using Azure.Core;
using Microsoft.Graph;
using Microsoft.SharePoint.Client;
using SharepointToolbox.Web.Core.Models;

namespace SharepointToolbox.Web.Infrastructure.Auth;

/// <summary>
/// Builds app-only (certificate-based) clients for a client profile. Drives BOTH the
/// background report scheduler AND the interactive session: when a profile is configured
/// for certificate auth (see <see cref="IsConfigured"/>), technicians operate through the
/// app identity and never sign in to SharePoint per profile. Requires
/// <see cref="TenantProfile.AppOnlyEnabled"/>, an app-only client id, and a stored certificate.
/// </summary>
public interface IAppOnlyContextFactory
{
    /// <summary>
    /// True when this profile can authenticate app-only without an interactive sign-in:
    /// <see cref="TenantProfile.AppOnlyEnabled"/> is set, an app-only client id is present,
    /// and a certificate is stored for the profile. When false, callers fall back to the
    /// delegated refresh-token flow.
    /// </summary>
    bool IsConfigured(TenantProfile profile);

    /// <summary>CSOM context for a specific site, authenticated app-only.</summary>
    Task<ClientContext> CreateContextAsync(TenantProfile profile, string siteUrl, CancellationToken ct = default);

    /// <summary>Microsoft Graph client, authenticated app-only.</summary>
    Task<GraphServiceClient> CreateGraphClientAsync(TenantProfile profile, CancellationToken ct = default);

    /// <summary>Acquires an app-only access token for an arbitrary scope (e.g. a SharePoint host or Graph).</summary>
    Task<AccessToken> GetTokenAsync(TenantProfile profile, string scope, CancellationToken ct = default);

    /// <summary>
    /// Verifies the stored credentials can authenticate against the tenant root web.
    /// Returns null on success, or an error message describing the failure.
    /// </summary>
    Task<string?> TestConnectionAsync(TenantProfile profile, CancellationToken ct = default);

    /// <summary>
    /// Polls <see cref="TestConnectionAsync"/> until it succeeds or <paramref name="timeout"/>
    /// elapses. After a fresh app registration, the certificate key credential and app-role
    /// admin consent take time to propagate through Entra (token requests 401 until then);
    /// this waits that window out. Returns null once ready, or the last error on timeout.
    /// </summary>
    Task<string?> WaitUntilReadyAsync(TenantProfile profile, TimeSpan timeout, CancellationToken ct = default);
}