using Microsoft.Extensions.Configuration;
using PostgresService.WebApi;

namespace PostgresService.Tests;

public sealed class PostgresServiceSecurityTests : IDisposable
{
    private readonly string _dataRoot = Path.Combine(Path.GetTempPath(), $"postgres-service-tests-{Guid.NewGuid():N}");

    [Fact]
    public void SecretStore_PromotesSeedsAndUsesIndependentHashes()
    {
        Directory.CreateDirectory(_dataRoot);
        File.WriteAllText(Path.Combine(_dataRoot, "admin-password.seed"), "Admin-Password-For-Tests!\n");
        File.WriteAllText(Path.Combine(_dataRoot, "enrollment-token.seed"), "Enrollment-Token-For-Tests-2026!\n");
        var configuration = new ConfigurationBuilder()
            .AddInMemoryCollection(new Dictionary<string, string?>
            {
                ["POSTGRES_SERVICE_DATA_ROOT"] = _dataRoot
            })
            .Build();

        var store = new SecretStore(configuration);
        store.EnsureInitialized();

        Assert.True(store.VerifyAdminPassword("Admin-Password-For-Tests!"));
        Assert.False(store.VerifyAdminPassword("Enrollment-Token-For-Tests-2026!"));
        Assert.True(store.VerifyEnrollmentToken("Enrollment-Token-For-Tests-2026!"));
        Assert.False(File.Exists(Path.Combine(_dataRoot, "admin-password.seed")));
        Assert.False(File.Exists(Path.Combine(_dataRoot, "enrollment-token.seed")));
        Assert.StartsWith("pbkdf2-sha256$", File.ReadAllText(Path.Combine(_dataRoot, "admin-password.hash")));
    }

    [Fact]
    public void SecretStore_RotatedEnrollmentTokenInvalidatesOldToken()
    {
        Directory.CreateDirectory(_dataRoot);
        File.WriteAllText(Path.Combine(_dataRoot, "admin-password.seed"), "Admin-Password-For-Tests!\n");
        File.WriteAllText(Path.Combine(_dataRoot, "enrollment-token.seed"), "Enrollment-Token-For-Tests-2026!\n");
        var configuration = new ConfigurationBuilder()
            .AddInMemoryCollection(new Dictionary<string, string?>
            {
                ["POSTGRES_SERVICE_DATA_ROOT"] = _dataRoot
            })
            .Build();
        var store = new SecretStore(configuration);
        store.EnsureInitialized();

        var replacement = store.RotateEnrollmentToken();

        Assert.Equal(64, replacement.Length);
        Assert.True(store.VerifyEnrollmentToken(replacement));
        Assert.False(store.VerifyEnrollmentToken("Enrollment-Token-For-Tests-2026!"));
    }

    [Fact]
    public void AdminSessionStore_CreatesValidAndRevocableSession()
    {
        var sessions = new AdminSessionStore();
        var token = sessions.Create();

        Assert.True(sessions.Validate(token));
        sessions.Revoke(token);
        Assert.False(sessions.Validate(token));
        Assert.False(sessions.Validate("unknown"));
    }

    public void Dispose()
    {
        if (Directory.Exists(_dataRoot))
        {
            Directory.Delete(_dataRoot, recursive: true);
        }
    }
}