use std::future::Future;
use std::time::Duration;

use futures::executor::block_on;
use mockito::{Matcher, Mock};
use vec1::vec1;
use warp_graphql::ai::AgentHarness;
use warp_graphql::managed_secrets::ManagedSecretType;
use warp_managed_secrets::client::{IdentityTokenOptions, ManagedSecretsClient as _, SecretOwner};
use warp_server_client::base_client::TEAM_UID_HEADER;

use super::super::ServerApi;
use crate::server::ids::ServerId;
use crate::server::team_scope::RequestTeamScope;
use crate::workspaces::user_workspaces::TeamContextForOperation;

fn request_scope_for_team(team_uid: ServerId) -> RequestTeamScope {
    RequestTeamScope::from_scope(&TeamContextForOperation::new_for_test(team_uid))
}

fn server_api() -> ServerApi {
    let server_api = ServerApi::new_for_test();
    server_api
        .base_client
        .set_ambient_workload_token_for_test("test-workload-token".to_string());
    server_api
}

fn mock_graphql_request(operation: &str, team_uid: Option<&str>) -> Mock {
    let mut server = warp_core::channel::ChannelState::mock_server();
    let request = server
        .mock("POST", "/graphql/v2")
        .match_query(Matcher::UrlEncoded("op".to_string(), operation.to_string()))
        .with_status(200)
        .with_body(r#"{"data":null}"#);
    match team_uid {
        Some(team_uid) => request.match_header(TEAM_UID_HEADER, team_uid).create(),
        None => request
            .match_header(TEAM_UID_HEADER, Matcher::Missing)
            .create(),
    }
}

fn assert_request_sent<T>(request: Mock, future: impl Future<Output = anyhow::Result<T>>) {
    assert!(block_on(future).is_err());
    request.assert();
}

#[test]
fn scoped_managed_secret_requests_send_selected_team_header() {
    let server_api = server_api();
    let team_uid = ServerId::from(17);
    let team_uid_header = team_uid.to_string();
    let request_scope = request_scope_for_team(team_uid);

    assert_request_sent(
        mock_graphql_request("GetManagedSecretConfig", Some(&team_uid_header)),
        server_api.get_managed_secret_configs(&request_scope),
    );
    assert_request_sent(
        mock_graphql_request("CreateManagedSecret", Some(&team_uid_header)),
        server_api.create_managed_secret(
            &request_scope,
            SecretOwner::CurrentUser,
            "API_KEY".to_string(),
            ManagedSecretType::RawValue,
            "encrypted".to_string(),
            None,
        ),
    );
    assert_request_sent(
        mock_graphql_request("DeleteManagedSecret", Some(&team_uid_header)),
        server_api.delete_managed_secret(
            &request_scope,
            SecretOwner::CurrentUser,
            "API_KEY".to_string(),
        ),
    );
    assert_request_sent(
        mock_graphql_request("UpdateManagedSecret", Some(&team_uid_header)),
        server_api.update_managed_secret(
            &request_scope,
            SecretOwner::CurrentUser,
            "API_KEY".to_string(),
            Some("updated".to_string()),
            None,
        ),
    );
    assert_request_sent(
        mock_graphql_request("ListManagedSecrets", Some(&team_uid_header)),
        server_api.list_secrets(Some(&request_scope)),
    );
    assert_request_sent(
        mock_graphql_request("ListHarnessAuthSecrets", Some(&team_uid_header)),
        server_api.list_harness_auth_secrets(&request_scope, AgentHarness::ClaudeCode),
    );
}

#[test]
fn unscoped_managed_secret_list_omits_team_header() {
    let server_api = server_api();

    assert_request_sent(
        mock_graphql_request("ListManagedSecrets", None),
        server_api.list_secrets(None),
    );
}

#[test]
fn resource_authoritative_managed_secret_requests_omit_team_header() {
    let server_api = server_api();

    assert_request_sent(
        mock_graphql_request("TaskSecrets", None),
        server_api.get_task_secrets("task-id".to_string(), "workload-token".to_string()),
    );
    assert_request_sent(
        mock_graphql_request("IssueTaskIdentityToken", None),
        server_api.issue_task_identity_token(IdentityTokenOptions {
            audience: "https://example.com".to_string(),
            requested_duration: Duration::from_secs(300),
            subject_template: vec1!["scoped_principal".to_string()],
        }),
    );
}