using System.DirectoryServices;
using System.Security.AccessControl;
using System.Security.Principal;
using SGU.AuthBroker.Core.Profiles;
using SGU.AuthBroker.Services;
using Xunit;

namespace SGU.AuthBroker.Tests;

public sealed class ActiveDirectorySynchronizerTests
{
    [Fact]
    public void GenderMetadataPreservesUnmanagedNotesAndReplacesItsManagedLine()
    {
        const string existing = "  Responsable de laboratorio  \r\n\r\nSGU-Gender: Male\r\nTurno vespertino";

        string? updated = ActiveDirectorySynchronizer.MergeGenderMetadata(
            existing,
            InstitutionalGender.Female);

        Assert.Equal(
            "  Responsable de laboratorio  \r\n\r\nTurno vespertino\r\nSGU-Gender: Female",
            updated);
    }

    [Fact]
    public void GenderMetadataDoesNotTruncateAnExistingFullNotesField()
    {
        string existing = new('x', 1024);

        string? updated = ActiveDirectorySynchronizer.MergeGenderMetadata(
            existing,
            InstitutionalGender.Male);

        Assert.Null(updated);
    }

    [Fact]
    public void CannotChangePasswordRulesAreCompleteAndIdempotent()
    {
        ActiveDirectorySecurity security = new();

        Assert.True(ActiveDirectorySynchronizer.EnsureCannotChangePassword(security));
        Assert.False(ActiveDirectorySynchronizer.EnsureCannotChangePassword(security));

        Guid changePasswordRight = new("AB721A53-1E2F-11D0-9819-00AA0040529B");
        ActiveDirectoryAccessRule[] rules = security
            .GetAccessRules(includeExplicit: true, includeInherited: false, typeof(SecurityIdentifier))
            .OfType<ActiveDirectoryAccessRule>()
            .Where(rule =>
                rule.AccessControlType == AccessControlType.Deny &&
                rule.ObjectType == changePasswordRight &&
                (rule.ActiveDirectoryRights & ActiveDirectoryRights.ExtendedRight) != 0)
            .ToArray();

        Assert.Equal(2, rules.Length);
        Assert.Contains(rules, rule => rule.IdentityReference.Equals(
            new SecurityIdentifier(WellKnownSidType.WorldSid, null)));
        Assert.Contains(rules, rule => rule.IdentityReference.Equals(
            new SecurityIdentifier(WellKnownSidType.SelfSid, null)));
    }
}