// Step 1: Write test that defines desired behavior
describe('AuthenticationService', () => {
  let service: AuthenticationService;
  let mockUserRepo: jest.Mocked<UserRepository>;
  let mockCache: jest.Mocked<CacheService>;

  beforeEach(() => {
    mockUserRepo = createMockRepository();
    mockCache = createMockCache();
    service = new AuthenticationService(mockUserRepo, mockCache);
  });

  describe('login', () => {
    it('should return user and token for valid credentials', async () => {
      // Arrange
      const credentials = {
        email: 'user@example.com',
        password: 'SecurePass123!'
      };
      const mockUser = {
        id: 'user-123',
        email: credentials.email,
        passwordHash: await hash(credentials.password)
      };
      
      mockUserRepo.findByEmail.mockResolvedValue(mockUser);

      // Act
      const result = await service.login(credentials);

      // Assert
      expect(result).toHaveProperty('user');
      expect(result).toHaveProperty('token');
      expect(result.user.id).toBe(mockUser.id);
      expect(mockCache.set).toHaveBeenCalledWith(
        `session:${result.token}`,
        expect.any(Object),
        expect.any(Number)
      );
    });

    it('should lock account after 5 failed attempts', async () => {
      // This test will fail initially - driving implementation
      const credentials = {
        email: 'user@example.com',
        password: 'WrongPassword'
      };

      // Simulate 5 failed attempts
      for (let i = 0; i < 5; i++) {
        await expect(service.login(credentials))
          .rejects.toThrow('Invalid credentials');
      }

      // 6th attempt should indicate locked account
      await expect(service.login(credentials))
        .rejects.toThrow('Account locked due to multiple failed attempts');
    });
  });
});

// Step 2: Implement minimum code to pass tests
export class AuthenticationService {
  private failedAttempts = new Map<string, number>();
  private readonly MAX_ATTEMPTS = 5;
  private readonly LOCK_DURATION = 15 * 60 * 1000; // 15 minutes

  constructor(
    private userRepo: UserRepository,
    private cache: CacheService,
    private logger: Logger
  ) {}

  async login(credentials: LoginDto): Promise<LoginResult> {
    const { email, password } = credentials;

    // Check if account is locked
    const attempts = this.failedAttempts.get(email) || 0;
    if (attempts >= this.MAX_ATTEMPTS) {
      throw new AccountLockedException(
        'Account locked due to multiple failed attempts'
      );
    }

    // Find user
    const user = await this.userRepo.findByEmail(email);
    if (!user) {
      this.recordFailedAttempt(email);
      throw new UnauthorizedException('Invalid credentials');
    }

    // Verify password
    const isValidPassword = await this.verifyPassword(
      password,
      user.passwordHash
    );
    if (!isValidPassword) {
      this.recordFailedAttempt(email);
      throw new UnauthorizedException('Invalid credentials');
    }

    // Clear failed attempts on successful login
    this.failedAttempts.delete(email);

    // Generate token and create session
    const token = this.generateToken(user);
    const session = {
      userId: user.id,
      email: user.email,
      createdAt: new Date()
    };

    await this.cache.set(
      `session:${token}`,
      session,
      this.SESSION_DURATION
    );

    return {
      user: this.sanitizeUser(user),
      token
    };
  }

  private recordFailedAttempt(email: string): void {
    const current = this.failedAttempts.get(email) || 0;
    this.failedAttempts.set(email, current + 1);
    
    this.logger.warn('Failed login attempt', {
      email,
      attempts: current + 1
    });
  }
}

// Step 3: Refactor while keeping tests green
export class AuthenticationService {
  constructor(
    private userRepo: UserRepository,
    private cache: CacheService,
    private logger: Logger,
    private config: AuthConfig,
    private eventBus: EventBus
  ) {}

  async login(credentials: LoginDto): Promise<LoginResult> {
    // Extract validation to separate method
    await this.validateLoginAttempt(credentials.email);

    try {
      const user = await this.authenticateUser(credentials);
      const session = await this.createSession(user);
      
      // Emit event for other services
      await this.eventBus.emit('user.logged_in', {
        userId: user.id,
        timestamp: new Date()
      });

      return {
        user: this.sanitizeUser(user),
        token: session.token,
        expiresAt: session.expiresAt
      };
    } catch (error) {
      await this.handleLoginFailure(credentials.email, error);
      throw error;
    }
  }

  private async validateLoginAttempt(email: string): Promise<void> {
    const lockInfo = await this.cache.get(`lock:${email}`);
    if (lockInfo) {
      const remainingTime = this.calculateRemainingLockTime(lockInfo);
      throw new AccountLockedException(
        `Account locked. Try again in ${remainingTime} minutes`
      );
    }
  }

  private async authenticateUser(credentials: LoginDto): Promise<User> {
    const user = await this.userRepo.findByEmail(credentials.email);
    if (!user || !await this.verifyPassword(credentials.password, user.passwordHash)) {
      throw new UnauthorizedException('Invalid credentials');
    }
    return user;
  }

  private async handleLoginFailure(email: string, error: Error): Promise<void> {
    if (error instanceof UnauthorizedException) {
      const attempts = await this.incrementFailedAttempts(email);
      
      if (attempts >= this.config.maxLoginAttempts) {
        await this.lockAccount(email);
      }
    }
  }
}

// Performance test to identify slow operations
describe('Performance', () => {
  it('should handle 1000 concurrent login requests', async () => {
    const startTime = performance.now();
    
    const promises = Array(1000).fill(null).map((_, i) => 
      service.login({
        email: `user${i}@example.com`,
        password: 'password'
      }).catch(() => {}) // Ignore errors for perf test
    );

    await Promise.all(promises);
    
    const duration = performance.now() - startTime;
    expect(duration).toBeLessThan(5000); // Should complete in 5 seconds
  });
});

// Before: N database queries
async function getUserPermissions(userId: string): Promise<string[]> {
  const user = await db.query('SELECT * FROM users WHERE id = ?', [userId]);
  const roles = await db.query('SELECT * FROM user_roles WHERE user_id = ?', [userId]);
  const permissions = [];
  
  for (const role of roles) {
    const perms = await db.query('SELECT * FROM role_permissions WHERE role_id = ?', [role.id]);
    permissions.push(...perms);
  }
  
  return permissions;
}

// After: Single optimized query with caching
async function getUserPermissions(userId: string): Promise<string[]> {
  // Check cache first
  const cached = await cache.get(`permissions:${userId}`);
  if (cached) return cached;

  // Single query with joins
  const permissions = await db.query(`
    SELECT DISTINCT p.name
    FROM users u
    JOIN user_roles ur ON u.id = ur.user_id
    JOIN role_permissions rp ON ur.role_id = rp.role_id
    JOIN permissions p ON rp.permission_id = p.id
    WHERE u.id = ?
  `, [userId]);

  // Cache for 5 minutes
  await cache.set(`permissions:${userId}`, permissions, 300);
  
  return permissions;
}

// Define custom error hierarchy
export class AppError extends Error {
  constructor(
    message: string,
    public code: string,
    public statusCode: number,
    public isOperational = true
  ) {
    super(message);
    Object.setPrototypeOf(this, new.target.prototype);
    Error.captureStackTrace(this);
  }
}

export class ValidationError extends AppError {
  constructor(message: string, public fields?: Record<string, string>) {
    super(message, 'VALIDATION_ERROR', 400);
  }
}

export class AuthenticationError extends AppError {
  constructor(message: string = 'Authentication required') {
    super(message, 'AUTHENTICATION_ERROR', 401);
  }
}

// Global error handler
export function errorHandler(
  error: Error,
  req: Request,
  res: Response,
  next: NextFunction
): void {
  if (error instanceof AppError && error.isOperational) {
    res.status(error.statusCode).json({
      error: {
        code: error.code,
        message: error.message,
        ...(error instanceof ValidationError && { fields: error.fields })
      }
    });
  } else {
    // Unexpected errors
    logger.error('Unhandled error', { error, request: req });
    res.status(500).json({
      error: {
        code: 'INTERNAL_ERROR',
        message: 'An unexpected error occurred'
      }
    });
  }
}

// Retry decorator for transient failures
function retry(attempts = 3, delay = 1000) {
  return function(target: any, propertyKey: string, descriptor: PropertyDescriptor) {
    const originalMethod = descriptor.value;

    descriptor.value = async function(...args: any[]) {
      let lastError: Error;
      
      for (let i = 0; i < attempts; i++) {
        try {
          return await originalMethod.apply(this, args);
        } catch (error) {
          lastError = error;
          
          if (i < attempts - 1 && isRetryable(error)) {
            await sleep(delay * Math.pow(2, i)); // Exponential backoff
          } else {
            throw error;
          }
        }
      }
      
      throw lastError;
    };
  };
}

// Circuit breaker for external services
export class CircuitBreaker {
  private failures = 0;
  private lastFailureTime?: Date;
  private state: 'CLOSED' | 'OPEN' | 'HALF_OPEN' = 'CLOSED';

  constructor(
    private threshold = 5,
    private timeout = 60000 // 1 minute
  ) {}

  async execute<T>(operation: () => Promise<T>): Promise<T> {
    if (this.state === 'OPEN') {
      if (this.shouldAttemptReset()) {
        this.state = 'HALF_OPEN';
      } else {
        throw new Error('Circuit breaker is OPEN');
      }
    }

    try {
      const result = await operation();
      this.onSuccess();
      return result;
    } catch (error) {
      this.onFailure();
      throw error;
    }
  }

  private onSuccess(): void {
    this.failures = 0;
    this.state = 'CLOSED';
  }

  private onFailure(): void {
    this.failures++;
    this.lastFailureTime = new Date();
    
    if (this.failures >= this.threshold) {
      this.state = 'OPEN';
    }
  }

  private shouldAttemptReset(): boolean {
    return this.lastFailureTime 
      && (Date.now() - this.lastFailureTime.getTime()) > this.timeout;
  }
}

# Jest configuration for coverage
module.exports = {
  coverageThreshold: {
    global: {
      branches: 80,
      functions: 80,
      lines: 80,
      statements: 80
    }
  },
  coveragePathIgnorePatterns: [
    '$node_modules/',
    '$test/',
    '$dist/'
  ]
};

// Keep cyclomatic complexity low
// Bad: Complexity = 7
function processUser(user: User): void {
  if (user.age > 18) {
    if (user.country === 'US') {
      if (user.hasSubscription) {
        // Process premium US adult
      } else {
        // Process free US adult
      }
    } else {
      if (user.hasSubscription) {
        // Process premium international adult
      } else {
        // Process free international adult
      }
    }
  } else {
    // Process minor
  }
}

// Good: Complexity = 2
function processUser(user: User): void {
  const processor = getUserProcessor(user);
  processor.process(user);
}

function getUserProcessor(user: User): UserProcessor {
  const type = getUserType(user);
  return ProcessorFactory.create(type);
}