// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.
 
using Aspire.Deployment.EndToEnd.Tests.Helpers;
using Hex1b.Automation;
using Xunit;
 
namespace Aspire.Deployment.EndToEnd.Tests;
 
/// <summary>
/// L2+L3 connectivity verification test for Azure Key Vault with VNet and Private Endpoint.
/// Deploys a starter app with VNet + PE + Aspire Key Vault client, then curls the app to prove PE connectivity.
/// </summary>
public sealed class VnetKeyVaultConnectivityDeploymentTests(ITestOutputHelper output)
{
    private static readonly TimeSpan s_testTimeout = TimeSpan.FromMinutes(40);
 
    [Fact]
    public async Task DeployStarterTemplateWithKeyVaultPrivateEndpoint()
    {
        using var cts = new CancellationTokenSource(s_testTimeout);
        using var linkedCts = CancellationTokenSource.CreateLinkedTokenSource(
            cts.Token, TestContext.Current.CancellationToken);
        var cancellationToken = linkedCts.Token;
 
        await DeployStarterTemplateWithKeyVaultPrivateEndpointCore(cancellationToken);
    }
 
    private async Task DeployStarterTemplateWithKeyVaultPrivateEndpointCore(CancellationToken cancellationToken)
    {
        var subscriptionId = AzureAuthenticationHelpers.TryGetSubscriptionId();
        if (string.IsNullOrEmpty(subscriptionId))
        {
            Assert.Skip("Azure subscription not configured. Set ASPIRE_DEPLOYMENT_TEST_SUBSCRIPTION.");
        }
 
        if (!AzureAuthenticationHelpers.IsAzureAuthAvailable())
        {
            if (DeploymentE2ETestHelpers.IsRunningInCI)
            {
                Assert.Fail("Azure authentication not available in CI. Check OIDC configuration.");
            }
            else
            {
                Assert.Skip("Azure authentication not available. Run 'az login' to authenticate.");
            }
        }
 
        var workspace = TemporaryWorkspace.Create(output);
        var startTime = DateTime.UtcNow;
        var deploymentUrls = new Dictionary<string, string>();
        var resourceGroupName = DeploymentE2ETestHelpers.GenerateResourceGroupName("vnet-kv-l23");
        var projectName = "VnetKvApp";
 
        output.WriteLine($"Test: {nameof(DeployStarterTemplateWithKeyVaultPrivateEndpoint)}");
        output.WriteLine($"Project Name: {projectName}");
        output.WriteLine($"Resource Group: {resourceGroupName}");
        output.WriteLine($"Subscription: {subscriptionId[..8]}...");
        output.WriteLine($"Workspace: {workspace.WorkspaceRoot.FullName}");
 
        try
        {
            using var terminal = DeploymentE2ETestHelpers.CreateTestTerminal();
            var pendingRun = terminal.RunAsync(cancellationToken);
 
            var counter = new SequenceCounter();
            var auto = new Hex1bTerminalAutomator(terminal, defaultTimeout: TimeSpan.FromSeconds(500));
 
            // Step 1: Prepare environment
            output.WriteLine("Step 1: Preparing environment...");
            await auto.PrepareEnvironmentAsync(workspace, counter);
 
            await auto.InstallCurrentBuildAspireCliAsync(counter, output);
 
            // Step 3: Create starter project using aspire new
            output.WriteLine("Step 3: Creating starter project...");
            await auto.AspireNewAsync(projectName, counter, useRedisCache: false);
 
            // Step 4: Navigate to project directory
            await auto.TypeAsync($"cd {projectName}");
            await auto.EnterAsync();
            await auto.WaitForSuccessPromptAsync(counter);
 
            // Step 5a: Add Aspire.Hosting.Azure.AppContainers
            output.WriteLine("Step 5a: Adding Azure Container Apps hosting package...");
            await auto.TypeAsync("aspire add Aspire.Hosting.Azure.AppContainers");
            await auto.EnterAsync();
 
            await auto.WaitForAspireAddCompletionAsync(counter);
 
            // Step 5b: Add Aspire.Hosting.Azure.Network
            output.WriteLine("Step 5b: Adding Azure Network hosting package...");
            await auto.TypeAsync("aspire add Aspire.Hosting.Azure.Network");
            await auto.EnterAsync();
 
            await auto.WaitForAspireAddCompletionAsync(counter);
 
            // Step 5c: Add Aspire.Hosting.Azure.KeyVault
            output.WriteLine("Step 5c: Adding Azure Key Vault hosting package...");
            await auto.TypeAsync("aspire add Aspire.Hosting.Azure.KeyVault");
            await auto.EnterAsync();
 
            await auto.WaitForAspireAddCompletionAsync(counter);
 
            // Step 6: Add Aspire client package to the Web project
            output.WriteLine("Step 6: Adding Key Vault client package to Web project...");
            await auto.TypeAsync($"dotnet add {projectName}.Web package Aspire.Azure.Security.KeyVault --prerelease");
            await auto.EnterAsync();
            await auto.WaitForSuccessPromptAsync(counter, TimeSpan.FromSeconds(120));
 
            // Step 7: Modify AppHost.cs to add VNet + PE + WithReference
            {
                var projectDir = Path.Combine(workspace.WorkspaceRoot.FullName, projectName);
                var appHostDir = Path.Combine(projectDir, $"{projectName}.AppHost");
                var appHostFilePath = Path.Combine(appHostDir, "AppHost.cs");
 
                output.WriteLine($"Looking for AppHost.cs at: {appHostFilePath}");
 
                var content = File.ReadAllText(appHostFilePath);
 
                content = content.Replace(
                    "var builder = DistributedApplication.CreateBuilder(args);",
                    """
var builder = DistributedApplication.CreateBuilder(args);
 
#pragma warning disable ASPIREAZURE003
 
// VNet with delegated subnet for ACA and PE subnet
var vnet = builder.AddAzureVirtualNetwork("vnet");
var acaSubnet = vnet.AddSubnet("aca-subnet", "10.0.0.0/23");
var peSubnet = vnet.AddSubnet("pe-subnet", "10.0.2.0/24");
 
builder.AddAzureContainerAppEnvironment("env")
    .WithDelegatedSubnet(acaSubnet);
 
// Key Vault with Private Endpoint
var kv = builder.AddAzureKeyVault("kv");
peSubnet.AddPrivateEndpoint(kv);
 
#pragma warning restore ASPIREAZURE003
""");
 
                content = content.Replace(
                    ".WithExternalHttpEndpoints()",
                    ".WithExternalHttpEndpoints()\n    .WithReference(kv)");
 
                File.WriteAllText(appHostFilePath, content);
 
                output.WriteLine($"Modified AppHost.cs with VNet + Key Vault PE + WithReference");
                output.WriteLine($"New content:\n{content}");
            }
 
            // Step 8: Modify Web project Program.cs to register Key Vault client
            {
                var projectDir = Path.Combine(workspace.WorkspaceRoot.FullName, projectName);
                var webProgramPath = Path.Combine(projectDir, $"{projectName}.Web", "Program.cs");
 
                output.WriteLine($"Looking for Web Program.cs at: {webProgramPath}");
 
                var content = File.ReadAllText(webProgramPath);
 
                content = content.Replace(
                    "builder.AddServiceDefaults();",
                    """
builder.AddServiceDefaults();
builder.AddAzureKeyVaultClient("kv");
""");
 
                File.WriteAllText(webProgramPath, content);
 
                output.WriteLine($"Modified Web Program.cs to add Key Vault client registration");
            }
 
            // Step 9: Navigate to AppHost project directory
            await auto.TypeAsync($"cd {projectName}.AppHost");
            await auto.EnterAsync();
            await auto.WaitForSuccessPromptAsync(counter);
 
            // Step 10: Set environment variables for deployment
            await auto.TypeAsync($"unset ASPIRE_PLAYGROUND && export AZURE__LOCATION=westus3 && export AZURE__RESOURCEGROUP={resourceGroupName}");
            await auto.EnterAsync();
            await auto.WaitForSuccessPromptAsync(counter);
 
            // Step 11: Deploy to Azure
            output.WriteLine("Step 11: Starting Azure deployment...");
            await auto.TypeAsync("aspire deploy --clear-cache");
            await auto.EnterAsync();
            await auto.WaitForPipelineSuccessAsync(timeout: TimeSpan.FromMinutes(30));
            await auto.WaitForSuccessPromptAsync(counter, TimeSpan.FromMinutes(2));
 
            // Step 12: Verify PE infrastructure
            output.WriteLine("Step 12: Verifying PE infrastructure...");
            await auto.TypeAsync($"az network private-endpoint list -g \"{resourceGroupName}\" --query \"[].{{name:name,state:provisioningState}}\" -o table && " +
                      $"az network private-dns zone list -g \"{resourceGroupName}\" --query \"[].name\" -o tsv");
            await auto.EnterAsync();
            await auto.WaitForSuccessPromptAsync(counter, TimeSpan.FromSeconds(60));
 
            // Step 13: Verify deployed endpoints with retry
            output.WriteLine("Step 13: Verifying deployed endpoints...");
            await auto.TypeAsync($"RG_NAME=\"{resourceGroupName}\" && " +
                      "urls=$(az containerapp list -g \"$RG_NAME\" --query \"[].properties.configuration.ingress.fqdn\" -o tsv 2>/dev/null | grep -v '\\.internal\\.') && " +
                      "if [ -z \"$urls\" ]; then echo \"❌ No external container app endpoints found\"; exit 1; fi && " +
                      "failed=0 && " +
                      "for url in $urls; do " +
                      "echo \"Checking https://$url...\"; " +
                      "success=0; " +
                      "for i in $(seq 1 18); do " +
                      "STATUS=$(curl -s -o /dev/null -w \"%{http_code}\" \"https://$url\" --max-time 10 2>/dev/null); " +
                      "if [ \"$STATUS\" = \"200\" ] || [ \"$STATUS\" = \"302\" ]; then echo \"  ✅ $STATUS (attempt $i)\"; success=1; break; fi; " +
                      "echo \"  Attempt $i: $STATUS, retrying in 10s...\"; sleep 10; " +
                      "done; " +
                      "if [ \"$success\" -eq 0 ]; then echo \"  ❌ Failed after 18 attempts\"; failed=1; fi; " +
                      "done && " +
                      "if [ \"$failed\" -ne 0 ]; then echo \"❌ One or more endpoint checks failed\"; exit 1; fi");
            await auto.EnterAsync();
            await auto.WaitForSuccessPromptAsync(counter, TimeSpan.FromMinutes(5));
 
            // Step 14: Exit terminal
            await auto.TypeAsync("exit");
            await auto.EnterAsync();
 
            await pendingRun;
 
            var duration = DateTime.UtcNow - startTime;
            output.WriteLine($"Deployment completed in {duration}");
 
            DeploymentReporter.ReportDeploymentSuccess(
                nameof(DeployStarterTemplateWithKeyVaultPrivateEndpoint),
                resourceGroupName,
                deploymentUrls,
                duration);
 
            output.WriteLine("✅ Test passed!");
        }
        catch (Exception ex)
        {
            var duration = DateTime.UtcNow - startTime;
            output.WriteLine($"❌ Test failed after {duration}: {ex.Message}");
 
            DeploymentReporter.ReportDeploymentFailure(
                nameof(DeployStarterTemplateWithKeyVaultPrivateEndpoint),
                resourceGroupName,
                ex.Message,
                ex.StackTrace);
 
            throw;
        }
        finally
        {
            output.WriteLine($"Triggering cleanup of resource group: {resourceGroupName}");
            TriggerCleanupResourceGroup(resourceGroupName, output);
            DeploymentReporter.ReportCleanupStatus(resourceGroupName, success: true, "Cleanup triggered (fire-and-forget)");
        }
    }
 
    private static void TriggerCleanupResourceGroup(string resourceGroupName, ITestOutputHelper output)
    {
        var process = new System.Diagnostics.Process
        {
            StartInfo = new System.Diagnostics.ProcessStartInfo
            {
                FileName = "az",
                Arguments = $"group delete --name {resourceGroupName} --yes --no-wait",
                RedirectStandardOutput = true,
                RedirectStandardError = true,
                UseShellExecute = false,
                CreateNoWindow = true
            }
        };
 
        try
        {
            process.Start();
            output.WriteLine($"Cleanup triggered for resource group: {resourceGroupName}");
        }
        catch (Exception ex)
        {
            output.WriteLine($"Failed to trigger cleanup: {ex.Message}");
        }
    }
}