using System.Net;
using System.Net.Http.Json;
using CashLineERP.Contracts.Finance;

namespace CashLineERP.Api.Tests;

public sealed class SecurityValidationQaTests : IClassFixture<ApiTestFactory>
{
    private readonly HttpClient _client;

    public SecurityValidationQaTests(ApiTestFactory factory)
    {
        _client = factory.CreateClient();
    }

    [Fact]
    public async Task External_User_Cannot_Access_Internal_Finance_And_Workflow_Monitoring_Routes()
    {
        await _client.AuthenticateAsSupplierAsync();

        var financeStatementsResponse = await _client.GetAsync("/api/v1/reports/finance-statements/BALANCE_SHEET?asOfDate=2026-04-29");
        var accountingRulesResponse = await _client.GetAsync("/api/v1/finance/accounting-rules");
        var workflowMonitoringResponse = await _client.GetAsync("/api/v1/internal/workflow-monitoring?itemLimit=3");

        Assert.Equal(HttpStatusCode.Forbidden, financeStatementsResponse.StatusCode);
        Assert.Equal(HttpStatusCode.Forbidden, accountingRulesResponse.StatusCode);
        Assert.Equal(HttpStatusCode.Forbidden, workflowMonitoringResponse.StatusCode);
    }

    [Fact]
    public async Task External_Party_Cannot_Cross_Access_Financing_And_Compliance_Context()
    {
        await _client.AuthenticateAsCustomerAsync();

        var financingRequestsResponse = await _client.GetAsync("/api/v1/external/parties/1/financing/requests");
        var complianceDocumentsResponse = await _client.GetAsync("/api/v1/external/parties/1/compliance-documents");

        Assert.Equal(HttpStatusCode.Forbidden, financingRequestsResponse.StatusCode);
        Assert.Equal(HttpStatusCode.Forbidden, complianceDocumentsResponse.StatusCode);
    }

    [Fact]
    public async Task Finance_Maker_Cannot_Self_Approve_An_Accounting_Rule()
    {
        await _client.AuthenticateAsFinanceMakerAsync();

        var createRuleResponse = await _client.PostAsJsonAsync("/api/v1/finance/accounting-rules", new CreateFinanceAccountingRuleRequest(
            RuleName: "Deferred revenue security validation",
            GeneralLedgerAccountId: 2299,
            GeneralLedgerAccountCode: "2299",
            GeneralLedgerAccountName: "Deferred Revenue Security",
            AccountCategoryCode: "LIABILITY",
            StatementSectionCode: "CURRENT_LIABILITY",
            CashFlowCategoryCode: "NON_CASH",
            IsCashAccount: false,
            DisplayOrder: 2299,
            EffectiveFromDate: new DateOnly(2026, 4, 1),
            EffectiveToDate: null,
            Notes: "Security validation maker-checker guardrail."));
        Assert.True(createRuleResponse.IsSuccessStatusCode, await createRuleResponse.Content.ReadAsStringAsync());
        var createdRule = await createRuleResponse.Content.ReadFromJsonAsync<FinanceAccountingRuleResponse>();
        Assert.NotNull(createdRule);

        var submitResponse = await _client.PostAsync($"/api/v1/finance/accounting-rules/{createdRule!.FinanceAccountingRuleId}/submit", null);
        Assert.True(submitResponse.IsSuccessStatusCode, await submitResponse.Content.ReadAsStringAsync());

        var approveResponse = await _client.PostAsync($"/api/v1/finance/accounting-rules/{createdRule.FinanceAccountingRuleId}/approve", null);
        Assert.Equal(HttpStatusCode.BadRequest, approveResponse.StatusCode);
        Assert.Contains("maker-checker", await approveResponse.Content.ReadAsStringAsync(), StringComparison.OrdinalIgnoreCase);
    }
}
