using System.Net;
using System.Net.Http.Json;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.DependencyInjection.Extensions;
using Omika.Api.Services;
using Omika.Core.Abstractions;
using Omika.Core.Compatibility;
using Omika.Core.Constants;
using Omika.Core.Contracts.Mobile.License;
using Omika.Core.Contracts.Security;
using Omika.Core.Domain.Entities.Mobile;
using Omika.Core.Domain.Entities.Security;
using Omika.Core.Interfaces;
using Omika.Core.Interfaces.Mobile;
using Omika.Core.Runtime;
using Omika.Data.Configuration;
using Omika.Data.Connection;
using Omika.Data.Runtime;

namespace Omika.Tests.Api;

/// <summary>
/// Tests HTTP de l'endpoint d'authentification Back-Office WinDev
/// (POST /api/backoffice/auth/token).
///
/// Vérifie le contrat complet : codes HTTP, émission du Bearer token via le
/// mécanisme normal (ITokenService / MobileAuthMiddleware), contrôle d'accès
/// Back-Office (CO_AccesBO / UT_AccesBO), code client, et séparation avec le
/// droit A.LIC.MOB (qui n'est pas une condition d'émission du token).
///
/// Le hash utilisé est un placeholder volontairement faux : aucun vrai hash ni
/// vrai token n'apparaît dans ces tests.
/// </summary>
[Collection("ApplicationRuntimeContext")]
public class BackOfficeAuthEndpointsTests : IDisposable
{
    private const string SigningKey = "test-signing-key-for-integration-tests-only";
    private const string CodeClient = "BATIK.01";
    private const string ValidLogin = "DFO";
    private const string ValidHash = "FAKE-HASH-0123456789ABCDEF0123456789ABCDEF";
    private const long ValidUserId = 42;
    private const long ValidCollaborateurId = 7;

    private readonly FakeBackOfficeAuthRepository _authRepository = new();
    private readonly FakeLicenceRepository _licenceRepository = new();
    private readonly FakeLicenseService _licenseService = new();
    private readonly FakePermissionService _permissionService = new();
    private readonly WebApplicationFactory<Program> _factory;

    public BackOfficeAuthEndpointsTests()
    {
        ApplicationRuntimeContext.Reset();

        _factory = new WebApplicationFactory<Program>()
            .WithWebHostBuilder(builder =>
            {
                builder.ConfigureServices(services =>
                {
                    var config = new ConfigurationBuilder()
                        .AddInMemoryCollection(new Dictionary<string, string?>
                        {
                            ["Hfsql:Server"] = "test-server",
                            ["Hfsql:DatabaseName"] = "test-db",
                            ["MobileAuth:SigningKey"] = SigningKey
                        })
                        .Build();
                    services.AddSingleton<IConfiguration>(config);

                    services.RemoveAll<IDatabaseRuntimeInitializer>();
                    services.AddScoped<IDatabaseRuntimeInitializer, FakeRuntimeInitializer>();

                    services.RemoveAll<IHfsqlConnection>();
                    services.AddScoped<IHfsqlConnection, FakeHfsqlConnection>();

                    services.RemoveAll<IBackOfficeAuthRepository>();
                    services.AddScoped<IBackOfficeAuthRepository>(_ => _authRepository);

                    services.RemoveAll<ILicenceRepository>();
                    services.AddScoped<ILicenceRepository>(_ => _licenceRepository);

                    services.RemoveAll<ILicenseService>();
                    services.AddScoped<ILicenseService>(_ => _licenseService);

                    services.RemoveAll<IMobilePermissionService>();
                    services.AddScoped<IMobilePermissionService>(_ => _permissionService);
                });
            });
    }

    public void Dispose()
    {
        _factory.Dispose();
        ApplicationRuntimeContext.Reset();
    }

    // ===== 1. Authentification réussie =====

    [Fact]
    public async Task Post_ValidCredentials_WithBoAccess_Returns200_AndValidToken()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = ValidUser();
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = ValidLogin,
            PasswordHash = ValidHash
        });

        Assert.Equal(200, (int)response.StatusCode);
        var body = await response.Content.ReadFromJsonAsync<BackOfficeAuthTokenResponse>();
        Assert.NotNull(body);
        Assert.False(string.IsNullOrWhiteSpace(body.AccessToken));
        Assert.True(body.AccessTokenExpiresAtUtc > DateTimeOffset.UtcNow);
        Assert.Equal(ValidUserId.ToString(), body.UserId);
        Assert.Equal(ValidCollaborateurId.ToString(), body.CollaborateurId);

        // Le token est valide et porte l'identité attendue (même mécanisme que le mobile).
        using var scope = _factory.Services.CreateScope();
        var tokenService = scope.ServiceProvider.GetRequiredService<ITokenService>();
        MobileTokenIdentity identity = tokenService.ValidateToken(body.AccessToken)!;
        Assert.NotNull(identity);
        Assert.Equal(CodeClient, identity.CodeClient);
        Assert.Equal(ValidUserId.ToString(), identity.UserId);
        Assert.Equal(ValidCollaborateurId.ToString(), identity.CollaborateurId);
    }

    [Fact]
    public async Task Post_LoginIsCaseInsensitive_Returns200()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = ValidUser();
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = "dfo", // minuscules : reproduit le UPPER(UT_Login) = UPPER(login) WinDev
            PasswordHash = ValidHash
        });

        Assert.Equal(200, (int)response.StatusCode);
    }

    // ===== 2/3. Identifiants incorrects =====

    [Fact]
    public async Task Post_WrongLogin_Returns401_GenericMessage()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = ValidUser();
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = "INCONNU",
            PasswordHash = ValidHash
        });

        Assert.Equal(401, (int)response.StatusCode);
        Assert.Contains("Compte ou mot de passe incorrect.", await response.Content.ReadAsStringAsync());
    }

    [Fact]
    public async Task Post_WrongPasswordHash_Returns401_GenericMessage()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = ValidUser();
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = ValidLogin,
            PasswordHash = "AUTRE-HASH-FAUX"
        });

        Assert.Equal(401, (int)response.StatusCode);
        Assert.Contains("Compte ou mot de passe incorrect.", await response.Content.ReadAsStringAsync());
    }

    // ===== 4. Hash vide =====

    [Fact]
    public async Task Post_EmptyPasswordHash_Returns400()
    {
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = ValidLogin,
            PasswordHash = string.Empty
        });

        Assert.Equal(400, (int)response.StatusCode);
    }

    // ===== 5. Accès Back-Office refusé =====

    [Fact]
    public async Task Post_UserWithoutBoAccess_Returns403()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = new BackOfficeAuthUser(
            ValidUserId, ValidLogin, ValidCollaborateurId, ValidCollaborateurId,
            UtilisateurAccesBO: false, CollaborateurAccesBO: false, CollaborateurActif: true);
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = ValidLogin,
            PasswordHash = ValidHash
        });

        Assert.Equal(403, (int)response.StatusCode);
    }

    [Fact]
    public async Task Post_UserWithoutCollaborateur_ButUtAccesBoTrue_Returns200()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = new BackOfficeAuthUser(
            ValidUserId, ValidLogin, CollaborateurId: 0, CollaborateurPkId: 0,
            UtilisateurAccesBO: true, CollaborateurAccesBO: false, CollaborateurActif: false);
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = ValidLogin,
            PasswordHash = ValidHash
        });

        Assert.Equal(200, (int)response.StatusCode);
    }

    // ===== 6. Collaborateur lié =====

    [Fact]
    public async Task Post_LinkedCollaborateur_ReturnsCorrectUserIdAndCollaborateurId()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = ValidUser();
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = ValidLogin,
            PasswordHash = ValidHash
        });

        Assert.Equal(200, (int)response.StatusCode);
        var body = await response.Content.ReadFromJsonAsync<BackOfficeAuthTokenResponse>();
        Assert.NotNull(body);
        Assert.Equal(ValidUserId.ToString(), body.UserId);
        Assert.Equal(ValidCollaborateurId.ToString(), body.CollaborateurId);
    }

    // ===== 7. Utilisateur sans collaborateur =====

    [Fact]
    public async Task Post_UserWithoutCollaborateur_ReturnsNullCollaborateurId()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = new BackOfficeAuthUser(
            ValidUserId, ValidLogin, CollaborateurId: 0, CollaborateurPkId: 0,
            UtilisateurAccesBO: true, CollaborateurAccesBO: false, CollaborateurActif: false);
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = ValidLogin,
            PasswordHash = ValidHash
        });

        Assert.Equal(200, (int)response.StatusCode);
        var body = await response.Content.ReadFromJsonAsync<BackOfficeAuthTokenResponse>();
        Assert.NotNull(body);
        Assert.Equal(ValidUserId.ToString(), body.UserId);
        Assert.Null(body.CollaborateurId);
    }

    // ===== 8/9. Code client =====

    [Fact]
    public async Task Post_EmptyCodeClient_Returns400()
    {
        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = string.Empty,
            Login = ValidLogin,
            PasswordHash = ValidHash
        });

        Assert.Equal(400, (int)response.StatusCode);
    }

    [Fact]
    public async Task Post_UnknownCodeClient_Returns400()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = ValidUser();
        _licenceRepository.ClientToReturn = null; // client inconnu côté serveur

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = "INCONNU.99",
            Login = ValidLogin,
            PasswordHash = ValidHash
        });

        Assert.Equal(400, (int)response.StatusCode);
    }

    // ===== 10/11/12. Token accepté par MobileAuthMiddleware + A.LIC.MOB =====

    [Fact]
    public async Task Post_ReturnedToken_IsAcceptedByMobileAuthMiddleware_OnProtectedEndpoint()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = ValidUser();
        _licenceRepository.ClientToReturn = ValidClient();

        _permissionService.Permissions[MobilePermissionKeys.LicenceMobile] = true;
        _licenseService.GetResult = new CollaborateurLicenceDto
        {
            Numero = "LIC-001",
            CodeClient = CodeClient,
            Active = true,
            QrCode = "omika-enroll-v1:cGF5bG9hZA.sig"
        };

        var client = _factory.CreateClient();

        // 1. Obtention du token Back-Office.
        var authResponse = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = ValidLogin,
            PasswordHash = ValidHash
        });
        Assert.Equal(200, (int)authResponse.StatusCode);
        var session = await authResponse.Content.ReadFromJsonAsync<BackOfficeAuthTokenResponse>();
        Assert.NotNull(session);
        Assert.False(string.IsNullOrWhiteSpace(session.AccessToken));

        // 2. Le token est accepté par MobileAuthMiddleware sur un endpoint protégé.
        var protectedClient = _factory.CreateClient();
        protectedClient.DefaultRequestHeaders.Authorization =
            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", session.AccessToken);

        var protectedResponse = await protectedClient.GetAsync(
            $"/collaborateurs/{ValidCollaborateurId}/licence-mobile");

        Assert.Equal(200, (int)protectedResponse.StatusCode);
    }

    [Fact]
    public async Task Post_UserWithLicenceMobilePermission_CanAccessLicenceMobileEndpoint()
    {
        _permissionService.Permissions[MobilePermissionKeys.LicenceMobile] = true;
        _licenseService.GetResult = new CollaborateurLicenceDto
        {
            Numero = "LIC-002",
            CodeClient = CodeClient,
            Active = true,
            QrCode = "omika-enroll-v1:cGF5bG9hZA.sig"
        };

        string token = await ObtainTokenAsync();

        var client = _factory.CreateClient();
        client.DefaultRequestHeaders.Authorization =
            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);

        var response = await client.GetAsync($"/collaborateurs/{ValidCollaborateurId}/licence-mobile");

        Assert.Equal(200, (int)response.StatusCode);
        Assert.Equal(CodeClient, _licenseService.LastCodeClient);
    }

    [Fact]
    public async Task Post_UserWithoutLicenceMobilePermission_TokenCreated_ButLicenceMobileDenied()
    {
        _permissionService.Permissions[MobilePermissionKeys.LicenceMobile] = false;

        string token = await ObtainTokenAsync();
        Assert.False(string.IsNullOrWhiteSpace(token));

        var client = _factory.CreateClient();
        client.DefaultRequestHeaders.Authorization =
            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);

        var response = await client.GetAsync($"/collaborateurs/{ValidCollaborateurId}/licence-mobile");

        Assert.Equal(401, (int)response.StatusCode);
    }

    // ===== 13. Sécurité : aucun hash/token exposé =====

    [Fact]
    public async Task ErrorResponses_DoNotContainPasswordHash()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = ValidUser();
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();

        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = "INCONNU",
            PasswordHash = ValidHash
        });

        Assert.Equal(401, (int)response.StatusCode);
        string body = await response.Content.ReadAsStringAsync();
        Assert.DoesNotContain(ValidHash, body);
        Assert.DoesNotContain(ValidHash.ToLowerInvariant(), body);
    }

    // ===== Helpers =====

    private async Task<string> ObtainTokenAsync()
    {
        _authRepository.ValidLogin = ValidLogin;
        _authRepository.ValidHash = ValidHash;
        _authRepository.UserToReturn = ValidUser();
        _licenceRepository.ClientToReturn = ValidClient();

        var client = _factory.CreateClient();
        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
        {
            CodeClient = CodeClient,
            Login = ValidLogin,
            PasswordHash = ValidHash
        });
        Assert.Equal(200, (int)response.StatusCode);
        var session = await response.Content.ReadFromJsonAsync<BackOfficeAuthTokenResponse>();
        Assert.NotNull(session);
        return session.AccessToken;
    }

    private static BackOfficeAuthUser ValidUser() => new(
        ValidUserId,
        ValidLogin,
        CollaborateurId: ValidCollaborateurId,
        CollaborateurPkId: ValidCollaborateurId,
        UtilisateurAccesBO: false,
        CollaborateurAccesBO: true,
        CollaborateurActif: true);

    private static ClientBase ValidClient() => new()
    {
        Id = 1,
        Code = CodeClient,
        Nom = "Société Test"
    };

    // ===== Fakes =====

    private sealed class FakeBackOfficeAuthRepository : IBackOfficeAuthRepository
    {
        public string ValidLogin { get; set; } = string.Empty;
        public string ValidHash { get; set; } = string.Empty;
        public BackOfficeAuthUser? UserToReturn { get; set; }

        public Task<BackOfficeAuthUser?> GetByLoginAndPasswordHashAsync(
            string login,
            string passwordHash,
            CancellationToken cancellationToken = default)
        {
            bool loginMatches = string.Equals(login, ValidLogin, StringComparison.OrdinalIgnoreCase);
            bool hashMatches = string.Equals(passwordHash, ValidHash, StringComparison.Ordinal);

            return Task.FromResult(loginMatches && hashMatches ? UserToReturn : null);
        }
    }

    private sealed class FakeLicenceRepository : ILicenceRepository
    {
        public ClientBase? ClientToReturn { get; set; }

        public Task<ClientBase?> GetClientByCodeAsync(string codeClient, CancellationToken cancellationToken = default)
            => Task.FromResult(ClientToReturn);

        public Task<Licence?> GetByNumeroAsync(string numero, CancellationToken cancellationToken = default)
            => Task.FromResult<Licence?>(null);

        public Task<Licence?> GetByNumeroAndClientAsync(string numero, string codeClient, CancellationToken cancellationToken = default)
            => Task.FromResult<Licence?>(null);

        public Task<string?> GetMobileApiUrlForClientAsync(string codeClient, CancellationToken cancellationToken = default)
            => Task.FromResult<string?>(null);

        public Task<Licence?> GetByCollaborateurAsync(long collaborateurId, CancellationToken cancellationToken = default)
            => Task.FromResult<Licence?>(null);

        public Task<Licence?> GetFreeMobileLicenceAsync(long clientId, CancellationToken cancellationToken = default)
            => Task.FromResult<Licence?>(null);

        public Task<bool> AssignMobileLicenceAsync(string numero, long userId, long collaborateurId, string? nom, string? prenom, CancellationToken cancellationToken = default)
            => Task.FromResult(false);

        public Task<bool> ReleaseMobileLicenceAsync(string numero, CancellationToken cancellationToken = default)
            => Task.FromResult(false);

        public Task<bool> AssignDeviceAsync(string numero, string deviceId, CancellationToken cancellationToken = default)
            => Task.FromResult(false);

        public Task AddHistoAsync(LicenceHistoEntry entry, CancellationToken cancellationToken = default)
            => Task.CompletedTask;
    }

    private sealed class FakeLicenseService : ILicenseService
    {
        public CollaborateurLicenceDto? GetResult { get; set; }
        public string? LastCodeClient { get; private set; }

        public Task<LicenseResponse> ActivateAsync(LicenseActivateRequest request, CancellationToken cancellationToken = default)
            => Task.FromResult(new LicenseResponse());

        public Task<LicenseResponse> ValidateAsync(LicenseValidateRequest request, CancellationToken cancellationToken = default)
            => Task.FromResult(new LicenseResponse());

        public Task<CollaborateurLicenceDto?> GetMobileLicenceForCollaborateurAsync(string collaborateurId, string codeClient, CancellationToken cancellationToken = default)
        {
            LastCodeClient = codeClient;
            return Task.FromResult(GetResult);
        }

        public Task<CollaborateurLicenceDto?> AssignMobileLicenceAsync(string collaborateurId, string codeClient, CancellationToken cancellationToken = default)
        {
            LastCodeClient = codeClient;
            return Task.FromResult<CollaborateurLicenceDto?>(null);
        }

        public Task<bool> ReleaseMobileLicenceAsync(string collaborateurId, CancellationToken cancellationToken = default)
            => Task.FromResult(true);
    }

    private sealed class FakePermissionService : IMobilePermissionService
    {
        public Dictionary<string, bool> Permissions { get; } = new();

        public MobileTokenIdentity? Identity => null;

        public Task<IReadOnlyDictionary<string, bool>> GetPermissionsAsync(CancellationToken cancellationToken = default)
            => Task.FromResult<IReadOnlyDictionary<string, bool>>(Permissions);

        public Task<bool> HasPermissionAsync(string key, CancellationToken cancellationToken = default)
            => Task.FromResult(Permissions.TryGetValue(key, out bool allowed) && allowed);
    }

    private sealed class FakeRuntimeInitializer : IDatabaseRuntimeInitializer
    {
        public Task<Result> InitializeAsync(CancellationToken cancellationToken = default)
        {
            ApplicationRuntimeContext.SetDetectedVersion(DatabaseSchemaVersion.Batik);
            return Task.FromResult(Result.Success());
        }
    }

    private sealed class FakeHfsqlConnection : IHfsqlConnection, IDisposable
    {
        public HfsqlOptions Options => new();
        public HfsqlConnectionState State => HfsqlConnectionState.Closed;
        public void Dispose() { }
        public Task OpenAsync(CancellationToken ct = default) => Task.CompletedTask;
        public Task CloseAsync() => Task.CompletedTask;
        public Task<object?> ExecuteScalarAsync(string sql, IReadOnlyList<object?>? parameters = null, CancellationToken ct = default)
            => Task.FromResult<object?>(null);
        public Task<int> ExecuteNonQueryAsync(string sql, IReadOnlyList<object?>? parameters = null, CancellationToken ct = default)
            => Task.FromResult(0);
        public Task<IReadOnlyList<IReadOnlyDictionary<string, object?>>> QueryAsync(string sql, IReadOnlyList<object?>? parameters = null, CancellationToken ct = default)
            => Task.FromResult<IReadOnlyList<IReadOnlyDictionary<string, object?>>>([]);
        public Task<IReadOnlyList<HfsqlColumnMetadata>> GetColumnsAsync(string tableName, CancellationToken ct = default)
            => Task.FromResult<IReadOnlyList<HfsqlColumnMetadata>>([]);
        public ValueTask DisposeAsync() => ValueTask.CompletedTask;
    }
}