using System.Net;
using System.Net.Http.Json;
using System.Text.RegularExpressions;
using BigRegister.Api.Contracts;
using BigRegister.Api.Data;
using Microsoft.AspNetCore.Mvc.Testing;

namespace BigRegister.Tests;

/// WP-41: the persisted authz/PII-reveal audit trail is queryable, data-minimised (no PII).
public class AuthzAuditTests(TestWebApplicationFactory factory) : IClassFixture<TestWebApplicationFactory>
{
  private readonly HttpClient _client = factory.CreateClient();

  private HttpRequestMessage Admin(HttpMethod method, string path)
  {
    var req = new HttpRequestMessage(method, path);
    req.Headers.Add("X-Role", "admin");
    return req;
  }

  private async Task<List<AuthzAuditDto>> AuditLog()
  {
    var res = await _client.SendAsync(Admin(HttpMethod.Get, "/api/v1/admin/audit"));
    res.EnsureSuccessStatusCode();
    return (await res.Content.ReadFromJsonAsync<List<AuthzAuditDto>>())!;
  }

  [Fact]
  public async Task A_denied_admin_action_is_recorded()
  {
    // No X-Role → drafter → 403 on an admin endpoint → a deny entry.
    Assert.Equal(HttpStatusCode.Forbidden, (await _client.GetAsync("/api/v1/admin/cases")).StatusCode);
    Assert.Contains(await AuditLog(), e => e.Action == "cases:manage" && e.Decision == "deny");
  }

  [Fact]
  public async Task A_reveal_attempt_is_recorded()
  {
    // Drafter (capable role) without X-Step-Up → reveal denied → recorded.
    var res = await _client.PostAsync("/api/v1/brief/reveal-bignummer", null);
    Assert.Equal(HttpStatusCode.Forbidden, res.StatusCode);
    Assert.Contains(await AuditLog(), e => e.Action == "brief:reveal-bignummer");
  }

  /// RB-02/BIO-008: the schema test below asserts on **column names**, so a BSN inside a
  /// column called `Resource` was invisible to it — and one was there, concatenated as
  /// `"brief/" + Bsn`. This asserts on the stored **values** instead. Four documents
  /// promise this trail holds no PII; this is the test that makes the promise checkable.
  [Fact]
  public async Task No_audit_row_carries_a_subjects_bsn()
  {
    const string subject = "999999990";
    var reveal = new HttpRequestMessage(HttpMethod.Post, "/api/v1/brief/reveal-bignummer");
    reveal.Headers.Add("X-Subject", subject);
    Assert.Equal(HttpStatusCode.Forbidden, (await _client.SendAsync(reveal)).StatusCode);

    var bsns = new[] { subject, DocumentStore.DemoOwner };
    foreach (var e in await AuditLog())
      foreach (var field in new[] { e.Action, e.Resource, e.Decision, e.Role, e.At, e.CorrelationId })
        Assert.DoesNotContain(bsns, bsn => field.Contains(bsn, StringComparison.Ordinal));
  }

  [Fact]
  public void The_audit_schema_carries_no_pii()
  {
    var names = typeof(AuthzAuditEntry).GetProperties().Select(p => p.Name).ToArray();
    Assert.Equal(
        new[] { "At", "Action", "Resource", "Decision", "Role", "CorrelationId", "Id" }.OrderBy(x => x),
        names.OrderBy(x => x));
    Assert.DoesNotContain(names, n => Regex.IsMatch(n, "naam|name|bsn|value|waarde", RegexOptions.IgnoreCase));
  }
}