using System.Security.Cryptography;
using Microsoft.Extensions.Configuration;
using UniVerse.Infrastructure.ExternalServices;
using Xunit;

namespace UniVerse.Api.Tests.Auth;

public class EntraTokenCacheStoreTests
{
    [Fact]
    public async Task SaveReadRemove_EncryptsTokensAndRestoresAfterNewStoreInstance()
    {
        var directory = Path.Combine(Path.GetTempPath(), $"universe-cache-test-{Guid.NewGuid():N}");
        try
        {
            var configuration = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
            {
                ["AzureAd:TokenCacheDirectory"] = directory,
                ["AzureAd:TokenCacheKey"] = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32))
            }).Build();
            var store = new EntraTokenCacheStore(configuration);
            var tokens = System.Text.Encoding.UTF8.GetBytes("sensitive-refresh-token");

            await store.SaveAsync(7, "account-7", tokens, CancellationToken.None);

            var file = File.ReadAllBytes(Path.Combine(directory, "user-7.bin"));
            Assert.DoesNotContain("sensitive-refresh-token", System.Text.Encoding.UTF8.GetString(file));
            var restored = await new EntraTokenCacheStore(configuration).ReadAsync(7, CancellationToken.None);
            Assert.Equal("account-7", restored?.AccountId);
            Assert.Equal(tokens, restored?.Cache);

            await store.RemoveAsync(7);
            Assert.Null(await store.ReadAsync(7, CancellationToken.None));
        }
        finally
        {
            if (Directory.Exists(directory)) Directory.Delete(directory, true);
        }
    }
}