. $PSScriptRoot\..\..\Load-PesterModules.ps1
$here = Split-Path -Parent $MyInvocation.MyCommand.Path
$sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path) -replace '\.tests\.', '.'
$global:functionPath = Join-Path -Path $here -ChildPath $sut

InModuleScope -ModuleName Alkami.DevOps.SystemEngineering -ScriptBlock {
    Write-Host "InModuleScope - Overriding SUT: $global:functionPath"
    Import-Module $global:functionPath -Force
    $inScopeModule = "Alkami.DevOps.SystemEngineering"

    Describe "New-ServerlessServiceAccountSecret" {

        Mock -CommandName Get-LogLeadName       -ModuleName $inScopeModule -MockWith { return 'New-ServerlessServiceAccountSecret.tests' }
        Mock -CommandName Get-AWSRegion         -ModuleName $inScopeModule -MockWith { return @( @{ 'Region' = 'us-east-1' } ) }
        Mock -CommandName Import-AWSModule      -ModuleName $inScopeModule -MockWith {}
        Mock -CommandName New-SECSecret         -ModuleName $inScopeModule -MockWith { return @{ ARN = 'TestSecretArn' } }
        Mock -CommandName Write-SECSecretValue  -ModuleName $inScopeModule -MockWith {}
        Mock -CommandName Add-SECSecretToRegion -ModuleName $inScopeModule -MockWith  { return @{ ARN = 'TestSecretArn' } }

        $testList = @()
        $testList += ( New-Object 'Management.Automation.PsCredential' 'test1', ( ConvertTo-SecureString -AsPlainText -Force -String 'test1' ))
        $testList += ( New-Object 'Management.Automation.PsCredential' 'test2', ( ConvertTo-SecureString -AsPlainText -Force -String 'test2' ))

        Context "Parameter Validation" {

            It "Throws if SecretName Is Null" {
                { New-ServerlessServiceAccountSecret -SecretName $Null } | Should -Throw
            }

            It "Throws if SecretName Is Empty" {
                { New-ServerlessServiceAccountSecret -SecretName '' } | Should -Throw
            }

            It "Throws if UserDataList has too few elements" {
                { New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList @() } | Should -Throw
            }

            It "Throws if UserDataList has too many elements" {
                $badTestList = @()
                $badTestList += ( New-Object 'Management.Automation.PsCredential' 'test1', ( ConvertTo-SecureString -AsPlainText -Force -String 'test1' ))
                $badTestList += ( New-Object 'Management.Automation.PsCredential' 'test2', ( ConvertTo-SecureString -AsPlainText -Force -String 'test2' ))
                $badTestList += ( New-Object 'Management.Automation.PsCredential' 'test3', ( ConvertTo-SecureString -AsPlainText -Force -String 'test3' ))

                { New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $badTestList } | Should -Throw
            }

            It "Throws if EnvironmentTag Is Null" {
                { New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag $null } | Should -Throw
            }

            It "Throws if EnvironmentTag Is Empty" {
                { New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag '' } | Should -Throw
            }

            It "Throws if ProfileName Is Null" {
                { New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName $null } | Should -Throw
            }

            It "Throws if ProfileName Is Empty" {
                { New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName '' } | Should -Throw
            }

            It "Throws if Region Is Not In Allowable List" {
                { New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'Test' } | Should -Throw
            }

            It "Throws if ReplicationRegion Is Not In Allowable List" {
                { New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                     -ReplicationRegion 'Test' } | Should -Throw
            }

            It "Throws if Description Is Null" {
                { New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                     -ReplicationRegion 'us-east-1' -Description $null } | Should -Throw
            }

            It "Throws if Description Is Empty" {
                { New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                     -ReplicationRegion 'us-east-1' -Description '' } | Should -Throw
            }
        }

        Context "Logic" {

            It "Returns an Array of Strings" {

                (Get-Command New-ServerlessServiceAccountSecret).OutputType.Type.ToString() | Should -BeExactly "System.String[]"
            }

            It "Creates Secret Using Supplied Arguments" {

                New-ServerlessServiceAccountSecret -SecretName 'TestName' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                   -ReplicationRegion '' -Description 'TestDescription' | Out-Null

                Assert-MockCalled -ModuleName $inScopeModule -CommandName New-SECSecret -Times 1 -Exactly -Scope It `
                                  -ParameterFilter { (($Name -ceq 'TestName') -and ($Description -ceq 'TestDescription') -and `
                                                      ($ProfileName -ceq 'temp-test') -and ($Region -ceq 'us-east-1')) }
            }

            It "Applies Tags to the Created Secret" {

                New-ServerlessServiceAccountSecret -SecretName 'TestName' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                   -ReplicationRegion '' -Description 'TestDescription' | Out-Null

                Assert-MockCalled -ModuleName $inScopeModule -CommandName New-SECSecret -Times 1 -Exactly -Scope It `
                                  -ParameterFilter { $Tag.Count -gt 0 }
            }

            It "Creates Secret Using First User's Data" {

                New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                   -ReplicationRegion '' -Description 'Test' | Out-Null

                Assert-MockCalled -ModuleName $inScopeModule -CommandName New-SECSecret -Times 1 -Exactly -Scope It `
                                  -ParameterFilter { $SecretString -match "test1" }
            }

            It "Updates Secret Value Using Second User's Data" {

                New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                   -ReplicationRegion '' -Description 'Test' | Out-Null

                Assert-MockCalled -ModuleName $inScopeModule -CommandName Write-SECSecretValue -Times 1 -Exactly -Scope It `
                                  -ParameterFilter { $SecretString -match "test2" }
            }

            It "Applies Replication Policy If Replication Region Supplied" {

                New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                   -ReplicationRegion 'us-east-1' -Description 'Test' | Out-Null

                Assert-MockCalled -ModuleName $inScopeModule -CommandName Add-SECSecretToRegion -Times 1 -Exactly -Scope It `
                                  -ParameterFilter { $AddReplicaRegion[0].Region -ceq 'us-east-1' }
            }

            It "Returns Two ARNs If Replication Region Supplied" {

                $result = New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                             -ReplicationRegion 'us-east-1' -Description 'Test'

                $result | Should -HaveCount 2
            }

            It "Does Not Apply Replication Policy If Replication Region Is Null" {

                New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                   -ReplicationRegion $null -Description 'Test' | Out-Null

                Assert-MockCalled -ModuleName $inScopeModule -CommandName Add-SECSecretToRegion -Times 0 -Exactly -Scope It
            }

            It "Does Not Apply Replication Policy If Replication Region Is Empty" {

                New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                   -ReplicationRegion '' -Description 'Test' | Out-Null

                Assert-MockCalled -ModuleName $inScopeModule -CommandName Add-SECSecretToRegion -Times 0 -Exactly -Scope It
            }

            It "Returns One ARN If Replication Region Not Supplied" {

                $result = New-ServerlessServiceAccountSecret -SecretName 'Test' -UserDataList $testList -EnvironmentTag 'test' -ProfileName 'temp-test' -Region 'us-east-1' `
                                                             -ReplicationRegion '' -Description 'Test'

                $result | Should -HaveCount 1
            }
        }
    }
}