foxhunt/services/api_gateway/tests/regime_routing_integration_test.rs

//! Agent F8: Regime Endpoint Routing Integration Tests
//!
//! Comprehensive validation of API Gateway routing, authentication, rate limiting,
//! and performance for regime detection endpoints.
//!
//! Tests:
//! 1. Routing validation (GetRegimeState, GetRegimeTransitions)
//! 2. Authentication enforcement (valid JWT required)
//! 3. Rate limiting operational (requests within quota)
//! 4. Proxy latency (target: < 1ms)
//! 5. Concurrent requests (10 parallel)
//!
//! Requirements:
//! - API Gateway running on port 50051
//! - Trading Service running on port 50052
//! - Redis running on port 6379
//! - PostgreSQL running on port 5432
//!
//! Run with:
//! ```
//! cargo test -p api_gateway --test regime_routing_integration_test --ignored -- --nocapture
//! ```

#[path = "common/mod.rs"]
mod common;

use anyhow::Result;
use std::time::Instant;
use tonic::{metadata::MetadataValue, Request};

use api_gateway::foxhunt::tli::{
    trading_service_client::TradingServiceClient, GetRegimeStateRequest,
    GetRegimeTransitionsRequest,
};

/// Test 1: Basic Routing - GetRegimeState
#[tokio::test]
#[ignore = "Run manually with services running"]
async fn test_get_regime_state_routing() -> Result<()> {
    println!("\n=== Test 1: GetRegimeState Routing ===");

    // Create authenticated request
    let (token, _jti) = common::generate_test_token(
        "regime-test-user",
        vec!["trader".to_string()],
        vec!["trading.regime_state".to_string()],
        3600,
    )?;

    let mut client = TradingServiceClient::connect("http://localhost:50051").await?;

    let req = GetRegimeStateRequest {
        symbol: "ES.FUT".to_string(),
    };

    let mut request = Request::new(req);
    let auth_value = MetadataValue::try_from(format!("Bearer {}", token))?;
    request.metadata_mut().insert("authorization", auth_value);

    let start = Instant::now();
    let response = client.get_regime_state(request).await;
    let elapsed = start.elapsed();

    println!("  Response time: {:?}", elapsed);

    match response {
        Ok(resp) => {
            let regime = resp.into_inner();
            println!("  ✓ Routing successful");
            println!("    Symbol: {}", regime.symbol);
            println!("    Regime: {}", regime.current_regime);
            println!("    Confidence: {:.2}", regime.confidence);
            println!("    ADX: {:.2}", regime.adx);
            println!("    Latency: {:?}", elapsed);

            // Validate latency target
            if elapsed.as_millis() < 1 {
                println!("  ✅ PASS: Latency {} μs < 1ms target", elapsed.as_micros());
            } else {
                println!(
                    "  ⚠️  WARNING: Latency {} ms >= 1ms target",
                    elapsed.as_millis()
                );
            }

            Ok(())
        },
        Err(e) => {
            println!("  ❌ Routing failed: {:?}", e);
            println!("  Status code: {:?}", e.code());
            println!("  Message: {}", e.message());
            Err(anyhow::anyhow!("GetRegimeState routing failed: {}", e))
        },
    }
}

/// Test 2: Basic Routing - GetRegimeTransitions
#[tokio::test]
#[ignore = "Run manually with services running"]
async fn test_get_regime_transitions_routing() -> Result<()> {
    println!("\n=== Test 2: GetRegimeTransitions Routing ===");

    // Create authenticated request
    let (token, _jti) = common::generate_test_token(
        "regime-test-user",
        vec!["trader".to_string()],
        vec!["trading.regime_transitions".to_string()],
        3600,
    )?;

    let mut client = TradingServiceClient::connect("http://localhost:50051").await?;

    let req = GetRegimeTransitionsRequest {
        symbol: "ES.FUT".to_string(),
        limit: 10,
    };

    let mut request = Request::new(req);
    let auth_value = MetadataValue::try_from(format!("Bearer {}", token))?;
    request.metadata_mut().insert("authorization", auth_value);

    let start = Instant::now();
    let response = client.get_regime_transitions(request).await;
    let elapsed = start.elapsed();

    println!("  Response time: {:?}", elapsed);

    match response {
        Ok(resp) => {
            let transitions = resp.into_inner();
            println!("  ✓ Routing successful");
            println!("    Transitions count: {}", transitions.transitions.len());

            if !transitions.transitions.is_empty() {
                let first = &transitions.transitions[0];
                println!(
                    "    First transition: {} → {}",
                    first.from_regime, first.to_regime
                );
                println!("    Duration: {} bars", first.duration_bars);
                println!("    Probability: {:.2}", first.transition_probability);
            }

            println!("    Latency: {:?}", elapsed);

            // Validate latency target
            if elapsed.as_millis() < 1 {
                println!("  ✅ PASS: Latency {} μs < 1ms target", elapsed.as_micros());
            } else {
                println!(
                    "  ⚠️  WARNING: Latency {} ms >= 1ms target",
                    elapsed.as_millis()
                );
            }

            Ok(())
        },
        Err(e) => {
            println!("  ❌ Routing failed: {:?}", e);
            println!("  Status code: {:?}", e.code());
            println!("  Message: {}", e.message());
            Err(anyhow::anyhow!(
                "GetRegimeTransitions routing failed: {}",
                e
            ))
        },
    }
}

/// Test 3: Authentication Enforcement - No Token
#[tokio::test]
#[ignore = "Run manually with services running"]
async fn test_authentication_no_token() -> Result<()> {
    println!("\n=== Test 3: Authentication Enforcement (No Token) ===");

    let mut client = TradingServiceClient::connect("http://localhost:50051").await?;

    let req = GetRegimeStateRequest {
        symbol: "ES.FUT".to_string(),
    };

    let request = Request::new(req); // No authorization header

    let response = client.get_regime_state(request).await;

    match response {
        Ok(_) => {
            println!("  ❌ FAIL: Request succeeded without authentication");
            Err(anyhow::anyhow!("Authentication not enforced"))
        },
        Err(e) => {
            println!("  ✓ Request rejected (expected)");
            println!("    Status code: {:?}", e.code());
            println!("    Message: {}", e.message());

            if e.code() == tonic::Code::Unauthenticated {
                println!("  ✅ PASS: Correct error code (Unauthenticated)");
                Ok(())
            } else {
                println!(
                    "  ⚠️  WARNING: Expected Unauthenticated, got {:?}",
                    e.code()
                );
                Ok(())
            }
        },
    }
}

/// Test 4: Authentication Enforcement - Invalid Token
#[tokio::test]
#[ignore = "Run manually with services running"]
async fn test_authentication_invalid_token() -> Result<()> {
    println!("\n=== Test 4: Authentication Enforcement (Invalid Token) ===");

    let mut client = TradingServiceClient::connect("http://localhost:50051").await?;

    let req = GetRegimeStateRequest {
        symbol: "ES.FUT".to_string(),
    };

    let mut request = Request::new(req);
    let auth_value = MetadataValue::try_from("Bearer invalid.token.signature")?;
    request.metadata_mut().insert("authorization", auth_value);

    let response = client.get_regime_state(request).await;

    match response {
        Ok(_) => {
            println!("  ❌ FAIL: Request succeeded with invalid token");
            Err(anyhow::anyhow!("Invalid token not rejected"))
        },
        Err(e) => {
            println!("  ✓ Request rejected (expected)");
            println!("    Status code: {:?}", e.code());
            println!("    Message: {}", e.message());

            if e.code() == tonic::Code::Unauthenticated {
                println!("  ✅ PASS: Correct error code (Unauthenticated)");
                Ok(())
            } else {
                println!(
                    "  ⚠️  WARNING: Expected Unauthenticated, got {:?}",
                    e.code()
                );
                Ok(())
            }
        },
    }
}

/// Test 5: Authentication Enforcement - Expired Token
#[tokio::test]
#[ignore = "Run manually with services running"]
async fn test_authentication_expired_token() -> Result<()> {
    println!("\n=== Test 5: Authentication Enforcement (Expired Token) ===");

    let token = common::generate_expired_token("expired-user")?;

    let mut client = TradingServiceClient::connect("http://localhost:50051").await?;

    let req = GetRegimeStateRequest {
        symbol: "ES.FUT".to_string(),
    };

    let mut request = Request::new(req);
    let auth_value = MetadataValue::try_from(format!("Bearer {}", token))?;
    request.metadata_mut().insert("authorization", auth_value);

    let response = client.get_regime_state(request).await;

    match response {
        Ok(_) => {
            println!("  ❌ FAIL: Request succeeded with expired token");
            Err(anyhow::anyhow!("Expired token not rejected"))
        },
        Err(e) => {
            println!("  ✓ Request rejected (expected)");
            println!("    Status code: {:?}", e.code());
            println!("    Message: {}", e.message());

            if e.code() == tonic::Code::Unauthenticated {
                println!("  ✅ PASS: Correct error code (Unauthenticated)");
                Ok(())
            } else {
                println!(
                    "  ⚠️  WARNING: Expected Unauthenticated, got {:?}",
                    e.code()
                );
                Ok(())
            }
        },
    }
}

/// Test 6: Rate Limiting - Within Quota
#[tokio::test]
#[ignore = "Run manually with services running"]
async fn test_rate_limiting_within_quota() -> Result<()> {
    println!("\n=== Test 6: Rate Limiting (Within Quota) ===");

    // Create authenticated request
    let (token, _jti) = common::generate_test_token(
        "rate-limit-test-user",
        vec!["trader".to_string()],
        vec!["trading.regime_state".to_string()],
        3600,
    )?;

    let mut client = TradingServiceClient::connect("http://localhost:50051").await?;

    // Send 10 requests (default rate limit is 100 req/s)
    let mut success_count = 0;
    let mut failed_count = 0;

    for i in 0..10 {
        let req = GetRegimeStateRequest {
            symbol: "ES.FUT".to_string(),
        };

        let mut request = Request::new(req);
        let auth_value = MetadataValue::try_from(format!("Bearer {}", token))?;
        request.metadata_mut().insert("authorization", auth_value);

        let response = client.get_regime_state(request).await;

        match response {
            Ok(_) => success_count += 1,
            Err(e) => {
                if e.code() == tonic::Code::ResourceExhausted {
                    failed_count += 1;
                    println!("  ⚠️  Request {} rate limited (unexpected)", i + 1);
                }
            },
        }
    }

    println!("  Successful requests: {}/10", success_count);
    println!("  Rate limited: {}/10", failed_count);

    if success_count == 10 {
        println!("  ✅ PASS: All requests within quota succeeded");
        Ok(())
    } else {
        println!("  ⚠️  WARNING: {} requests rate limited", failed_count);
        Ok(())
    }
}

/// Test 7: Proxy Latency Measurement
#[tokio::test]
#[ignore = "Run manually with services running"]
async fn test_proxy_latency_measurement() -> Result<()> {
    println!("\n=== Test 7: Proxy Latency Measurement ===");

    // Create authenticated request
    let (token, _jti) = common::generate_test_token(
        "latency-test-user",
        vec!["trader".to_string()],
        vec!["trading.regime_state".to_string()],
        3600,
    )?;

    let mut client = TradingServiceClient::connect("http://localhost:50051").await?;

    // Warmup: 100 requests
    println!("  Warming up with 100 requests...");
    for _ in 0..100 {
        let req = GetRegimeStateRequest {
            symbol: "ES.FUT".to_string(),
        };

        let mut request = Request::new(req);
        let auth_value = MetadataValue::try_from(format!("Bearer {}", token))?;
        request.metadata_mut().insert("authorization", auth_value);

        let _ = client.get_regime_state(request).await;
    }

    // Measure 1000 warm requests
    let mut latencies = Vec::new();
    println!("  Measuring 1000 warm requests...");

    for _ in 0..1000 {
        let req = GetRegimeStateRequest {
            symbol: "ES.FUT".to_string(),
        };

        let mut request = Request::new(req);
        let auth_value = MetadataValue::try_from(format!("Bearer {}", token))?;
        request.metadata_mut().insert("authorization", auth_value);

        let start = Instant::now();
        let _ = client.get_regime_state(request).await;
        latencies.push(start.elapsed());
    }

    latencies.sort();
    let p50 = latencies[latencies.len() / 2];
    let p95 = latencies[(latencies.len() as f64 * 0.95) as usize];
    let p99 = latencies[(latencies.len() as f64 * 0.99) as usize];
    let min = latencies[0];
    let max = latencies[latencies.len() - 1];

    println!("\n  📊 Proxy Latency Statistics:");
    println!("    Min:    {:>8} μs", min.as_micros());
    println!("    P50:    {:>8} μs", p50.as_micros());
    println!("    P95:    {:>8} μs", p95.as_micros());
    println!("    P99:    {:>8} μs", p99.as_micros());
    println!("    Max:    {:>8} μs", max.as_micros());
    println!("    Target: < 1,000 μs (1ms)");

    if p99.as_micros() < 1000 {
        println!("  ✅ PASS: P99 {} μs < 1ms target", p99.as_micros());
        Ok(())
    } else {
        println!("  ⚠️  WARNING: P99 {} μs >= 1ms target", p99.as_micros());
        Ok(())
    }
}

/// Test 8: Concurrent Requests (10 parallel)
#[tokio::test]
#[ignore = "Run manually with services running"]
async fn test_concurrent_requests() -> Result<()> {
    println!("\n=== Test 8: Concurrent Requests (10 parallel) ===");

    // Create authenticated request
    let (token, _jti) = common::generate_test_token(
        "concurrent-test-user",
        vec!["trader".to_string()],
        vec![
            "trading.regime_state".to_string(),
            "trading.regime_transitions".to_string(),
        ],
        3600,
    )?;

    let start = Instant::now();

    let mut handles = vec![];
    for i in 0..10 {
        let token_clone = token.clone();
        let handle = tokio::spawn(async move {
            let mut client = TradingServiceClient::connect("http://localhost:50051")
                .await
                .unwrap();

            // Alternate between GetRegimeState and GetRegimeTransitions
            let result = if i % 2 == 0 {
                let req = GetRegimeStateRequest {
                    symbol: "ES.FUT".to_string(),
                };

                let mut request = Request::new(req);
                let auth_value =
                    MetadataValue::try_from(format!("Bearer {}", token_clone)).unwrap();
                request.metadata_mut().insert("authorization", auth_value);

                client.get_regime_state(request).await.map(|_| ())
            } else {
                let req = GetRegimeTransitionsRequest {
                    symbol: "ES.FUT".to_string(),
                    limit: 10,
                };

                let mut request = Request::new(req);
                let auth_value =
                    MetadataValue::try_from(format!("Bearer {}", token_clone)).unwrap();
                request.metadata_mut().insert("authorization", auth_value);

                client.get_regime_transitions(request).await.map(|_| ())
            };
            result
        });
        handles.push(handle);
    }

    let mut success_count = 0;
    let mut error_count = 0;

    for handle in handles {
        match handle.await {
            Ok(Ok(_)) => success_count += 1,
            Ok(Err(e)) => {
                error_count += 1;
                println!("  ⚠️  Request failed: {:?}", e);
            },
            Err(e) => {
                error_count += 1;
                println!("  ⚠️  Task panicked: {:?}", e);
            },
        }
    }

    let elapsed = start.elapsed();
    let avg_per_request = elapsed / 10;

    println!("  Total time: {:?}", elapsed);
    println!("  Avg/request: {:?}", avg_per_request);
    println!("  Successful: {}/10", success_count);
    println!("  Failed: {}/10", error_count);

    if success_count == 10 {
        println!("  ✅ PASS: All concurrent requests succeeded");
        Ok(())
    } else {
        println!("  ⚠️  WARNING: {}/10 requests failed", error_count);
        Ok(())
    }
}

/// Test 9: Metadata Forwarding
#[tokio::test]
#[ignore = "Run manually with services running"]
async fn test_metadata_forwarding() -> Result<()> {
    println!("\n=== Test 9: Metadata Forwarding ===");

    // Create authenticated request with custom metadata
    let (token, _jti) = common::generate_test_token(
        "metadata-test-user",
        vec!["trader".to_string()],
        vec!["trading.regime_state".to_string()],
        3600,
    )?;

    let mut client = TradingServiceClient::connect("http://localhost:50051").await?;

    let req = GetRegimeStateRequest {
        symbol: "ES.FUT".to_string(),
    };

    let mut request = Request::new(req);
    let auth_value = MetadataValue::try_from(format!("Bearer {}", token))?;
    request.metadata_mut().insert("authorization", auth_value);

    // Add custom metadata
    let user_id_value = MetadataValue::try_from("metadata-test-user")?;
    request.metadata_mut().insert("x-user-id", user_id_value);

    let response = client.get_regime_state(request).await;

    match response {
        Ok(resp) => {
            println!("  ✓ Request succeeded with custom metadata");
            let regime = resp.into_inner();
            println!("    Symbol: {}", regime.symbol);
            println!("    Regime: {}", regime.current_regime);
            println!("  ✅ PASS: Metadata forwarding works");
            Ok(())
        },
        Err(e) => {
            println!("  ❌ Request failed: {:?}", e);
            Err(anyhow::anyhow!("Metadata forwarding test failed: {}", e))
        },
    }
}

/// Test 10: Circuit Breaker Behavior (Simulated Backend Failure)
#[tokio::test]
#[ignore = "Run manually with services running - requires stopping Trading Service"]
async fn test_circuit_breaker_backend_failure() -> Result<()> {
    println!("\n=== Test 10: Circuit Breaker (Backend Failure) ===");
    println!("  NOTE: This test requires stopping the Trading Service to simulate failure");

    // Create authenticated request
    let (token, _jti) = common::generate_test_token(
        "circuit-breaker-test-user",
        vec!["trader".to_string()],
        vec!["trading.regime_state".to_string()],
        3600,
    )?;

    let mut client = TradingServiceClient::connect("http://localhost:50051").await?;

    let req = GetRegimeStateRequest {
        symbol: "ES.FUT".to_string(),
    };

    let mut request = Request::new(req);
    let auth_value = MetadataValue::try_from(format!("Bearer {}", token))?;
    request.metadata_mut().insert("authorization", auth_value);

    let response = client.get_regime_state(request).await;

    match response {
        Ok(_) => {
            println!("  ✓ Backend is available (test requires backend to be down)");
            println!("  ⚠️  SKIPPED: Stop Trading Service to test circuit breaker");
            Ok(())
        },
        Err(e) => {
            println!("  ✓ Request failed (expected when backend is down)");
            println!("    Status code: {:?}", e.code());
            println!("    Message: {}", e.message());

            if e.code() == tonic::Code::Unavailable {
                println!("  ✅ PASS: Circuit breaker opened (Unavailable)");
                Ok(())
            } else {
                println!("  ⚠️  WARNING: Expected Unavailable, got {:?}", e.code());
                Ok(())
            }
        },
    }
}