package auth

import (
	"testing"

	"github.com/gochat/gochat/internal/config"
	"github.com/gochat/gochat/internal/model"
)

// ============================================================================
// JWT Service Benchmarks
// ============================================================================

// BenchmarkJWTService_GenerateTokenPair benchmarks JWT token pair generation.
// Reference: Chatwoot DeviseTokenAuth generates tokens in ~5-15ms (Ruby).
func BenchmarkJWTService_GenerateTokenPair(b *testing.B) {
	cfg := &config.JWTConfig{
		Secret:             "benchmark-secret-key-for-jwt-testing",
		ExpiryHours:        1,
		RefreshExpiryHours: 168,
	}
	svc := NewJWTService(cfg)
	user := &model.User{
		Base:     model.Base{ID: 42},
		Name:     "Benchmark Agent",
		Email:    "bench_jwt@test.com",
		Provider: "email",
		Role:     "agent",
	}

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		_, err := svc.GenerateTokenPair(user, 1, "agent")
		if err != nil {
			b.Fatal(err)
		}
	}
}

// BenchmarkJWTService_ValidateAccessToken benchmarks JWT access token validation.
// Reference: Chatwoot DeviseTokenAuth validates tokens in ~3-10ms (Ruby).
func BenchmarkJWTService_ValidateAccessToken(b *testing.B) {
	cfg := &config.JWTConfig{
		Secret:             "benchmark-secret-key-for-jwt-testing",
		ExpiryHours:        1,
		RefreshExpiryHours: 168,
	}
	svc := NewJWTService(cfg)
	user := &model.User{
		Base:     model.Base{ID: 42},
		Name:     "Benchmark Agent",
		Email:    "bench_jwt@test.com",
		Provider: "email",
		Role:     "agent",
	}

	pair, err := svc.GenerateTokenPair(user, 1, "agent")
	if err != nil {
		b.Fatal(err)
	}

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		_, err := svc.ValidateAccessToken(pair.AccessToken)
		if err != nil {
			b.Fatal(err)
		}
	}
}

// BenchmarkJWTService_ValidateRefreshToken benchmarks JWT refresh token validation.
func BenchmarkJWTService_ValidateRefreshToken(b *testing.B) {
	cfg := &config.JWTConfig{
		Secret:             "benchmark-secret-key-for-jwt-testing",
		ExpiryHours:        1,
		RefreshExpiryHours: 168,
	}
	svc := NewJWTService(cfg)
	user := &model.User{
		Base:     model.Base{ID: 42},
		Name:     "Benchmark Agent",
		Email:    "bench_jwt@test.com",
		Provider: "email",
		Role:     "agent",
	}

	pair, err := svc.GenerateTokenPair(user, 1, "agent")
	if err != nil {
		b.Fatal(err)
	}

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		_, err := svc.ValidateRefreshToken(pair.RefreshToken)
		if err != nil {
			b.Fatal(err)
		}
	}
}

// ============================================================================
// Policy Evaluation Benchmarks
// ============================================================================

// BenchmarkPolicy_Can_Agent benchmarks the Can() permission check for agent role.
// Reference: Chatwoot Pundit policy check — Ruby takes ~2-5ms per check.
func BenchmarkPolicy_Can_Agent(b *testing.B) {
	policyCtx := NewPolicyContext(42, 1, "agent", 0, nil)

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		policyCtx.Can("read", "conversation")
	}
}

// BenchmarkPolicy_Can_Administrator benchmarks the Can() permission check for admin role.
func BenchmarkPolicy_Can_Administrator(b *testing.B) {
	policyCtx := NewPolicyContext(1, 1, "administrator", 0, nil)

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		policyCtx.Can("read", "conversation")
	}
}

// BenchmarkPolicy_Can_CustomRole benchmarks the Can() permission check for custom role.
func BenchmarkPolicy_Can_CustomRole(b *testing.B) {
	customPerms := PermissionMatrixMap{
		DimensionConversationManage:    PermissionRead,
		DimensionConversationDelete:    PermissionNone,
		DimensionContactManage:         PermissionFull,
		DimensionReportManage:          PermissionNone,
		DimensionKnowledgeBaseManage:   PermissionRead,
		DimensionAutomationManage:      PermissionNone,
	}
	policyCtx := NewPolicyContext(5, 1, "custom_role", 10, customPerms)

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		policyCtx.Can("manage", "contact")
	}
}

// BenchmarkPolicy_MultiCan benchmarks checking multiple permissions sequentially.
// Simulates a real request that checks several permissions before allowing action.
func BenchmarkPolicy_MultiCan(b *testing.B) {
	policyCtx := NewPolicyContext(42, 1, "agent", 0, nil)

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		policyCtx.Can("read", "conversation")
		policyCtx.Can("create", "message")
		policyCtx.Can("read", "inbox")
		policyCtx.Can("read", "contact")
	}
}