package jnpf.dmsService;

import jnpf.base.UserInfo;
import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
import jnpf.dmsEntity.permission.enums.DmsPermissionAction;
import jnpf.dmsEntity.permission.enums.DmsResourceType;
import jnpf.dmsEntity.permission.form.PermissionDecisionForm;
import jnpf.dmsEntity.permission.model.DmsResourcePath;
import jnpf.dmsEntity.permission.model.DmsSubjectSet;
import jnpf.dmsEntity.permission.vo.DmsPermissionDecisionVO;
import jnpf.dmsIntegration.audit.DmsAuditAdapter;
import jnpf.dmsMapper.DmsFilePermissionMapper;
import jnpf.dmsPermission.DmsAccessExclusionResolver;
import jnpf.dmsPermission.DmsCurrentIdentity;
import jnpf.dmsPermission.DmsPermissionGroupMembershipResolver;
import jnpf.dmsPermission.DmsPermissionMatcher;
import jnpf.dmsPermission.DmsPermissionProperties;
import jnpf.dmsPermission.DmsResourceResolver;
import jnpf.dmsPermission.DmsSubjectResolver;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;

import java.util.Arrays;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.UUID;

import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.ArgumentMatchers.anyList;
import static org.mockito.ArgumentMatchers.anySet;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;

class DmsPermissionDecisionServiceTest {
    private final DmsCurrentIdentity currentIdentity = mock(DmsCurrentIdentity.class);
    private final DmsSubjectResolver subjectResolver = mock(DmsSubjectResolver.class);
    private final DmsResourceResolver resourceResolver = mock(DmsResourceResolver.class);
    private final DmsFilePermissionMapper permissionMapper = mock(DmsFilePermissionMapper.class);
    private final DmsPermissionGroupMembershipResolver groupResolver =
            mock(DmsPermissionGroupMembershipResolver.class);
    private final DmsPermissionMatcher matcher = mock(DmsPermissionMatcher.class);
    private final DmsPermissionProperties properties = new DmsPermissionProperties();
    private final DmsAuditAdapter auditAdapter = mock(DmsAuditAdapter.class);
    private final DmsAccessExclusionResolver exclusionResolver = mock(DmsAccessExclusionResolver.class);
    private final DmsPermissionDecisionService service = new DmsPermissionDecisionService(
            currentIdentity, subjectResolver, resourceResolver, permissionMapper, groupResolver,
            matcher, properties, auditAdapter, exclusionResolver);
    private final UserInfo user = new UserInfo();

    @BeforeEach
    void setUp() {
        user.setTenantId("tenant-1");
        user.setUserId("user-1");
        when(currentIdentity.requireUser()).thenReturn(user);
        when(currentIdentity.tenantId(user)).thenReturn("tenant-1");
        when(subjectResolver.resolve(user)).thenReturn(mock(DmsSubjectSet.class));
    }

    @Test
    void exclusionWinsWithoutLoadingAllowCandidates() {
        UUID documentId = UUID.randomUUID();
        PermissionDecisionForm request = request(DmsResourceType.DOCUMENT, documentId);
        DmsResourcePath path = document(documentId);
        when(resourceResolver.resolveAll("tenant-1", Collections.singletonList(request)))
                .thenReturn(Collections.singletonMap(documentId, path));
        when(exclusionResolver.resolve(eq("tenant-1"), eq("user-1"), any()))
                .thenReturn(new DmsAccessExclusionResolver.Snapshot(
                        new HashSet<>(Collections.singletonList(documentId)), Collections.emptySet()));

        DmsPermissionDecisionVO result = service.evaluate(request);

        assertFalse(result.isAllowed());
        assertEquals("USER_READ_EXCLUDED", result.getReasonCode());
        verify(permissionMapper, never()).selectCandidates(any(), any(), anyList());
        verify(subjectResolver, never()).resolve(user);
    }

    @Test
    void fileVersionExclusionOnlyDeniesSpecifiedVersionInBatch() {
        UUID documentId = UUID.randomUUID();
        UUID excludedVersionId = UUID.randomUUID();
        UUID visibleVersionId = UUID.randomUUID();
        PermissionDecisionForm excludedRequest = request(DmsResourceType.FILE_VERSION, excludedVersionId);
        PermissionDecisionForm visibleRequest = request(DmsResourceType.FILE_VERSION, visibleVersionId);
        DmsResourcePath excludedPath = version(documentId, excludedVersionId);
        DmsResourcePath visiblePath = version(documentId, visibleVersionId);
        Map<UUID, DmsResourcePath> paths = new HashMap<>();
        paths.put(excludedVersionId, excludedPath);
        paths.put(visibleVersionId, visiblePath);
        when(resourceResolver.resolveAll("tenant-1", Arrays.asList(excludedRequest, visibleRequest)))
                .thenReturn(paths);
        when(exclusionResolver.resolve(eq("tenant-1"), eq("user-1"), any()))
                .thenReturn(new DmsAccessExclusionResolver.Snapshot(Collections.emptySet(),
                        new HashSet<>(Collections.singletonList(excludedVersionId))));
        when(resourceResolver.candidateResourceIds(visiblePath))
                .thenReturn(Arrays.asList(visibleVersionId, documentId));
        DmsFilePermissionEntity allow = new DmsFilePermissionEntity();
        allow.setId(UUID.randomUUID());
        when(permissionMapper.selectCandidates("tenant-1", Collections.singletonList("READ"),
                Arrays.asList(visibleVersionId, documentId))).thenReturn(Collections.singletonList(allow));
        allow.setActionCode("READ");
        when(matcher.matches(eq(allow), eq(visiblePath), any(DmsSubjectSet.class))).thenReturn(true);

        List<DmsPermissionDecisionVO> result = service.evaluate(Arrays.asList(excludedRequest, visibleRequest));

        assertFalse(result.get(0).isAllowed());
        assertEquals("USER_READ_EXCLUDED", result.get(0).getReasonCode());
        assertTrue(result.get(1).isAllowed());
        assertEquals(allow.getId(), result.get(1).getMatchedPermissionId());
        verify(permissionMapper).selectCandidates("tenant-1", Collections.singletonList("READ"),
                Arrays.asList(visibleVersionId, documentId));
        verify(groupResolver).resolve(anySet(), any(DmsSubjectSet.class));
    }

    @Test
    void twoHundredMixedDecisionsUseOneBulkLoadPerDependency() {
        List<PermissionDecisionForm> requests = new java.util.ArrayList<>();
        Map<UUID, DmsResourcePath> paths = new HashMap<>();
        for (int index = 0; index < properties.getMaxDecisionBatchSize(); index++) {
            UUID resourceId = UUID.randomUUID();
            DmsPermissionAction action = index % 2 == 0
                    ? DmsPermissionAction.READ : DmsPermissionAction.UPDATE;
            PermissionDecisionForm request = request(DmsResourceType.DOCUMENT, resourceId, action);
            DmsResourcePath path = document(resourceId);
            requests.add(request);
            paths.put(resourceId, path);
            when(resourceResolver.candidateResourceIds(path)).thenReturn(Collections.singletonList(resourceId));
        }
        when(resourceResolver.resolveAll("tenant-1", requests)).thenReturn(paths);
        when(exclusionResolver.resolve(eq("tenant-1"), eq("user-1"), any()))
                .thenReturn(DmsAccessExclusionResolver.Snapshot.empty());
        when(permissionMapper.selectCandidates(eq("tenant-1"), anyList(), anyList()))
                .thenReturn(Collections.emptyList());

        List<DmsPermissionDecisionVO> result = service.evaluate(requests);

        assertEquals(properties.getMaxDecisionBatchSize(), result.size());
        assertTrue(result.stream().noneMatch(DmsPermissionDecisionVO::isAllowed));
        org.mockito.ArgumentCaptor<List<String>> actions = org.mockito.ArgumentCaptor.forClass(List.class);
        org.mockito.ArgumentCaptor<List<UUID>> resourceIds = org.mockito.ArgumentCaptor.forClass(List.class);
        verify(resourceResolver, times(1)).resolveAll("tenant-1", requests);
        verify(subjectResolver, times(1)).resolve(user);
        verify(exclusionResolver, times(1)).resolve(eq("tenant-1"), eq("user-1"), any());
        verify(permissionMapper, times(1)).selectCandidates(eq("tenant-1"), actions.capture(),
                resourceIds.capture());
        verify(groupResolver, times(1)).resolve(anySet(), any(DmsSubjectSet.class));
        assertEquals(Arrays.asList("READ", "UPDATE"), actions.getValue());
        assertEquals(properties.getMaxDecisionBatchSize(), new HashSet<>(resourceIds.getValue()).size());
    }

    private PermissionDecisionForm request(DmsResourceType type, UUID id) {
        return request(type, id, DmsPermissionAction.READ);
    }

    private PermissionDecisionForm request(DmsResourceType type, UUID id, DmsPermissionAction action) {
        PermissionDecisionForm result = new PermissionDecisionForm();
        result.setResourceType(type);
        result.setResourceId(id);
        result.setActionCode(action);
        return result;
    }

    private DmsResourcePath document(UUID documentId) {
        DmsResourcePath path = new DmsResourcePath();
        path.setActualResourceType("DOCUMENT");
        path.setActualResourceId(documentId);
        path.setDocumentId(documentId);
        return path;
    }

    private DmsResourcePath version(UUID documentId, UUID versionId) {
        DmsResourcePath path = new DmsResourcePath();
        path.setActualResourceType("FILE_VERSION");
        path.setActualResourceId(versionId);
        path.setDocumentId(documentId);
        return path;
    }
}