package api

import (
	"context"
	"encoding/json"
	"errors"
	"net/url"
	"strings"
	"testing"
	"time"

	"buf.build/go/protovalidate"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/mock"
	"go.opentelemetry.io/otel"

	auditV1 "dev.azure.com/schwarzit/schwarzit.stackit-public/audit-go.git/gen/go/audit/v1"
	internalAuditApi "dev.azure.com/schwarzit/schwarzit.stackit-public/audit-go.git/internal/audit/api"
	pkgAuditCommon "dev.azure.com/schwarzit/schwarzit.stackit-public/audit-go.git/pkg/audit/common"
	pkgMessagingApi "dev.azure.com/schwarzit/schwarzit.stackit-public/audit-go.git/pkg/messaging/api"
	pkgMessagingCommon "dev.azure.com/schwarzit/schwarzit.stackit-public/audit-go.git/pkg/messaging/common"
	pkgMessagingTest "dev.azure.com/schwarzit/schwarzit.stackit-public/audit-go.git/pkg/messaging/test"
)

func TestDynamicLegacyAuditApi(t *testing.T) {

	// Specify test timeout
	ctx, cancelFn := context.WithTimeout(context.Background(), 120*time.Second)
	defer cancelFn()

	// Start solace docker container
	solaceContainer, err := pkgMessagingTest.NewSolaceContainer(context.Background())
	assert.NoError(t, err)
	defer solaceContainer.Stop()

	// Instantiate the messaging api
	amqpApi, err := pkgMessagingApi.NewAmqpApi(
		pkgMessagingCommon.AmqpConnectionPoolConfig{
			Parameters: pkgMessagingCommon.AmqpConnectionConfig{BrokerUrl: solaceContainer.AmqpConnectionString},
			PoolSize:   1,
		})
	assert.NoError(t, err)

	// Validator
	validator, err := protovalidate.New()
	assert.NoError(t, err)

	topicSubscriptionTopicPattern := "stackit-platform/t/swz/audit-log/>"

	// Check that event-type data-access is rejected as it is currently
	// not supported by downstream services
	t.Run("reject data access event", func(t *testing.T) {
		defer solaceContainer.StopOnError()

		// Create the queue and topic subscription in solace
		queueName := "reject-data-access-legacy"
		assert.NoError(t, solaceContainer.QueueCreate(ctx, queueName))
		assert.NoError(t, solaceContainer.TopicSubscriptionCreate(ctx, queueName, topicSubscriptionTopicPattern))

		topicName := "topic://stackit-platform/t/swz/audit-log/eu01/v1/resource-manager/organization-rejected"
		assert.NoError(t, solaceContainer.ValidateTopicName(topicSubscriptionTopicPattern, topicName))

		// Instantiate audit api
		auditApi, err := NewDynamicLegacyAuditApi(
			amqpApi,
			validator,
		)
		assert.NoError(t, err)

		// Instantiate test data
		event, objectIdentifier := internalAuditApi.NewOrganizationAuditEvent(nil)
		event.LogName = strings.Replace(event.LogName, string(pkgAuditCommon.EventTypeAdminActivity), string(pkgAuditCommon.EventTypeDataAccess), 1)

		// Log the event to solace
		visibility := auditV1.Visibility_VISIBILITY_PUBLIC
		ctxWithTopic := context.WithValue(ctx, ContextKeyTopic, topicName)
		assert.ErrorIs(t, auditApi.Log(
			ctxWithTopic,
			event,
			visibility,
			pkgAuditCommon.NewRoutableIdentifier(objectIdentifier),
		), pkgAuditCommon.ErrUnsupportedEventTypeDataAccess)
	})

	// Check logging of organization events
	t.Run("Log public organization event", func(t *testing.T) {
		defer solaceContainer.StopOnError()

		// Create the queue and topic subscription in solace
		queueName := "org-event-public-legacy"
		assert.NoError(t, solaceContainer.QueueCreate(ctx, queueName))
		assert.NoError(t, solaceContainer.TopicSubscriptionCreate(ctx, queueName, topicSubscriptionTopicPattern))

		topicName := "topic://stackit-platform/t/swz/audit-log/eu01/v1/resource-manager/organization-created"
		assert.NoError(t, solaceContainer.ValidateTopicName(topicSubscriptionTopicPattern, topicName))

		// Instantiate audit api
		auditApi, err := NewDynamicLegacyAuditApi(
			amqpApi,
			validator,
		)
		assert.NoError(t, err)

		// Instantiate test data
		event, objectIdentifier := internalAuditApi.NewOrganizationAuditEvent(nil)

		// Log the event to solace
		visibility := auditV1.Visibility_VISIBILITY_PUBLIC
		ctxWithTopic := context.WithValue(ctx, ContextKeyTopic, topicName)
		assert.NoError(t, auditApi.Log(
			ctxWithTopic,
			event,
			visibility,
			pkgAuditCommon.NewRoutableIdentifier(objectIdentifier),
		))

		message, err := solaceContainer.NextMessageFromQueue(ctx, queueName, true)
		assert.NoError(t, err)

		validateSentMessage(t, topicName, message, event)
	})

	t.Run("Log private organization event", func(t *testing.T) {
		defer solaceContainer.StopOnError()

		// Create the queue and topic subscription in solace
		queueName := "org-event-private-legacy"
		assert.NoError(t, solaceContainer.QueueCreate(ctx, queueName))
		assert.NoError(t, solaceContainer.TopicSubscriptionCreate(ctx, queueName, topicSubscriptionTopicPattern))

		topicName := "topic://stackit-platform/t/swz/audit-log/eu01/v1/resource-manager/organization-created"
		assert.NoError(t, solaceContainer.ValidateTopicName(topicSubscriptionTopicPattern, topicName))

		// Instantiate audit api
		auditApi, err := NewDynamicLegacyAuditApi(
			amqpApi,
			validator,
		)
		assert.NoError(t, err)

		// Instantiate test data
		event, objectIdentifier := internalAuditApi.NewOrganizationAuditEvent(nil)

		// Log the event to solace
		visibility := auditV1.Visibility_VISIBILITY_PRIVATE
		ctxWithTopic := context.WithValue(ctx, ContextKeyTopic, topicName)
		assert.NoError(t, auditApi.Log(
			ctxWithTopic,
			event,
			visibility,
			pkgAuditCommon.NewRoutableIdentifier(objectIdentifier),
		))

		message, err := solaceContainer.NextMessageFromQueue(ctx, queueName, true)
		assert.NoError(t, err)

		validateSentMessage(t, topicName, message, event)
	})

	// Check logging of folder events
	t.Run("Log public folder event", func(t *testing.T) {
		defer solaceContainer.StopOnError()

		// Create the queue and topic subscription in solace
		queueName := "folder-event-public-legacy"
		assert.NoError(t, solaceContainer.QueueCreate(ctx, queueName))
		assert.NoError(t, solaceContainer.TopicSubscriptionCreate(ctx, queueName, topicSubscriptionTopicPattern))

		topicName := "topic://stackit-platform/t/swz/audit-log/eu01/v1/resource-manager/folder-created"
		assert.NoError(t, solaceContainer.ValidateTopicName(topicSubscriptionTopicPattern, topicName))

		// Instantiate audit api
		auditApi, err := NewDynamicLegacyAuditApi(
			amqpApi,
			validator,
		)
		assert.NoError(t, err)

		// Instantiate test data
		event, objectIdentifier := internalAuditApi.NewFolderAuditEvent(nil)

		// Log the event to solace
		visibility := auditV1.Visibility_VISIBILITY_PUBLIC
		ctxWithTopic := context.WithValue(ctx, ContextKeyTopic, topicName)
		assert.NoError(t, auditApi.Log(
			ctxWithTopic,
			event,
			visibility,
			pkgAuditCommon.NewRoutableIdentifier(objectIdentifier),
		))

		message, err := solaceContainer.NextMessageFromQueue(ctx, queueName, true)
		assert.NoError(t, err)

		validateSentMessage(t, topicName, message, event)
	})

	t.Run("Log private folder event", func(t *testing.T) {
		defer solaceContainer.StopOnError()

		// Create the queue and topic subscription in solace
		queueName := "folder-event-private-legacy"
		assert.NoError(t, solaceContainer.QueueCreate(ctx, queueName))
		assert.NoError(t, solaceContainer.TopicSubscriptionCreate(ctx, queueName, topicSubscriptionTopicPattern))

		topicName := "topic://stackit-platform/t/swz/audit-log/eu01/v1/resource-manager/folder-created"
		assert.NoError(t, solaceContainer.ValidateTopicName(topicSubscriptionTopicPattern, topicName))

		// Instantiate audit api
		auditApi, err := NewDynamicLegacyAuditApi(
			amqpApi,
			validator,
		)
		assert.NoError(t, err)

		// Instantiate test data
		event, objectIdentifier := internalAuditApi.NewFolderAuditEvent(nil)

		// Log the event to solace
		visibility := auditV1.Visibility_VISIBILITY_PRIVATE
		ctxWithTopic := context.WithValue(ctx, ContextKeyTopic, topicName)
		assert.NoError(t, auditApi.Log(
			ctxWithTopic,
			event,
			visibility,
			pkgAuditCommon.NewRoutableIdentifier(objectIdentifier),
		))

		message, err := solaceContainer.NextMessageFromQueue(ctx, queueName, true)
		assert.NoError(t, err)

		validateSentMessage(t, topicName, message, event)
	})

	// Check logging of project events
	t.Run("Log public project event", func(t *testing.T) {
		defer solaceContainer.StopOnError()

		// Create the queue and topic subscription in solace
		queueName := "project-event-public-legacy"
		assert.NoError(t, solaceContainer.QueueCreate(ctx, queueName))
		assert.NoError(t, solaceContainer.TopicSubscriptionCreate(ctx, queueName, topicSubscriptionTopicPattern))

		topicName := "topic://stackit-platform/t/swz/audit-log/eu01/v1/resource-manager/project-created"
		assert.NoError(t, solaceContainer.ValidateTopicName(topicSubscriptionTopicPattern, topicName))

		// Instantiate audit api
		auditApi, err := NewDynamicLegacyAuditApi(
			amqpApi,
			validator,
		)
		assert.NoError(t, err)

		// Instantiate test data
		event, objectIdentifier := internalAuditApi.NewProjectAuditEvent(nil)

		// Log the event to solace
		visibility := auditV1.Visibility_VISIBILITY_PUBLIC
		ctxWithTopic := context.WithValue(ctx, ContextKeyTopic, topicName)
		assert.NoError(t, auditApi.Log(
			ctxWithTopic,
			event,
			visibility,
			pkgAuditCommon.NewRoutableIdentifier(objectIdentifier),
		))

		message, err := solaceContainer.NextMessageFromQueue(ctx, queueName, true)
		assert.NoError(t, err)

		validateSentMessage(t, topicName, message, event)
	})

	t.Run("Log private project event", func(t *testing.T) {
		defer solaceContainer.StopOnError()

		// Create the queue and topic subscription in solace
		queueName := "project-event-private-legacy"
		assert.NoError(t, solaceContainer.QueueCreate(ctx, queueName))
		assert.NoError(t, solaceContainer.TopicSubscriptionCreate(ctx, queueName, topicSubscriptionTopicPattern))

		topicName := "topic://stackit-platform/t/swz/audit-log/eu01/v1/resource-manager/project-created"
		assert.NoError(t, solaceContainer.ValidateTopicName(topicSubscriptionTopicPattern, topicName))

		// Instantiate audit api
		auditApi, err := NewDynamicLegacyAuditApi(
			amqpApi,
			validator,
		)
		assert.NoError(t, err)

		// Instantiate test data
		event, objectIdentifier := internalAuditApi.NewProjectAuditEvent(nil)

		// Log the event to solace
		visibility := auditV1.Visibility_VISIBILITY_PRIVATE
		ctxWithTopic := context.WithValue(ctx, ContextKeyTopic, topicName)
		assert.NoError(t, auditApi.Log(
			ctxWithTopic,
			event,
			visibility,
			pkgAuditCommon.NewRoutableIdentifier(objectIdentifier),
		))

		message, err := solaceContainer.NextMessageFromQueue(ctx, queueName, true)
		assert.NoError(t, err)

		validateSentMessage(t, topicName, message, event)
	})

	// Check logging of system events with identifier
	t.Run("Log private project system event", func(t *testing.T) {
		defer solaceContainer.StopOnError()

		queueName := "project-system-event-private"
		assert.NoError(t, solaceContainer.QueueCreate(ctx, queueName))
		assert.NoError(t, solaceContainer.TopicSubscriptionCreate(ctx, queueName, topicSubscriptionTopicPattern))

		topicName := "topic://stackit-platform/t/swz/audit-log/eu01/v1/resource-manager/project-system-changed"
		assert.NoError(t, solaceContainer.ValidateTopicName(topicSubscriptionTopicPattern, topicName))

		// Instantiate audit api
		auditApi, err := NewDynamicLegacyAuditApi(
			amqpApi,
			validator,
		)
		assert.NoError(t, err)

		// Instantiate test data
		event := internalAuditApi.NewProjectSystemAuditEvent(nil)

		// Log the event to solace
		visibility := auditV1.Visibility_VISIBILITY_PRIVATE
		ctxWithTopic := context.WithValue(ctx, ContextKeyTopic, topicName)
		assert.NoError(t,
			auditApi.Log(
				ctxWithTopic,
				event,
				visibility,
				pkgAuditCommon.RoutableSystemIdentifier,
			))

		// Receive the event from solace
		message, err := solaceContainer.NextMessageFromQueue(ctx, queueName, true)
		assert.NoError(t, err)

		// Check topic name
		assert.Equal(t, topicName, *message.Properties.To)
		assert.Equal(t, "", message.ApplicationProperties["cloudEvents:traceparent"])
		assert.Equal(t, "", message.ApplicationProperties["cloudEvents:tracestate"])

		// Check deserialized message
		var auditEvent internalAuditApi.LegacyAuditEvent
		assert.NoError(t, json.Unmarshal(message.Data[0], &auditEvent))

		assert.Equal(t, event.ProtoPayload.ResourceName, *auditEvent.ResourceName)
		assert.Equal(t, event.ProtoPayload.OperationName, auditEvent.EventName)
		assert.Equal(t, event.ProtoPayload.RequestMetadata.RequestAttributes.Time.AsTime(), auditEvent.EventTimeStamp)
		assert.Equal(t, event.ProtoPayload.AuthenticationInfo.PrincipalId, auditEvent.Initiator.Id)
		assert.Equal(t, "SYSTEM_EVENT", auditEvent.EventType)
		assert.Equal(t, "INFO", auditEvent.Severity)
		assert.Equal(t, event.ProtoPayload.RequestMetadata.RequestAttributes.Path, auditEvent.Request.Endpoint)
		assert.Equal(t, event.ProtoPayload.RequestMetadata.CallerIp, auditEvent.SourceIpAddress)
		assert.Equal(t, event.ProtoPayload.RequestMetadata.CallerSuppliedUserAgent, auditEvent.UserAgent)
	})

	// Check logging of system events
	t.Run("Log private system event", func(t *testing.T) {
		defer solaceContainer.StopOnError()

		queueName := "system-event-private"
		assert.NoError(t, solaceContainer.QueueCreate(ctx, queueName))
		assert.NoError(t, solaceContainer.TopicSubscriptionCreate(ctx, queueName, topicSubscriptionTopicPattern))

		topicName := "topic://stackit-platform/t/swz/audit-log/eu01/v1/resource-manager/system-changed"
		assert.NoError(t, solaceContainer.ValidateTopicName(topicSubscriptionTopicPattern, topicName))

		// Instantiate audit api
		auditApi, err := NewDynamicLegacyAuditApi(
			amqpApi,
			validator,
		)
		assert.NoError(t, err)

		// Instantiate test data
		event := internalAuditApi.NewSystemAuditEvent(nil)

		// Log the event to solace
		visibility := auditV1.Visibility_VISIBILITY_PRIVATE
		ctxWithTopic := context.WithValue(ctx, ContextKeyTopic, topicName)
		assert.NoError(t,
			auditApi.Log(
				ctxWithTopic,
				event,
				visibility,
				pkgAuditCommon.RoutableSystemIdentifier,
			))

		// Receive the event from solace
		message, err := solaceContainer.NextMessageFromQueue(ctx, queueName, true)
		assert.NoError(t, err)

		// Check topic name
		assert.Equal(t, topicName, *message.Properties.To)
		assert.Equal(t, "", message.ApplicationProperties["cloudEvents:traceparent"])
		assert.Equal(t, "", message.ApplicationProperties["cloudEvents:tracestate"])

		// Check deserialized message
		var auditEvent internalAuditApi.LegacyAuditEvent
		assert.NoError(t, json.Unmarshal(message.Data[0], &auditEvent))

		assert.Equal(t, event.ProtoPayload.OperationName, auditEvent.EventName)
		assert.Equal(t, event.ProtoPayload.RequestMetadata.RequestAttributes.Time.AsTime(), auditEvent.EventTimeStamp)
		assert.Equal(t, event.ProtoPayload.AuthenticationInfo.PrincipalId, auditEvent.Initiator.Id)
		assert.Equal(t, "SYSTEM_EVENT", auditEvent.EventType)
		assert.Equal(t, "INFO", auditEvent.Severity)
		assert.Equal(t, event.ProtoPayload.RequestMetadata.RequestAttributes.Path, auditEvent.Request.Endpoint)
		assert.Equal(t, event.ProtoPayload.RequestMetadata.CallerIp, auditEvent.SourceIpAddress)
		assert.Equal(t, event.ProtoPayload.RequestMetadata.CallerSuppliedUserAgent, auditEvent.UserAgent)
	})

	t.Run("Log event with details", func(t *testing.T) {
		defer solaceContainer.StopOnError()

		// Create the queue and topic subscription in solace
		queueName := "org-event-with-details-legacy"
		assert.NoError(t, solaceContainer.QueueCreate(ctx, queueName))
		assert.NoError(t, solaceContainer.TopicSubscriptionCreate(ctx, queueName, topicSubscriptionTopicPattern))

		topicName := "topic://stackit-platform/t/swz/audit-log/eu01/v1/resource-manager/organization-created"
		assert.NoError(t, solaceContainer.ValidateTopicName(topicSubscriptionTopicPattern, topicName))

		// Instantiate audit api
		auditApi, err := NewDynamicLegacyAuditApi(
			amqpApi,
			validator,
		)
		assert.NoError(t, err)

		// Instantiate test data
		event, objectIdentifier := internalAuditApi.NewOrganizationAuditEvent(nil)
		escapedQuery := url.QueryEscape("param=value")
		event.ProtoPayload.RequestMetadata.RequestAttributes.Query = &escapedQuery

		// Log the event to solace
		visibility := auditV1.Visibility_VISIBILITY_PUBLIC
		ctxWithTopic := context.WithValue(ctx, ContextKeyTopic, topicName)
		assert.NoError(t, auditApi.Log(
			ctxWithTopic,
			event,
			visibility,
			pkgAuditCommon.NewRoutableIdentifier(objectIdentifier),
		))

		message, err := solaceContainer.NextMessageFromQueue(ctx, queueName, true)
		assert.NoError(t, err)

		validateSentMessageWithDetails(t, topicName, message, event)
	})
}

func TestDynamicLegacyAuditApi_NewLegacyAuditApi_MessagingApiNil(t *testing.T) {
	auditApi, err := NewDynamicLegacyAuditApi(nil, nil)
	assert.Nil(t, auditApi)
	assert.EqualError(t, err, "messaging api nil")
}

func TestDynamicLegacyAuditApi_ValidateAndSerialize_ValidationFailed(t *testing.T) {
	expectedError := errors.New("expected error")

	validator := &ProtobufValidatorMock{}
	validator.On("Validate", mock.Anything).Return(expectedError)
	var protobufValidator pkgAuditCommon.ProtobufValidator = validator

	auditApi := DynamicLegacyAuditApi{
		tracer:    otel.Tracer("test"),
		validator: protobufValidator,
	}

	event := internalAuditApi.NewSystemAuditEvent(nil)
	_, err := auditApi.ValidateAndSerialize(context.Background(), event, auditV1.Visibility_VISIBILITY_PUBLIC, pkgAuditCommon.RoutableSystemIdentifier)
	assert.ErrorIs(t, err, expectedError)
}

func TestDynamicLegacyAuditApi_Log_ValidationFailed(t *testing.T) {
	expectedError := errors.New("expected error")

	validator := &ProtobufValidatorMock{}
	validator.On("Validate", mock.Anything).Return(expectedError)
	var protobufValidator pkgAuditCommon.ProtobufValidator = validator

	auditApi := DynamicLegacyAuditApi{
		tracer:    otel.Tracer("test"),
		validator: protobufValidator,
	}

	event := internalAuditApi.NewSystemAuditEvent(nil)
	err := auditApi.Log(context.Background(), event, auditV1.Visibility_VISIBILITY_PUBLIC, pkgAuditCommon.RoutableSystemIdentifier)
	assert.ErrorIs(t, err, expectedError)
}

func TestDynamicLegacyAuditApi_Log_NilEvent(t *testing.T) {
	auditApi := DynamicLegacyAuditApi{tracer: otel.Tracer("test")}
	err := auditApi.Log(context.Background(), nil, auditV1.Visibility_VISIBILITY_PUBLIC, pkgAuditCommon.RoutableSystemIdentifier)
	assert.ErrorIs(t, err, pkgAuditCommon.ErrEventNil)
}

func TestDynamicLegacyAuditApi_ConvertAndSerializeIntoLegacyFormatInvalidObjectIdentifierType(t *testing.T) {
	customization := func(event *auditV1.AuditLogEntry,
		objectIdentifier *auditV1.ObjectIdentifier) {
		objectIdentifier.Type = "invalid"
	}
	event, objectIdentifier := internalAuditApi.NewProjectAuditEvent(&customization)

	validator := &ProtobufValidatorMock{}
	validator.On("Validate", mock.Anything).Return(nil)
	var protobufValidator pkgAuditCommon.ProtobufValidator = validator

	auditApi := DynamicLegacyAuditApi{
		tracer:    otel.Tracer("test"),
		validator: protobufValidator,
	}
	_, err := auditApi.ValidateAndSerialize(context.Background(), event, auditV1.Visibility_VISIBILITY_PUBLIC, pkgAuditCommon.NewRoutableIdentifier(objectIdentifier))
	assert.ErrorIs(t, err, pkgAuditCommon.ErrUnsupportedRoutableType)
}