using System.IdentityModel.Tokens.Jwt;
using System.Text;
using Microsoft.Extensions.Options;
using Microsoft.IdentityModel.Tokens;
using TarninaHub.Application.Models;
using TarninaHub.Infrastructure.Auth;

namespace TarninaHub.Tests.Auth;

public class TokenServiceTests
{
    private static AuthSettings CreateSettings() => new()
    {
        Issuer = "tarninahub",
        Audience = "tarninahub",
        SigningKey = new string('k', 40),
        TokenLifetimeMinutes = 30,
    };

    [Fact]
    public void CreateToken_IncludesSubjectAndRole()
    {
        var service = new TokenService(Options.Create(CreateSettings()));
        var user = new UserAccount("user:ania", "+48000000001", "ania@example.test", "user", null);

        var result = service.CreateToken(user);
        var jwt = new JwtSecurityTokenHandler().ReadJwtToken(result.AccessToken);

        Assert.Equal("user:ania", jwt.Claims.Single(claim => claim.Type == "sub").Value);
        Assert.Equal("user", jwt.Claims.Single(claim => claim.Type == "role").Value);
        Assert.Equal("tarninahub", jwt.Issuer);
        Assert.True(result.ExpiresAt > DateTimeOffset.UtcNow);
    }

    [Fact]
    public void CreateToken_IsValidatedByTheSameSigningKey()
    {
        var settings = CreateSettings();
        var service = new TokenService(Options.Create(settings));
        var user = new UserAccount("user:jst", "+48000000010", null, "jst", "organization:mops_krakow");

        var result = service.CreateToken(user);

        var parameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = settings.Issuer,
            ValidateAudience = true,
            ValidAudience = settings.Audience,
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(settings.SigningKey)),
            ValidateLifetime = true,
            RoleClaimType = "role",
            NameClaimType = "sub",
        };

        var handler = new JwtSecurityTokenHandler { MapInboundClaims = false };
        var principal = handler.ValidateToken(result.AccessToken, parameters, out _);

        Assert.Equal("jst", principal.FindFirst("role")?.Value);
        Assert.Equal("user:jst", principal.FindFirst("sub")?.Value);
    }
}