application.Abstractions.Persistence;
using SIGCM2.Domain.Entities;

namespace SIGCM2.Api.Tests.Authorization;

/// <summary>
/// Unit tests for PermissionAuthorizationHandler — SUITE-B-01 (UDT-006).
/// Tests isolated from DB: IRolPermisoRepository is mocked via NSubstitute.
/// </summary>
public sealed class PermissionAuthorizationHandlerTests
{
    private readonly IRolPermisoRepository _rolPermisoRepo = Substitute.For<IRolPermisoRepository>();
    private readonly PermissionAuthorizationHandler _handler;

    public PermissionAuthorizationHandlerTests()
    {
        _handler = new PermissionAuthorizationHandler(
            _rolPermisoRepo,
            NullLogger<PermissionAuthorizationHandler>.Instance);
    }

    // ── Helpers ──────────────────────────────────────────────────────────────

    private static ClaimsPrincipal AuthenticatedUserWithRol(string rolValue)
    {
        var identity = new ClaimsIdentity(
            new[] { new Claim("rol", rolValue) },
            authenticationType: "TestAuth");
        return new ClaimsPrincipal(identity);
    }

    private static ClaimsPrincipal AuthenticatedUserWithoutRolClaim()
    {
        var identity = new ClaimsIdentity(
            new[] { new Claim(ClaimTypes.Name, "someuser") },
            authenticationType: "TestAuth");
        return new ClaimsPrincipal(identity);
    }

    private static ClaimsPrincipal AnonymousUser()
    {
        return new ClaimsPrincipal(new ClaimsIdentity()); // not authenticated
    }

    private static Permiso MakePermiso(int id, string codigo) =>
        Permiso.ForRead(id, codigo, codigo, null, codigo.Split(':')[0], true, DateTime.UtcNow);

    private static AuthorizationHandlerContext MakeContext(
        ClaimsPrincipal user,
        RequirePermissionAttribute requirement,
        HttpContext? httpContext = null)
    {
        var ctx = httpContext ?? new DefaultHttpContext();
        return new AuthorizationHandlerContext(
            requirements: new[] { requirement },
            user: user,
            resource: ctx);
    }

    // ── B-01-01: Usuario con permiso requerido → Succeed ─────────────────────

    [Fact]
    public async Task HandleAsync_Succeeds_WhenUserHasRequiredPermission()
    {
        // Arrange
        var user = AuthenticatedUserWithRol("admin");
        var requirement = new RequirePermissionAttribute("administracion:usuarios:gestionar");

        _rolPermisoRepo.GetByRolCodigoAsync("admin", Arg.Any<CancellationToken>())
            .Returns(new List<Permiso> { MakePermiso(1, "administracion:usuarios:gestionar") }
                .AsReadOnly() as IReadOnlyList<Permiso>);

        var context = MakeContext(user, requirement);

        // Act
        await _handler.HandleAsync(context);

        // Assert
        Assert.True(context.HasSucceeded);
    }

    // ── B-01-02: Usuario sin el permiso requerido → Fail ──────────────────────

    [Fact]
    public async Task HandleAsync_Fails_WhenUserLacksPermission()
    {
        // Arrange
        var user = AuthenticatedUserWithRol("cajero");
        var requirement = new RequirePermissionAttribute("administracion:usuarios:gestionar");

        _rolPermisoRepo.GetByRolCodigoAsync("cajero", Arg.Any<CancellationToken>())
            .Returns(new List<Permiso> { MakePermiso(10, "ventas:contado:crear") }
                .AsReadOnly() as IReadOnlyList<Permiso>);

        var context = MakeContext(user, requirement);

        // Act
        await _handler.HandleAsync(context);

        // Assert
        Assert.False(context.HasSucceeded);
    }

    // ── B-01-03: Multi-permiso OR — tiene uno de los dos → Succeed ────────────

    [Fact]
    public async Task HandleAsync_Succeeds_WhenAnyOfMultiplePermissions_OR()
    {
        // Arrange
        var user = AuthenticatedUserWithRol("cajero");
        var requirement = new RequirePermissionAttribute(
            "ventas:contado:crear",
            "administracion:usuarios:gestionar");

        _rolPermisoRepo.GetByRolCodigoAsync("cajero", Arg.Any<CancellationToken>())
            .Returns(new List<Permiso>
            {
                MakePermiso(10, "ventas:contado:crear"),
                MakePermiso(11, "ventas:contado:cobrar"),
            }.AsReadOnly() as IReadOnlyList<Permiso>);

        var context = MakeContext(user, requirement);

        // Act
        await _handler.HandleAsync(context);

        // Assert
        Assert.True(context.HasSucceeded);
    }

    // ── B-01-04: Multi-permiso OR — no tiene ninguno → Fail ───────────────────

    [Fact]
    public async Task HandleAsync_Fails_WhenNoneOfMultiplePermissions()
    {
        // Arrange
        var user = AuthenticatedUserWithRol("cajero");
        var requirement = new RequirePermissionAttribute(
            "administracion:usuarios:gestionar",
            "administracion:roles:gestionar");

        _rolPermisoRepo.GetByRolCodigoAsync("cajero", Arg.Any<CancellationToken>())
            .Returns(new List<Permiso> { MakePermiso(10, "ventas:contado:crear") }
                .AsReadOnly() as IReadOnlyList<Permiso>);

        var context = MakeContext(user, requirement);

        // Act
        await _handler.HandleAsync(context);

        // Assert
        Assert.False(context.HasSucceeded);
    }

    // ── B-01-05: Claim "rol" ausente → Fail; repo nunca llamado ───────────────

    [Fact]
    public async Task HandleAsync_Fails_WhenRolClaimMissing()
    {
        // Arrange
        var user = AuthenticatedUserWithoutRolClaim();
        var requirement = new RequirePermissionAttribute("administracion:usuarios:gestionar");
        var context = MakeContext(user, requirement);

        // Act
        await _handler.HandleAsync(context);

        // Assert
        Assert.False(context.HasSucceeded);
        // Repo must NOT be called when claim is absent
        await _rolPermisoRepo.DidNotReceive()
            .GetByRolCodigoAsync(Arg.Any<string>(), Arg.Any<CancellationToken>());
    }

    // ── B-01-06: Repo devuelve lista vacía → Fail ─────────────────────────────

    [Fact]
    public async Task HandleAsync_Fails_WhenRoleHasNoPermissions()
    {
        // Arrange
        var user = AuthenticatedUserWithRol("reportes");
        var requirement = new RequirePermissionAttribute("administracion:usuarios:gestionar");

        _rolPermisoRepo.GetByRolCodigoAsync("reportes", Arg.Any<CancellationToken>())
            .Returns(new List<Permiso>().AsReadOnly() as IReadOnlyList<Permiso>);

        var context = MakeContext(user, requirement);

        // Act
        await _handler.HandleAsync(context);

        // Assert
        Assert.False(context.HasSucceeded);
    }

    // ── B-01-07: Rol no existe en RolPermiso (mismo caso que lista vacía) ──────

    [Fact]
    public async Task HandleAsync_Fails_WhenRoleDoesNotExistInRolPermisoTable()
    {
        // Arrange
        var user = AuthenticatedUserWithRol("rol_fantasma");
        var requirement = new RequirePermissionAttribute("administracion:usuarios:gestionar");

        _rolPermisoRepo.GetByRolCodigoAsync("rol_fantasma", Arg.Any<CancellationToken>())
            .Returns(new List<Permiso>().AsReadOnly() as IReadOnlyList<Permiso>);

        var context = MakeContext(user, requirement);

        // Act
        await _handler.HandleAsync(context);

        // Assert
        Assert.False(context.HasSucceeded);
    }

    // ── B-01-08: Fail stashea RequiredPermission en HttpContext.Items ──────────

    [Fact]
    public async Task HandleAsync_StashesRequiredPermission_InHttpContextItems_OnFail()
    {
        // Arrange
        var user = AuthenticatedUserWithRol("cajero");
        var requirement = new RequirePermissionAttribute("administracion:usuarios:gestionar");

        _rolPermisoRepo.GetByRolCodigoAsync("cajero", Arg.Any<CancellationToken>())
            .Returns(new List<Permiso> { MakePermiso(10, "ventas:contado:crear") }
                .AsReadOnly() as IReadOnlyList<Permiso>);

        var httpContext = new DefaultHttpContext();
        var context = MakeContext(user, requirement, httpContext);

        // Act
        await _handler.HandleAsync(context);

        // Assert — context.Resource is the HttpContext where items are stashed
        Assert.False(context.HasSucceeded);
        Assert.Equal("administracion:usuarios:gestionar", httpContext.Items["RequiredPermission"]);
    }
}