using SQLInsight.Core.Data;
using SQLInsight.Core.Findings;
using SQLInsight.Rules.Engine;
using SQLInsight.Rules.Instance;
using static SQLInsight.Rules.Tests.TestInstances;

namespace SQLInsight.Rules.Tests;

public class ErrorLogRuleTests
{
    private static RuleResult Run(IRule rule, RuleContext context) => Assert.Single(new RuleEngine([rule]).Evaluate(context));

    private static ErrorLogSnapshot Log(ErrorLogSource source, params ErrorLogGroup[] groups) => new()
    {
        CapturedAt = Now, Source = source, ReadUntil = Now, Groups = groups, Recent = groups, LoginFailureBurst = 20,
        Coverage = source == ErrorLogSource.ErrorLog ? null : "Giv agenten ALTER TRACE eller securityadmin",
    };

    private static ErrorLogGroup G(ErrorLogCategory category, int error, int severity, int count = 1) =>
        new(category, error, severity, count, Now.AddMinutes(-3), Now.AddMinutes(-1), "Error text with login 'anne'");

    [Theory]
    [InlineData(824, Severity.Critical)]
    [InlineData(825, Severity.High)]
    public void Corruption_is_critical_and_read_retries_high(int error, Severity expected)
    {
        var finding = Assert.Single(Run(new CorruptionErrorRule(), With(Log(ErrorLogSource.DefaultTrace, G(ErrorLogCategory.Corruption, error, 24)))).Findings);

        Assert.Equal(expected, finding.Severity);
        Assert.True(finding.Evidence.Single(e => e.Name == "Eksempel").Sensitive);
    }

    [Fact]
    public void Slow_io_and_stack_dumps_need_the_text_of_the_log()
    {
        var result = Run(new SlowIoErrorRule(), With(Log(ErrorLogSource.RingBuffer)));

        Assert.Equal(RuleOutcome.NotMeasurable, result.Outcome);
        Assert.Contains("securityadmin ADD MEMBER", result.Reason, StringComparison.Ordinal);
        Assert.Equal(RuleOutcome.NotMeasurable, Run(new SlowIoErrorRule(), With(Log(ErrorLogSource.DefaultTrace))).Outcome);
        Assert.Equal(RuleOutcome.Findings, Run(new SlowIoErrorRule(), With(Log(ErrorLogSource.ErrorLog, G(ErrorLogCategory.SlowIo, 833, 10)))).Outcome);
        Assert.Equal(RuleOutcome.NotMeasurable, Run(new StackDumpRule(), With(Log(ErrorLogSource.RingBuffer))).Outcome);
    }

    [Theory]
    [InlineData(19, RuleOutcome.Passed)]
    [InlineData(20, RuleOutcome.Findings)]
    public void Login_failures_are_a_finding_from_the_burst_size(int count, RuleOutcome expected) =>
        Assert.Equal(expected, Run(new LoginFailureBurstRule(), With(Log(ErrorLogSource.RingBuffer, G(ErrorLogCategory.LoginFailed, 18456, 14, count)))).Outcome);

    [Theory]
    [InlineData(17, Severity.Medium)]
    [InlineData(21, Severity.High)]
    public void Severe_errors_by_severity(int severity, Severity expected) =>
        Assert.Equal(expected, Assert.Single(Run(new SevereErrorRule(), With(Log(ErrorLogSource.RingBuffer, G(ErrorLogCategory.Severe, 701, severity)))).Findings).Severity);
}