PnvPanel/backend/tests/PnvPanel.Application.Tests/Configs/Revoke/RevokeVpnConfigCommandHandlerTests.cs

using Microsoft.Extensions.Logging;
using NSubstitute;
using PnvPanel.Application.Common.Interfaces;
using PnvPanel.Application.Common.Models;
using PnvPanel.Application.Configs;
using PnvPanel.Application.Configs.Revoke;
using PnvPanel.Application.Tests.TestSupport;
using PnvPanel.Domain.Configs;
using PnvPanel.Domain.Inbounds;
using PnvPanel.Domain.Nodes;
using Xunit;

namespace PnvPanel.Application.Tests.Configs.Revoke;

public class RevokeVpnConfigCommandHandlerTests
{
    private readonly IXuiPanelGateway _gateway = Substitute.For<IXuiPanelGateway>();
    private readonly IRealtimeNotifier _notifier = Substitute.For<IRealtimeNotifier>();
    private readonly ILogger<RevokeVpnConfigCommandHandler> _logger = Substitute.For<
        ILogger<RevokeVpnConfigCommandHandler>
    >();

    [Fact]
    public async Task Handle_WhenActiveConfigOwnedByUser_RevokesRemovesRemoteClientAndNotifies()
    {
        using var dbContext = InMemoryDbContextFactory.Create();
        var userId = Guid.NewGuid();

        var node = Node.Register(
            "node-1",
            new Uri("https://node1.example.com"),
            new NodeCredentials("admin", "protected"),
            null
        );
        var inbound = Inbound.FromRemote(node.Id, "1", VpnProtocol.Vless, "remark", 443);
        var config = VpnConfig.Create(userId, inbound.Id, VpnProtocol.Vless, null);
        config.AssignRemoteClient("external-id");

        dbContext.Nodes.Add(node);
        dbContext.Inbounds.Add(inbound);
        dbContext.VpnConfigs.Add(config);
        await dbContext.SaveChangesAsync(CancellationToken.None);

        _gateway
            .RemoveClientAsync(
                Arg.Any<PnvPanel.Domain.Nodes.Node>(),
                Arg.Any<string>(),
                Arg.Any<string>(),
                Arg.Any<VpnProtocol>(),
                Arg.Any<CancellationToken>()
            )
            .Returns(Result.Success());

        var handler = new RevokeVpnConfigCommandHandler(
            dbContext,
            _gateway,
            _notifier,
            FakeCurrentUser.Authenticated(userId),
            _logger
        );

        var result = await handler.Handle(
            new RevokeVpnConfigCommand(config.Id),
            CancellationToken.None
        );

        Assert.True(result.IsSuccess);
        Assert.Equal(ConfigStatus.Revoked, config.Status);
        await _gateway
            .Received(1)
            .RemoveClientAsync(
                Arg.Any<Node>(),
                inbound.RemoteInboundId,
                "external-id",
                config.Protocol,
                Arg.Any<CancellationToken>()
            );
        await _notifier
            .Received(1)
            .NotifyConfigStatusChangedAsync(
                userId,
                config.Id,
                ConfigStatus.Revoked,
                Arg.Any<CancellationToken>()
            );
    }

    [Fact]
    public async Task Handle_WhenInboundIsUnavailable_RevokesLocallyWithoutCallingGateway()
    {
        using var dbContext = InMemoryDbContextFactory.Create();
        var userId = Guid.NewGuid();

        var node = Node.Register(
            "node-1",
            new Uri("https://node1.example.com"),
            new NodeCredentials("admin", "protected"),
            null
        );
        var inbound = Inbound.FromRemote(node.Id, "1", VpnProtocol.Vless, "remark", 443);
        inbound.MarkUnavailable();
        var config = VpnConfig.Create(userId, inbound.Id, VpnProtocol.Vless, null);
        config.AssignRemoteClient("external-id");

        dbContext.Nodes.Add(node);
        dbContext.Inbounds.Add(inbound);
        dbContext.VpnConfigs.Add(config);
        await dbContext.SaveChangesAsync(CancellationToken.None);

        var handler = new RevokeVpnConfigCommandHandler(
            dbContext,
            _gateway,
            _notifier,
            FakeCurrentUser.Authenticated(userId),
            _logger
        );

        var result = await handler.Handle(
            new RevokeVpnConfigCommand(config.Id),
            CancellationToken.None
        );

        Assert.True(result.IsSuccess);
        Assert.Equal(ConfigStatus.Revoked, config.Status);
        await _gateway
            .DidNotReceive()
            .RemoveClientAsync(
                Arg.Any<Node>(),
                Arg.Any<string>(),
                Arg.Any<string>(),
                Arg.Any<VpnProtocol>(),
                Arg.Any<CancellationToken>()
            );
    }

    [Fact]
    public async Task Handle_WhenAlreadyRevoked_IsIdempotentAndDoesNotCallGateway()
    {
        using var dbContext = InMemoryDbContextFactory.Create();
        var userId = Guid.NewGuid();

        var inbound = Inbound.FromRemote(Guid.NewGuid(), "1", VpnProtocol.Vless, "remark", 443);
        var config = VpnConfig.Create(userId, inbound.Id, VpnProtocol.Vless, null);
        config.Revoke();

        dbContext.Inbounds.Add(inbound);
        dbContext.VpnConfigs.Add(config);
        await dbContext.SaveChangesAsync(CancellationToken.None);

        var handler = new RevokeVpnConfigCommandHandler(
            dbContext,
            _gateway,
            _notifier,
            FakeCurrentUser.Authenticated(userId),
            _logger
        );

        var result = await handler.Handle(
            new RevokeVpnConfigCommand(config.Id),
            CancellationToken.None
        );

        Assert.True(result.IsSuccess);
        await _gateway
            .DidNotReceive()
            .RemoveClientAsync(
                Arg.Any<PnvPanel.Domain.Nodes.Node>(),
                Arg.Any<string>(),
                Arg.Any<string>(),
                Arg.Any<VpnProtocol>(),
                Arg.Any<CancellationToken>()
            );
    }

    [Fact]
    public async Task Handle_WhenConfigNotFound_ReturnsNotFound()
    {
        using var dbContext = InMemoryDbContextFactory.Create();
        var userId = Guid.NewGuid();

        var handler = new RevokeVpnConfigCommandHandler(
            dbContext,
            _gateway,
            _notifier,
            FakeCurrentUser.Authenticated(userId),
            _logger
        );

        var result = await handler.Handle(
            new RevokeVpnConfigCommand(Guid.NewGuid()),
            CancellationToken.None
        );

        Assert.False(result.IsSuccess);
        Assert.Equal(ConfigErrors.NotFound, result.Error);
    }

    [Fact]
    public async Task Handle_WhenNotAuthenticated_ReturnsUnauthorized()
    {
        using var dbContext = InMemoryDbContextFactory.Create();

        var handler = new RevokeVpnConfigCommandHandler(
            dbContext,
            _gateway,
            _notifier,
            FakeCurrentUser.Anonymous(),
            _logger
        );

        var result = await handler.Handle(
            new RevokeVpnConfigCommand(Guid.NewGuid()),
            CancellationToken.None
        );

        Assert.False(result.IsSuccess);
        Assert.Equal(PnvPanel.Application.Auth.AuthErrors.Unauthorized, result.Error);
    }
}