using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Threading.Tasks;
using LCU.Library.Internal.Security.Models.AuthRequest;
using LCU.Library.Internal.Security.Service;
using Microsoft.AspNetCore.Mvc;
using NUnit.Framework;

namespace LCU.Library.Internal.SecurityTests.Service
{
    public class UsernamePasswordAuthorizationServiceTest
    {
        private readonly IUsernamePasswordAuthorizationService _service;

        private readonly FakeAzureAdVerificationService _activeDirectoryService = new FakeAzureAdVerificationService();

        public UsernamePasswordAuthorizationServiceTest()
        {
            _service = new UsernamePasswordAuthorizationService(_activeDirectoryService);
        }

        [Test]
        public async Task OnAuthorizationAsync_NullJWTFromAd_ReturnsUnauthorized()
        {
            var authResult = await _service.OnAuthorizationAsync(AuthRequestFactory());

            Assert.IsInstanceOf<UnauthorizedResult>(authResult);
        }

        [Test]
        public async Task OnAuthorizationAsync_JWTNotAuthorizedByRole_ReturnsForbidden()
        {
            var request = AuthRequestFactory();
            _activeDirectoryService.SetAuthenticable(request.UserName, request.Password);

            var authResult = await _service.OnAuthorizationAsync(request);

            Assert.IsInstanceOf<ForbidResult>(authResult);
        }

        [Test]
        public async Task OnAuthorizationAsync_JWTAuthorized_ReturnsNull()
        {
            var request = AuthRequestFactory();
            _activeDirectoryService.SetAuthenticable(request.UserName, request.Password);
            _activeDirectoryService.SetAuthorized(request.UserName, request.Password);

            var authResult = await _service.OnAuthorizationAsync(request);

            Assert.IsNull(authResult);
        }

        private static AuthRequest AuthRequestFactory() => new AuthRequest
        {
            UserName = Guid.NewGuid().ToString(),
            Password = Guid.NewGuid().ToString()
        };

        private class FakeAzureAdVerificationService : IAzureAdVerificationService
        {
            private readonly IDictionary<string, IDictionary<string, JwtSecurityToken>> _tokens =
                new Dictionary<string, IDictionary<string, JwtSecurityToken>>();

            private readonly IList<JwtSecurityToken> _authorizedTokens = new List<JwtSecurityToken>();

            public void SetAuthenticable(string userName, string password)
            {
                if (_tokens.TryGetValue(userName, out var userPasswords))
                {
                    userPasswords[password] = new JwtSecurityToken();
                }
                else
                {
                    _tokens[userName] = new Dictionary<string, JwtSecurityToken>
                    {
                        [password] = new JwtSecurityToken()
                    };
                }
            }

            public void SetAuthorized(string userName, string password)
            {
                _authorizedTokens.Add(_tokens[userName][password]);
            }

            public Task<JwtSecurityToken> GetTokenForWebApiUsingUsernamePasswordAsync(string userName, string password)
            {
                return Task.FromResult
                (
                    _tokens.TryGetValue(userName, out var userPassword)
                        ? userPassword.TryGetValue(password, out var token)
                            ? token
                            : null
                        : null
                );
            }

            public bool ValidateJwtHasAuthorizedRole(JwtSecurityToken jsonToken)
            {
                return _authorizedTokens.Contains(jsonToken);
            }
            
            public bool ValidateJwtHasAuthorizedRole(JwtSecurityToken jsonToken, List<string> approvedRoles)
            {
                return _authorizedTokens.Contains(jsonToken);
            }
        }
    }
}