package jnpf.flowable.service;

import jnpf.base.UserInfo;
import jnpf.flowable.model.filepermission.FilePermissionView;
import jnpf.flowable.model.filepermission.FilePermissionPolicy.Action;
import jnpf.flowable.util.filepermission.FilePermissionRuntime;
import jnpf.flowable.util.filepermission.FilePermissionSnapshot;
import jnpf.util.UserProvider;
import org.junit.*;
import org.mockito.MockedStatic;
import org.springframework.beans.factory.ObjectProvider;
import java.util.*;
import static org.junit.Assert.*;
import static org.mockito.Mockito.*;
import static org.mockito.ArgumentMatchers.*;

public class FilePermissionRuntimeServiceTest {
    private FilePermissionSnapshotService snapshots;
    private ObjectProvider<FilePermissionRuntimeSource> providers;
    private FilePermissionRuntimeSource source;
    private FilePermissionRuntimeService service;
    private FilePermissionSnapshot snapshot;
    private FilePermissionRuntime.Facts facts;
    private MockedStatic<UserProvider> users;
    @Before @SuppressWarnings("unchecked") public void setup() {
        jnpf.util.context.SpringContext.setApplicationContext(mock(org.springframework.context.ApplicationContext.class));
        users = mockStatic(UserProvider.class);
        UserInfo user = new UserInfo(); user.setUserId("user"); user.setTenantId("tenant");
        users.when(UserProvider::getUser).thenReturn(user);
        users.when(UserProvider::getLoginUserId).thenReturn("user");
        snapshots = mock(FilePermissionSnapshotService.class);
        providers = mock(ObjectProvider.class); source = mock(FilePermissionRuntimeSource.class);
        when(providers.getIfAvailable()).thenReturn(source);
        service = new FilePermissionRuntimeService(snapshots, providers);
        Map<String,Object> rule = Map.of("id", "rule", "formId", "form", "field", "files", "trigger", "COMPLETED",
                "subject", "PARTICIPANTS", "actions", Map.of("DOWNLOAD", "DENY"));
        snapshot = FilePermissionSnapshot.read(FilePermissionSnapshot.create("tenant", "task", "flow",
                Map.of("version", 1, "rules", List.of(rule))), "tenant", "task");
        when(snapshots.find("task")).thenReturn(snapshot);
        facts = new FilePermissionRuntime.Facts(); facts.tenantId="tenant"; facts.taskId="task"; facts.formId="form";
        facts.userId="user"; facts.creatorId="user"; facts.revision="r1"; facts.verified=true;
        Map<Action,Boolean> allow = Map.of(Action.VIEW, true, Action.DOWNLOAD, true);
        facts.nativeUpperBounds.put("files", allow); facts.inherited.put("files", allow);
        when(source.read("tenant", "task", "form", "user", snapshot)).thenReturn(facts);
    }
    @After public void cleanup() { if (users != null) users.close(); }
    @Test public void reviewRuleDoesNotGrantEditAndKeepsCommentsVisibleAfterCompletion() {
        var policy = Map.of("version", 1, "rules", List.of(Map.of("id", "review", "formId", "form", "field", "files",
                "trigger", "ACTIVE", "triggerNodeId", "audit", "subject", "CURRENT_HANDLERS",
                "actions", Map.of("REVIEW", "ALLOW", "EDIT", "DENY"))));
        var rules = jnpf.flowable.model.filepermission.FilePermissionPolicy.parse(policy);
        facts.activeNodes.add("audit"); facts.currentHandlers.put("audit", Set.of("user"));
        facts.nativeUpperBounds.put("files", Map.of(Action.VIEW, true, Action.EDIT, true, Action.REVIEW, true));
        FilePermissionView active = FilePermissionRuntime.resolve(rules, facts);
        assertTrue(active.allows("files", Action.REVIEW)); assertFalse(active.allows("files", Action.EDIT));
        assertTrue(active.getFields().get("files").isReviewEnabled());
        facts.terminal = FilePermissionRuntime.Terminal.COMPLETED;
        FilePermissionView completed = FilePermissionRuntime.resolve(rules, facts);
        assertFalse(completed.allows("files", Action.REVIEW));
        assertTrue(completed.getFields().get("files").isReviewEnabled());
        assertFalse(FilePermissionRuntime.resolve(List.of(), facts).getFields().get("files").isReviewEnabled());
    }
    @Test public void nullSnapshotAloneRetainsOldBehavior() {
        when(snapshots.find("task")).thenReturn(null);
        FilePermissionView view = service.current("task", "form");
        assertFalse(view.isEnabled()); assertEquals("ready", view.getStatus());
        verifyNoInteractions(providers, source);
    }
    @Test public void failedSnapshotReadIsNotLegacy() {
        when(snapshots.find("task")).thenThrow(new IllegalArgumentException("damaged snapshot"));
        denied(service.current("task", "form")); verifyNoInteractions(source);
    }
    @Test public void confirmedAbsentTaskHasExplicitReasonAndStillDeniesByDefault() {
        when(snapshots.find("task")).thenThrow(new FilePermissionSnapshotService.TaskNotFoundException());
        FilePermissionView view = service.current("task", "form");
        denied(view); assertEquals("TASK_NOT_FOUND", view.getReason()); verifyNoInteractions(source);
    }
    @Test public void missingRuntimeSourceIsNotLegacy() {
        when(providers.getIfAvailable()).thenReturn(null);
        denied(service.current("task", "form"));
    }
    @Test public void runtimeFailureIsNotLegacy() {
        when(source.read(anyString(), anyString(), anyString(), anyString(), any())).thenThrow(new IllegalStateException("unavailable"));
        denied(service.current("task", "form"));
    }
    @Test public void rejectsCrossTenantTaskFormAndUserFacts() {
        facts.tenantId="other"; denied(service.current("task", "form")); facts.tenantId="tenant";
        facts.taskId="other"; denied(service.current("task", "form")); facts.taskId="task";
        facts.formId="other"; denied(service.current("task", "form")); facts.formId="form";
        facts.userId="other"; denied(service.current("task", "form"));
    }
    @Test public void rereadsCommittedStateForEveryAction() {
        assertTrue(service.current("task", "form").allows("files", Action.DOWNLOAD));
        facts.terminal=FilePermissionRuntime.Terminal.COMPLETED; facts.revision="r2";
        FilePermissionView next=service.current("task", "form");
        assertFalse(next.allows("files", Action.DOWNLOAD)); assertTrue(next.allows("files", Action.VIEW));
        assertEquals("r2", next.getRevision());
        verify(source, times(2)).read("tenant", "task", "form", "user", snapshot);
    }
    @Test public void inconsistentReadsAndUnverifiedProjectionAreDenied() {
        facts.transitioning=true; denied(service.current("task", "form"));
        facts.transitioning=false; facts.verified=false; denied(service.current("task", "form"));
    }
    @Test public void invalidInputAndUnauthenticatedUserAreDenied() {
        denied(service.current("", "form")); denied(service.current("task", ""));
        users.when(UserProvider::getLoginUserId).thenReturn("");
        denied(service.current("task", "form")); verifyNoInteractions(source);
    }
    @Test public void nonCurrentHandlersExcludeUsersHandlingAnyActiveNode() {
        Map<String,Object> current = new HashMap<>(Map.of(
                "id", "current", "formId", "form", "field", "files", "subject", "CURRENT_HANDLERS",
                "trigger", "ENTERED", "triggerNodeId", "department", "onReturn", "RELEASE",
                "actions", Map.of("VIEW", "ALLOW", "DOWNLOAD", "ALLOW", "EDIT", "ALLOW")));
        Map<String,Object> nonCurrent = new HashMap<>(Map.of(
                "id", "non-current", "formId", "form", "field", "files", "subject", "NON_CURRENT_HANDLERS",
                "trigger", "ENTERED", "triggerNodeId", "department", "onReturn", "RELEASE",
                "actions", Map.of("VIEW", "ALLOW", "DOWNLOAD", "DENY", "EDIT", "DENY",
                        "ADD", "DENY", "REPLACE", "DENY", "REMOVE", "DENY")));
        FilePermissionSnapshot scoped = FilePermissionSnapshot.read(FilePermissionSnapshot.create("tenant", "task", "flow",
                Map.of("version", 1, "rules", List.of(current, nonCurrent))), "tenant", "task");
        facts.activeEnteredRules.addAll(Set.of("current", "non-current"));
        facts.activeNodes.add("file-admin");
        facts.participants.put("department", Set.of("user"));
        facts.currentHandlers.put("file-admin", Set.of("user"));
        Map<Action,Boolean> upper = new EnumMap<>(Action.class);
        Map<Action,Boolean> inherited = new EnumMap<>(Action.class);
        for (Action action : Action.values()) {
            upper.put(action, true);
            inherited.put(action, action == Action.VIEW || action == Action.DOWNLOAD);
        }
        facts.nativeUpperBounds.put("files", upper);
        facts.inherited.put("files", inherited);

        FilePermissionView active = FilePermissionRuntime.resolve(scoped.getRules(), facts);
        assertTrue(active.allows("files", Action.VIEW));
        assertTrue(active.allows("files", Action.DOWNLOAD));
        assertTrue(active.allows("files", Action.EDIT));

        facts.currentHandlers.put("file-admin", Set.of("another-user"));
        FilePermissionView historical = FilePermissionRuntime.resolve(scoped.getRules(), facts);
        assertTrue(historical.allows("files", Action.VIEW));
        assertFalse(historical.allows("files", Action.DOWNLOAD));
        assertFalse(historical.allows("files", Action.EDIT));

        facts.participants.clear();
        facts.creatorId = "user";
        FilePermissionView creator = FilePermissionRuntime.resolve(scoped.getRules(), facts);
        assertTrue(creator.allows("files", Action.VIEW));
        assertFalse(creator.allows("files", Action.DOWNLOAD));

        facts.activeNodes.add("parallel");
        facts.currentHandlers.put("parallel", Set.of("user"));
        FilePermissionView parallelHandler = FilePermissionRuntime.resolve(scoped.getRules(), facts);
        assertTrue(parallelHandler.allows("files", Action.DOWNLOAD));
        assertTrue(parallelHandler.allows("files", Action.EDIT));
    }
    private static void denied(FilePermissionView view) {
        assertTrue(view.isEnabled()); assertEquals("error", view.getStatus());
        assertFalse(view.allows("files", Action.DOWNLOAD)); assertTrue(view.getFields().isEmpty());
    }
    @Test public void publishedFormReuseStillRechecksFactsAndRejectsStateOrIdentityChanges() {
        when(source.readWithPublishedForm("tenant","task","form","user",snapshot,"{}")).thenReturn(facts);
        assertEquals("ready",service.currentWithPublishedForm("task","form","{}").getStatus());
        facts.transitioning = true;
        assertNotEquals("ready",service.currentWithPublishedForm("task","form","{}").getStatus());
        facts.transitioning = false; facts.tenantId = "other";
        assertEquals("INVALID_CONTEXT",service.currentWithPublishedForm("task","form","{}").getReason());
        verify(snapshots,times(3)).find("task");
        verify(source,times(3)).readWithPublishedForm("tenant","task","form","user",snapshot,"{}");
        verify(source,never()).read(anyString(),anyString(),anyString(),anyString(),any());
    }

}