using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Linq;
using System.Text.Json;
using StellaOps.Scanner.Core.Contracts;
using StellaOps.Scanner.Emit.Composition;
using Xunit;

namespace StellaOps.Scanner.Emit.Tests.Composition;

public sealed class CycloneDxComposerTests
{
    [Fact]
    public void Compose_ProducesInventoryAndUsageArtifacts()
    {
        var request = BuildRequest();
        var composer = new CycloneDxComposer();

        var result = composer.Compose(request);

        Assert.NotNull(result.Inventory);
        Assert.StartsWith("urn:uuid:", result.Inventory.SerialNumber, StringComparison.Ordinal);
        Assert.Equal("application/vnd.cyclonedx+json; version=1.6", result.Inventory.JsonMediaType);
        Assert.Equal("application/vnd.cyclonedx+protobuf; version=1.6", result.Inventory.ProtobufMediaType);
        Assert.Equal(2, result.Inventory.Components.Length);

        Assert.NotNull(result.Usage);
        Assert.Equal("application/vnd.cyclonedx+json; version=1.6; view=usage", result.Usage!.JsonMediaType);
        Assert.Single(result.Usage.Components);
        Assert.Equal("pkg:npm/a", result.Usage.Components[0].Identity.Key);

        ValidateJson(result.Inventory.JsonBytes, expectedComponentCount: 2, expectedView: "inventory");
        ValidateJson(result.Usage.JsonBytes, expectedComponentCount: 1, expectedView: "usage");

        var inventoryComponentA = result.Inventory.Components.Single(component => string.Equals(component.Identity.Key, "pkg:npm/a", StringComparison.Ordinal));
        Assert.Equal("abcdef1234567890abcdef1234567890abcdef12", inventoryComponentA.Metadata?.BuildId);

        using var inventoryDoc = JsonDocument.Parse(result.Inventory.JsonBytes);
        var inventoryRoot = inventoryDoc.RootElement;
        Assert.True(inventoryRoot.TryGetProperty("vulnerabilities", out var inventoryVulnerabilities));
        var inventoryVulns = inventoryVulnerabilities.EnumerateArray().ToArray();
        Assert.Equal(2, inventoryVulns.Length);

        var primaryVuln = inventoryVulns.Single(v => string.Equals(v.GetProperty("bom-ref").GetString(), "finding-a", StringComparison.Ordinal));
        var primaryProperties = primaryVuln.GetProperty("properties")
            .EnumerateArray()
            .ToDictionary(
                element => element.GetProperty("name").GetString()!,
                element => element.GetProperty("value").GetString()!,
                StringComparer.Ordinal);
        Assert.Equal("Blocked", primaryProperties["stellaops:policy.status"]);
        Assert.Equal("true", primaryProperties["stellaops:policy.quiet"]);
        Assert.Equal("40.5", primaryProperties["stellaops:policy.score"]);
        Assert.Equal("medium", primaryProperties["stellaops:policy.confidenceBand"]);
        Assert.Equal("runtime", primaryProperties["stellaops:policy.reachability"]);
        Assert.Equal("0.45", primaryProperties["stellaops:policy.input.reachabilityWeight"]);
        var ratingScore = primaryVuln.GetProperty("ratings").EnumerateArray().Single().GetProperty("score").GetDouble();
        Assert.Equal(40.5, ratingScore);

        using var usageDoc = JsonDocument.Parse(result.Usage.JsonBytes);
        var usageRoot = usageDoc.RootElement;
        Assert.True(usageRoot.TryGetProperty("vulnerabilities", out var usageVulnerabilities));
        var usageVulns = usageVulnerabilities.EnumerateArray().ToArray();
        Assert.Single(usageVulns);
        Assert.Equal("finding-a", usageVulns[0].GetProperty("bom-ref").GetString());
    }

    [Fact]
    public void Compose_IsDeterministic()
    {
        var request = BuildRequest();
        var composer = new CycloneDxComposer();

        var first = composer.Compose(request);
        var second = composer.Compose(request);

        Assert.Equal(first.Inventory.JsonSha256, second.Inventory.JsonSha256);
        Assert.Equal(first.Inventory.ProtobufSha256, second.Inventory.ProtobufSha256);
        Assert.Equal(first.Inventory.SerialNumber, second.Inventory.SerialNumber);

        Assert.NotNull(first.Usage);
        Assert.NotNull(second.Usage);
        Assert.Equal(first.Usage!.JsonSha256, second.Usage!.JsonSha256);
        Assert.Equal(first.Usage.ProtobufSha256, second.Usage.ProtobufSha256);
        Assert.Equal(first.Usage.SerialNumber, second.Usage.SerialNumber);
    }

    private static SbomCompositionRequest BuildRequest()
    {
        var fragments = new[]
        {
            LayerComponentFragment.Create("sha256:layer1", new[]
            {
                new ComponentRecord
                {
                    Identity = ComponentIdentity.Create("pkg:npm/a", "component-a", "1.0.0", "pkg:npm/a@1.0.0", "library"),
                    LayerDigest = "sha256:layer1",
                    Evidence = ImmutableArray.Create(ComponentEvidence.FromPath("/app/node_modules/a/package.json")),
                    Dependencies = ImmutableArray.Create("pkg:npm/b"),
                    Usage = ComponentUsage.Create(true, new[] { "/app/start.sh" }),
                    Metadata = new ComponentMetadata
                    {
                        Scope = "runtime",
                        Licenses = new[] { "MIT" },
                        Properties = new Dictionary<string, string>
                        {
                            ["stellaops:source"] = "package-lock.json",
                            ["stellaops.os.analyzer"] = "apk",
                            ["stellaops.os.architecture"] = "x86_64",
                        },
                        BuildId = "ABCDEF1234567890ABCDEF1234567890ABCDEF12",
                    },
                }
            }),
            LayerComponentFragment.Create("sha256:layer2", new[]
            {
                new ComponentRecord
                {
                    Identity = ComponentIdentity.Create("pkg:npm/b", "component-b", "2.0.0", "pkg:npm/b@2.0.0", "library"),
                    LayerDigest = "sha256:layer2",
                    Evidence = ImmutableArray.Create(ComponentEvidence.FromPath("/app/node_modules/b/package.json")),
                    Usage = ComponentUsage.Create(false),
                    Metadata = new ComponentMetadata
                    {
                        Scope = "development",
                        Properties = new Dictionary<string, string>
                        {
                            ["stellaops.os.analyzer"] = "language-node",
                        },
                    },
                }
            })
        };

        var image = new ImageArtifactDescriptor
        {
            ImageDigest = "sha256:1234567890abcdef",
            ImageReference = "registry.example.com/app/service:1.2.3",
            Repository = "registry.example.com/app/service",
            Tag = "1.2.3",
            Architecture = "amd64",
        };

        return SbomCompositionRequest.Create(
            image,
            fragments,
            new DateTimeOffset(2025, 10, 19, 12, 0, 0, TimeSpan.Zero),
            generatorName: "StellaOps.Scanner",
            generatorVersion: "0.10.0",
            properties: new Dictionary<string, string>
            {
                ["stellaops:scanId"] = "scan-1234",
            },
            policyFindings: new[]
            {
                new SbomPolicyFinding
                {
                    FindingId = "finding-a",
                    ComponentKey = "pkg:npm/a",
                    VulnerabilityId = "CVE-2025-0001",
                    Status = "Blocked",
                    Score = 40.5,
                    ConfigVersion = "1.0",
                    Quiet = true,
                    QuietedBy = "policy/quiet-critical-runtime",
                    UnknownConfidence = 0.42,
                    ConfidenceBand = "medium",
                    UnknownAgeDays = 5,
                    SourceTrust = "NVD",
                    Reachability = "runtime",
                    Inputs = ImmutableArray.Create(
                        new KeyValuePair<string, double>("severityWeight", 90),
                        new KeyValuePair<string, double>("trustWeight", 1.0),
                        new KeyValuePair<string, double>("reachabilityWeight", 0.45))
                },
                new SbomPolicyFinding
                {
                    FindingId = "finding-b",
                    ComponentKey = "pkg:npm/b",
                    VulnerabilityId = "CVE-2025-0002",
                    Status = "Warned",
                    Score = 12.5,
                    ConfigVersion = "1.0",
                    Quiet = false,
                    SourceTrust = "StellaOps",
                    Reachability = "indirect",
                    Inputs = ImmutableArray.Create(
                        new KeyValuePair<string, double>("severityWeight", 55),
                        new KeyValuePair<string, double>("trustWeight", 0.85))
                }
            });
    }

    private static void ValidateJson(byte[] data, int expectedComponentCount, string expectedView)
    {
        using var document = JsonDocument.Parse(data);
        var root = document.RootElement;

        Assert.True(root.TryGetProperty("metadata", out var metadata), "metadata property missing");
        var properties = metadata.GetProperty("properties");
        var viewProperty = properties.EnumerateArray()
            .Single(prop => string.Equals(prop.GetProperty("name").GetString(), "stellaops:sbom.view", StringComparison.Ordinal));
        Assert.Equal(expectedView, viewProperty.GetProperty("value").GetString());

        var components = root.GetProperty("components").EnumerateArray().ToArray();
        Assert.Equal(expectedComponentCount, components.Length);

        var names = components.Select(component => component.GetProperty("name").GetString()!).ToArray();
        Assert.Equal(names, names.OrderBy(n => n, StringComparer.Ordinal).ToArray());

        var firstComponentProperties = components[0].GetProperty("properties").EnumerateArray().ToDictionary(
            element => element.GetProperty("name").GetString()!,
            element => element.GetProperty("value").GetString()!,
            StringComparer.Ordinal);

        Assert.Equal("apk", firstComponentProperties["stellaops.os.analyzer"]);
        Assert.Equal("x86_64", firstComponentProperties["stellaops.os.architecture"]);
        Assert.Equal("abcdef1234567890abcdef1234567890abcdef12", firstComponentProperties["stellaops:buildId"]);
    }
}