<?php

namespace Tests\Feature;

use App\Jobs\SyncDeviceUser;
use App\Models\Device;
use App\Models\DeviceAccessUser;
use App\Models\DeviceType;
use App\Models\DeviceUserAssignment;
use App\Models\DeviceVendor;
use App\Models\User;
use App\Services\TenantProvisioningService;
use App\Support\TenantContext;
use Database\Seeders\DeviceCatalogSeeder;
use Database\Seeders\RolePermissionSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Queue;
use Tests\TestCase;

class DeviceAccessUserTest extends TestCase
{
    use RefreshDatabase;

    protected function setUp(): void
    {
        parent::setUp();
        $this->seed([RolePermissionSeeder::class, DeviceCatalogSeeder::class]);
    }

    public function test_one_central_user_can_be_queued_for_multiple_devices_without_password_in_job(): void
    {
        Queue::fake();
        [$tenant, $admin] = $this->tenant('tenant-a');
        $devices = collect([$this->device($tenant->id, $admin->id), $this->device($tenant->id, $admin->id, '10.0.0.2')]);

        $this->actingAs($admin)->post(route('device-users.store'), [
            'display_name' => 'Operator NOC', 'username' => 'noc.operator',
            'password' => 'Device!Password123', 'password_confirmation' => 'Device!Password123',
            'group_name' => 'RADIQ-NOC', 'device_ids' => $devices->pluck('id')->all(), 'is_enabled' => true,
        ])->assertRedirect(route('device-users.index'));

        $accessUser = DeviceAccessUser::withoutGlobalScope('tenant')->firstOrFail();
        $this->assertSame('Device!Password123', $accessUser->password);
        $this->assertNotSame('Device!Password123', DB::table('device_access_users')->value('password'));
        $this->assertDatabaseCount('device_user_assignments', 2);
        Queue::assertPushed(SyncDeviceUser::class, 2);
        Queue::assertPushed(SyncDeviceUser::class, fn (SyncDeviceUser $job) => $job->tenantId === $tenant->id && ! property_exists($job, 'password'));
    }

    public function test_unsupported_vendor_is_recorded_without_losing_pending_work(): void
    {
        [$tenant, $admin] = $this->tenant('tenant-a');
        $device = $this->device($tenant->id, $admin->id);
        $user = DeviceAccessUser::create(['tenant_id' => $tenant->id, 'display_name' => 'Operator', 'username' => 'operator', 'password' => 'Device!Password123']);
        $assignment = DeviceUserAssignment::create(['tenant_id' => $tenant->id, 'device_access_user_id' => $user->id, 'device_id' => $device->id, 'group_name' => 'RADIQ-NOC']);

        (new SyncDeviceUser($tenant->id, $assignment->id))->handle(app(TenantContext::class));

        $this->assertSame('unsupported', $assignment->fresh()->sync_status);
        $this->assertSame('DRIVER_NOT_AVAILABLE', $assignment->fresh()->error_code);
    }

    private function tenant(string $slug): array
    {
        $tenant = app(TenantProvisioningService::class)->createWithOwner(['name' => strtoupper($slug), 'slug' => $slug, 'owner_name' => 'Admin', 'owner_email' => $slug.'@test.local', 'owner_password' => 'Strong!Password123']);

        return [$tenant, User::withoutGlobalScope('tenant')->where('tenant_id', $tenant->id)->firstOrFail()];
    }

    private function device(int $tenantId, int $adminId, string $address = '10.0.0.1'): Device
    {
        return Device::create(['tenant_id' => $tenantId, 'name' => 'Device '.$address, 'device_vendor_id' => DeviceVendor::where('slug', 'zte')->first()->id, 'device_type_id' => DeviceType::first()->id, 'management_address' => $address, 'management_port' => 22, 'connection_type' => 'ssh', 'created_by' => $adminId]);
    }
}