package jnpf.dmsService;

import jnpf.base.UserInfo;
import jnpf.dmsEntity.permission.form.UserFolderPermissionTreeForm;
import jnpf.dmsEntity.permission.model.DmsSubjectSet;
import jnpf.dmsEntity.permission.model.DmsUserFolderPermissionTreeRow;
import jnpf.dmsEntity.permission.vo.DmsCursorPageVO;
import jnpf.dmsEntity.permission.vo.DmsUserFolderPermissionTreeNodeVO;
import jnpf.dmsMapper.DmsUserFolderPermissionTreeMapper;
import jnpf.dmsPermission.DmsCurrentIdentity;
import jnpf.dmsPermission.DmsFileCenterCursorCodec;
import jnpf.dmsPermission.DmsPermissionError;
import jnpf.dmsPermission.DmsPermissionException;
import jnpf.dmsPermission.DmsPermissionGroupMembershipResolver;
import jnpf.dmsPermission.DmsPermissionProperties;
import jnpf.dmsPermission.DmsUserFolderPermissionPrincipal;
import jnpf.dmsPermission.DmsUserFolderPermissionTreeQuery;
import jnpf.dmsPermission.DmsUserSubjectBatchResolver;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.mockito.ArgumentCaptor;

import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.UUID;
import java.util.stream.Collectors;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.ArgumentMatchers.anyInt;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.doThrow;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;

class DmsUserFolderPermissionTreeServiceTest {
    private final UUID parentId = UUID.fromString("018f0000-0000-7000-8000-000000000301");
    private final UUID firstId = UUID.fromString("018f0000-0000-7000-8000-000000000302");
    private final UUID secondId = UUID.fromString("018f0000-0000-7000-8000-000000000303");
    private final DmsCurrentIdentity currentIdentity = mock(DmsCurrentIdentity.class);
    private final DmsPermissionProperties properties = properties();
    private final DmsFileCenterCursorCodec cursorCodec = new DmsFileCenterCursorCodec(properties);
    private final DmsUserSubjectBatchResolver subjectResolver = mock(DmsUserSubjectBatchResolver.class);
    private final DmsPermissionGroupMembershipResolver groupResolver =
            mock(DmsPermissionGroupMembershipResolver.class);
    private final DmsUserFolderPermissionTreeMapper mapper = mock(DmsUserFolderPermissionTreeMapper.class);
    private final DmsUserFolderPermissionTreeService service = new DmsUserFolderPermissionTreeService(
            currentIdentity, properties, cursorCodec, subjectResolver, groupResolver, mapper);
    private final UserInfo actor = new UserInfo();

    @Test
    void currentUserPrintScopeUsesAllPrincipalsWithoutAdministratorCheckOrTreePagination() {
        DmsSubjectSet subject = subject("admin-1");
        subject.getDirectOrgIds().add("org");
        subject.getAncestorOrgIds().add("parent-org");
        subject.getPositionIds().add("position");
        subject.getRoleIds().add("role");
        subject.getPermissionGroupIds().add("group");
        when(subjectResolver.resolve("tenant-1", Collections.singletonList("admin-1")))
                .thenReturn(Collections.singletonList(subject));
        when(mapper.selectPrintFolders(any())).thenReturn(Arrays.asList(
                row(firstId, "A", 1L, null, null, false), row(secondId, "B", 2L, null, null, false)));
        assertEquals(Arrays.asList(firstId, secondId), service.currentUserPrintFolderIds());
        verify(currentIdentity, never()).requirePermissionAdministrator();
        verify(mapper, never()).selectTree(any());
        verify(groupResolver).resolveAll(Collections.singletonList(subject), 1000);
        ArgumentCaptor<DmsUserFolderPermissionTreeQuery> q = ArgumentCaptor.forClass(DmsUserFolderPermissionTreeQuery.class);
        verify(mapper).selectPrintFolders(q.capture());
        assertEquals("tenant-1", q.getValue().getTenantId());
        assertEquals(6, q.getValue().getPrincipals().size());
    }

    @Test
    void personalWorkflowVersionsUseOnlyAuthenticatedUserAndIndependentQuery() {
        when(mapper.selectWorkflowPrintVersions("tenant-1", "admin-1")).thenReturn(
                Collections.singletonList(row(firstId, null, 0L, null, null, false)));
        assertEquals(Collections.singletonList(firstId), service.currentUserWorkflowPrintVersionIds());
        verify(mapper).selectWorkflowPrintVersions("tenant-1", "admin-1");
        verify(mapper, never()).selectPrintFolders(any());
        verify(currentIdentity, never()).requirePermissionAdministrator();
        verify(subjectResolver, never()).resolve(any(), any());
        verify(groupResolver, never()).resolveAll(any(List.class), anyInt());
    }

    @Test
    void currentUserScopeRejectsAnotherUsersResolvedSubjects() {
        when(subjectResolver.resolve("tenant-1", Collections.singletonList("admin-1")))
                .thenReturn(Collections.singletonList(subject("other-user")));
        assertThrows(DmsPermissionException.class, () -> service.currentUserPrintFolderIds());
        verify(mapper, never()).selectPrintFolders(any());
    }

    @BeforeEach
    void setUp() {
        actor.setUserId("admin-1");
        actor.setTenantId("tenant-1");
        when(currentIdentity.requireUser()).thenReturn(actor);
        when(currentIdentity.tenantId(actor)).thenReturn("tenant-1");
    }

    @Test
    void returnsPermissionAnnotatedUnionTreeAndPaginatesByFolder() {
        DmsSubjectSet user2 = subject("user-2");
        user2.getDirectOrgIds().add("org-direct");
        user2.getAncestorOrgIds().addAll(Arrays.asList("org-direct", "org-parent"));
        user2.getPositionIds().add("position-1");
        user2.getRoleIds().add("role-1");
        user2.getPermissionGroupIds().add("permission-group-1");
        DmsSubjectSet user1 = subject("user-1");
        when(subjectResolver.resolve("tenant-1", Arrays.asList("user-2", "user-1")))
                .thenReturn(Arrays.asList(user2, user1));
        when(mapper.selectTree(any())).thenReturn(Arrays.asList(
                row(firstId, "A", 1024L, "user-1", "PRINT", true),
                row(firstId, "A", 1024L, "user-2", "READ", true),
                row(firstId, "A", 1024L, "user-1", "READ", true),
                row(secondId, "B", 2048L, null, null, false)));

        UserFolderPermissionTreeForm form = new UserFolderPermissionTreeForm();
        form.setUserIds(Arrays.asList("user-2", " user-1 ", "user-2"));
        form.setParentId(parentId);
        form.setPageSize(1);

        DmsCursorPageVO<DmsUserFolderPermissionTreeNodeVO> result = service.tree(form);

        assertEquals(1, result.getList().size());
        assertTrue(result.isHasMore());
        assertNotNull(result.getNextCursor());
        DmsUserFolderPermissionTreeNodeVO node = result.getList().get(0);
        assertEquals(firstId, node.getId());
        assertTrue(node.isHasChildren());
        assertEquals(Arrays.asList("user-2", "user-1"), node.getUserPermissions().stream()
                .map(value -> value.getUserId()).collect(Collectors.toList()));
        assertEquals(Collections.singletonList("READ"), node.getUserPermissions().get(0).getActions());
        assertEquals(Arrays.asList("READ", "PRINT"), node.getUserPermissions().get(1).getActions());

        String fingerprint = cursorCodec.fingerprint("user-2\nuser-1");
        DmsFileCenterCursorCodec.Cursor cursor = cursorCodec.decode(result.getNextCursor(),
                "USER_FOLDER_PERMISSION_TREE", "tenant-1", "admin-1", parentId, fingerprint);
        assertEquals(1024L, cursor.getSortCode());
        assertEquals(firstId, cursor.getId());

        verify(groupResolver).resolveAll(Arrays.asList(user2, user1), 1000);
        ArgumentCaptor<DmsUserFolderPermissionTreeQuery> queryCaptor =
                ArgumentCaptor.forClass(DmsUserFolderPermissionTreeQuery.class);
        verify(mapper).selectTree(queryCaptor.capture());
        DmsUserFolderPermissionTreeQuery query = queryCaptor.getValue();
        assertEquals(2, query.getLimit());
        assertEquals(parentId, query.getParentId());
        assertEquals("tenant-1", query.getTenantId());
        assertTrue(hasPrincipal(query.getPrincipals(), "user-2", "USER", "user-2"));
        assertTrue(hasPrincipal(query.getPrincipals(), "user-2", "ORG_DIRECT", "org-direct"));
        assertTrue(hasPrincipal(query.getPrincipals(), "user-2", "ORG_ANCESTOR", "org-parent"));
        assertTrue(hasPrincipal(query.getPrincipals(), "user-2", "POSITION", "position-1"));
        assertTrue(hasPrincipal(query.getPrincipals(), "user-2", "ROLE", "role-1"));
        assertTrue(hasPrincipal(query.getPrincipals(), "user-2", "GROUP", "permission-group-1"));
    }

    @Test
    void keepsNavigationAncestorsWithoutClaimingPermissions() {
        DmsSubjectSet subject = subject("user-1");
        when(subjectResolver.resolve("tenant-1", Collections.singletonList("user-1")))
                .thenReturn(Collections.singletonList(subject));
        when(mapper.selectTree(any())).thenReturn(Collections.singletonList(
                row(firstId, "Navigation", 1024L, null, null, true)));
        UserFolderPermissionTreeForm form = new UserFolderPermissionTreeForm();
        form.setUserIds(Collections.singletonList("user-1"));

        DmsCursorPageVO<DmsUserFolderPermissionTreeNodeVO> result = service.tree(form);

        assertEquals(1, result.getList().size());
        assertTrue(result.getList().get(0).getUserPermissions().isEmpty());
        assertFalse(result.isHasMore());
    }

    @Test
    void rejectsInvalidInputBeforeResolvingSubjects() {
        UserFolderPermissionTreeForm empty = new UserFolderPermissionTreeForm();
        empty.setUserIds(Collections.<String>emptyList());
        assertThrows(DmsPermissionException.class, () -> service.tree(empty));

        UserFolderPermissionTreeForm invalidPage = new UserFolderPermissionTreeForm();
        invalidPage.setUserIds(Collections.singletonList("user-1"));
        invalidPage.setPageSize(101);
        assertThrows(DmsPermissionException.class, () -> service.tree(invalidPage));

        verify(subjectResolver, never()).resolve(any(), any());
        verify(groupResolver, never()).resolveAll(any(List.class), anyInt());
        verify(mapper, never()).selectTree(any());
    }

    @Test
    void rejectsNonAdministratorsBeforeReadingRequestContextOrCallingDownstreamServices() {
        doThrow(DmsPermissionException.of(DmsPermissionError.ADMIN_REQUIRED, "admin required"))
                .when(currentIdentity).requirePermissionAdministrator();
        UserFolderPermissionTreeForm form = new UserFolderPermissionTreeForm();
        form.setUserIds(Collections.singletonList("user-1"));

        DmsPermissionException error = assertThrows(DmsPermissionException.class,
                () -> service.tree(form));

        assertEquals(DmsPermissionError.ADMIN_REQUIRED, error.getError());
        verify(currentIdentity, never()).requireUser();
        verify(subjectResolver, never()).resolve(any(), any());
        verify(groupResolver, never()).resolveAll(any(List.class), anyInt());
        verify(mapper, never()).selectTree(any());
    }

    private DmsSubjectSet subject(String userId) {
        DmsSubjectSet value = new DmsSubjectSet();
        value.setUserId(userId);
        return value;
    }

    private DmsUserFolderPermissionTreeRow row(UUID id, String name, long sortCode,
                                                String userId, String action, boolean hasChildren) {
        DmsUserFolderPermissionTreeRow value = new DmsUserFolderPermissionTreeRow();
        value.setId(id);
        value.setParentId(parentId);
        value.setName(name);
        value.setSortCode(sortCode);
        value.setHasChildren(hasChildren);
        value.setUserId(userId);
        value.setActionCode(action);
        return value;
    }

    private boolean hasPrincipal(List<DmsUserFolderPermissionPrincipal> values,
                                 String userId, String kind, String principalId) {
        return values.stream().anyMatch(value -> userId.equals(value.getUserId())
                && kind.equals(value.getPrincipalKind()) && principalId.equals(value.getPrincipalId()));
    }

    private static DmsPermissionProperties properties() {
        DmsPermissionProperties value = new DmsPermissionProperties();
        value.setDefaultPageSize(20);
        value.setMaxPageSize(100);
        value.setMaxUserFolderTreeUsers(50);
        value.setMaxPermissionGroupScan(1000);
        value.setCursorSigningSecret("0123456789abcdef0123456789abcdef");
        return value;
    }
}