using System.Net;
using System.Security.Claims;
using JobTrackerApi.Services;
using Microsoft.AspNetCore.Http;
using Xunit;

namespace JobTrackerApi.Tests;

public sealed class RateLimitPartitionKeysTests
{
    [Theory]
    [InlineData("account-data")]
    [InlineData("email-send")]
    public void Account_requires_authenticated_identity_and_keeps_anonymous_addresses_separate(string policy)
    {
        var anonymous = Context("203.0.113.10", "irrelevant");
        anonymous.User = new ClaimsPrincipal(new ClaimsIdentity(new[] { new Claim(ClaimTypes.NameIdentifier, "unvalidated") }));
        var otherIp = Context("203.0.113.11", "irrelevant");
        Assert.Equal($"{policy}:ip:203.0.113.10", RateLimitPartitionKeys.Account(anonymous, policy));
        Assert.NotEqual(RateLimitPartitionKeys.Account(anonymous, policy), RateLimitPartitionKeys.Account(otherIp, policy));
        // Even an authenticated identifier shaped like an IP cannot collide with anonymous traffic.
        var owner = Context("203.0.113.11", "irrelevant");
        owner.User = new ClaimsPrincipal(new ClaimsIdentity(new[] { new Claim("sub", "203.0.113.10") }, "validated"));
        Assert.Equal($"{policy}:user:203.0.113.10", RateLimitPartitionKeys.Account(owner, policy));
        Assert.NotEqual(RateLimitPartitionKeys.Account(owner, policy), RateLimitPartitionKeys.Account(anonymous, policy));
    }

    [Fact]
    public void Public_pdf_partition_isolated_by_client_and_slug()
    {
        var first = Context("203.0.113.10", "shared-slug");
        var second = Context("203.0.113.11", "shared-slug");
        var otherSlug = Context("203.0.113.10", "other-slug");

        Assert.NotEqual(RateLimitPartitionKeys.PublicPdf(first), RateLimitPartitionKeys.PublicPdf(second));
        Assert.NotEqual(RateLimitPartitionKeys.PublicPdf(first), RateLimitPartitionKeys.PublicPdf(otherSlug));
        Assert.Equal(RateLimitPartitionKeys.PublicPdf(first), RateLimitPartitionKeys.PublicPdf(Context("203.0.113.10", "shared-slug")));
    }

    private static DefaultHttpContext Context(string address, string slug)
    {
        var context = new DefaultHttpContext();
        context.Connection.RemoteIpAddress = IPAddress.Parse(address);
        context.Request.RouteValues["slug"] = slug;
        return context;
    }
}