// Cloud-only: the OWNER's view of a workspace — `/api/admin/users*`. The
// product plane answers "what can I, this member, reach"; this plane answers
// "who uses my workspace, and what have they connected", reading across every
// member of the tenant instead of binding to one.
//
// Two members are built through the REAL flows (login → create-organization →
// invite → accept-invitation), each connects their own credential, and the
// admin then reads the joined view — the exact shape a customer dashboard's
// icon grid consumes. The guarantees pinned here:
//
//   1. the joined view reports BOTH members and each one's own connections,
//      even though no single product-view caller can see another member's;
//   2. it never carries credential material;
//   3. a plain member is refused (403) and an anonymous caller too (401);
//   4. another tenant's admin sees none of it.
//
// EMULATOR GAP: the WorkOS emulator hardcodes `owner.type: "user"` in its api-key
// serializer and exposes no organization-key mint route, so an org-scoped API
// key — the machine credential for this plane — cannot exist end-to-end here.
// This scenario therefore drives the ADMIN SESSION path, which is the other
// credential the plane accepts. The org-key half is covered at unit level in
// `apps/cloud/src/auth/org-api-key-mint.node.test.ts` (against the real WorkOS
// response shape) and `org-api-key-auth.node.test.ts` (PlatformAuth resolution).
import { randomBytes } from "node:crypto";

import { expect } from "@effect/vitest";
import { Effect } from "effect";
import type { HttpApiClient } from "effect/unstable/httpapi";
import { AdminUsersHttpApi } from "@executor-js/api";
import { composePluginApi } from "@executor-js/api/server";
import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
import { AuthTemplateSlug, ConnectionName, IntegrationSlug } from "@executor-js/sdk/shared";

import { scenario } from "../src/scenario";
import { Api, Target } from "../src/services";
import type { Identity, Target as TargetShape } from "../src/target";

const api = composePluginApi([openApiHttpPlugin()] as const);
type Client = HttpApiClient.ForApi<typeof api>;

const TEMPLATE_API_KEY = AuthTemplateSlug.make("apiKey");

/** Minimal OpenAPI spec with a single GET /ping — never contacted here. */
const pingSpec = JSON.stringify({
  openapi: "3.0.3",
  info: { title: "Ping API", version: "1.0.0" },
  paths: {
    "/ping": {
      get: { operationId: "ping", summary: "Ping", responses: { "200": { description: "pong" } } },
    },
  },
});

/** Registers a fresh apiKey-authenticated integration for connections to bind to. */
const registerIntegration = (client: Client) =>
  Effect.gen(function* () {
    const slug = IntegrationSlug.make(`admin-scn-${randomBytes(4).toString("hex")}`);
    yield* client.openapi.addSpec({
      payload: {
        spec: { kind: "blob", value: pingSpec },
        slug,
        baseUrl: "http://127.0.0.1:59999", // never contacted during registration
        authenticationTemplate: [
          {
            slug: "apiKey",
            type: "apiKey",
            headers: { authorization: ["Bearer ", { type: "variable", name: "token" }] },
          },
        ],
      },
    });
    return slug;
  });

const freshConnectionName = () => ConnectionName.make(`conn${randomBytes(4).toString("hex")}`);

const cookieOf = (identity: Identity): string => identity.headers?.["cookie"] ?? "";

const postJson = (target: TargetShape, path: string, identity: Identity, body: unknown) =>
  Effect.promise(async () => {
    const response = await fetch(new URL(path, target.baseUrl), {
      method: "POST",
      headers: {
        "content-type": "application/json",
        origin: new URL(target.baseUrl).origin,
        cookie: cookieOf(identity),
      },
      body: JSON.stringify(body),
    });
    if (!response.ok) {
      throw new Error(`${path} failed (${response.status}): ${await response.text()}`);
    }
    return response;
  });

/** The identity re-bound to the refreshed session cookie a response set. */
const withRefreshedSession = (identity: Identity, response: Response): Identity => {
  const refreshed = (response.headers.getSetCookie?.() ?? [])
    .find((header) => header.startsWith("wos-session="))
    ?.split(";")[0];
  if (!refreshed) throw new Error("response did not refresh the session cookie");
  return { ...identity, headers: { cookie: refreshed } };
};

/** Invite `member` into `admin`'s org and accept — the real invite flow. */
const joinOrg = (target: TargetShape, admin: Identity, member: Identity) =>
  Effect.gen(function* () {
    const inviteResponse = yield* postJson(target, "/api/account/members/invite", admin, {
      email: member.credentials?.email,
    });
    const invitation = (yield* Effect.promise(() => inviteResponse.json())) as { id: string };
    const acceptResponse = yield* postJson(target, "/api/auth/accept-invitation", member, {
      invitationId: invitation.id,
    });
    return withRefreshedSession(member, acceptResponse);
  });

/** The caller's own account id — the `externalId` the admin plane reports. */
const accountIdOf = (target: TargetShape, identity: Identity) =>
  Effect.promise(async () => {
    const response = await fetch(new URL("/api/account/me", target.baseUrl), {
      headers: { cookie: cookieOf(identity) },
    });
    if (!response.ok) throw new Error(`/api/account/me failed (${response.status})`);
    const body = (await response.json()) as { user: { id: string } };
    return body.user.id;
  });

scenario(
  "Admin · the owner sees every member of the workspace and what each has connected",
  {},
  Effect.gen(function* () {
    const target = yield* Target;
    const { client: apiClient } = yield* Api;

    const admin = yield* target.newIdentity();
    const invitee = yield* target.newIdentity({ org: false });
    const member = yield* joinOrg(target, admin, invitee);

    const adminClient = yield* apiClient(api, admin);
    const memberClient = yield* apiClient(api, member);
    const adminId = yield* accountIdOf(target, admin);
    const memberId = yield* accountIdOf(target, member);

    const integration = yield* registerIntegration(adminClient);
    const adminConnection = freshConnectionName();
    const memberConnection = freshConnectionName();

    yield* Effect.ensuring(
      Effect.gen(function* () {
        // Each member stores their OWN credential. Neither can see the other's
        // through the product plane — that is the whole point of the admin one.
        yield* adminClient.connections.create({
          payload: {
            owner: "user",
            name: adminConnection,
            integration,
            template: TEMPLATE_API_KEY,
            value: "admin-personal-token",
          },
        });
        yield* memberClient.connections.create({
          payload: {
            owner: "user",
            name: memberConnection,
            integration,
            template: TEMPLATE_API_KEY,
            value: "member-personal-token",
          },
        });

        const client = yield* apiClient(AdminUsersHttpApi, admin);

        // (1) The joined view: both members, each with their own connection.
        const joined = yield* client.adminUsers.listUsersWithConnections({ query: {} });
        const byId = new Map(joined.users.map((user) => [user.externalId, user]));

        expect([...byId.keys()].sort(), "both members of the workspace are reported").toEqual(
          [adminId, memberId].sort(),
        );
        expect(
          byId.get(adminId)?.connections.map((connection) => connection.name),
          "the admin's own connection is attributed to them",
        ).toContain(adminConnection);
        expect(
          byId.get(memberId)?.connections.map((connection) => connection.name),
          "the member's connection is visible to the owner, though not to the admin's product view",
        ).toContain(memberConnection);

        // The flat list agrees with the joined one.
        const flat = yield* client.adminUsers.listUsers({ query: {} });
        expect(
          flat.users.map((user) => user.externalId).sort(),
          "the flat list reports the same members",
        ).toEqual([adminId, memberId].sort());

        // Per-user connections resolve the same rows.
        const memberConnections = yield* client.adminUsers.listUserConnections({
          params: { externalId: memberId },
        });
        expect(
          memberConnections.connections.map((connection) => connection.name),
          "the member's connections are readable by external id",
        ).toContain(memberConnection);

        // (2) No credential material anywhere in the joined view.
        expect(
          JSON.stringify(joined),
          "the admin view never carries a stored credential",
        ).not.toContain("member-personal-token");
        expect(JSON.stringify(joined)).not.toContain("admin-personal-token");

        // (3) A plain member is refused: this plane reports on everyone.
        const asMember = yield* Effect.promise(() =>
          fetch(new URL("/api/admin/users", target.baseUrl), {
            headers: { cookie: cookieOf(member) },
          }),
        );
        expect(asMember.status, "a non-admin member cannot read the workspace view").toBe(403);

        // And an anonymous caller has no credential at all.
        const anonymous = yield* Effect.promise(() =>
          fetch(new URL("/api/admin/users", target.baseUrl)),
        );
        expect(anonymous.status, "no session → unauthorized").toBe(401);
      }),
      Effect.all(
        [
          adminClient.connections
            .remove({ params: { owner: "user", integration, name: adminConnection } })
            .pipe(Effect.ignore),
          memberClient.connections
            .remove({ params: { owner: "user", integration, name: memberConnection } })
            .pipe(Effect.ignore),
          adminClient.openapi.removeSpec({ params: { slug: integration } }).pipe(Effect.ignore),
        ],
        { discard: true },
      ),
    );
  }),
);

scenario(
  "Admin · one workspace's owner sees nothing of another workspace",
  {},
  Effect.gen(function* () {
    const target = yield* Target;
    const { client: apiClient } = yield* Api;

    const mine = yield* target.newIdentity();
    const theirs = yield* target.newIdentity();
    const myId = yield* accountIdOf(target, mine);
    const theirId = yield* accountIdOf(target, theirs);

    const myClient = yield* apiClient(api, mine);
    // A user earns their row in the workspace the first time they touch the
    // EXECUTOR plane (the account plane doesn't bind an executor), so the other
    // owner makes one product read — otherwise their own workspace is empty and
    // the isolation assertion below would pass vacuously.
    yield* (yield* apiClient(api, theirs)).connections.list({ query: {} });
    const integration = yield* registerIntegration(myClient);
    const connection = freshConnectionName();

    yield* Effect.ensuring(
      Effect.gen(function* () {
        yield* myClient.connections.create({
          payload: {
            owner: "user",
            name: connection,
            integration,
            template: TEMPLATE_API_KEY,
            value: "my-private-token",
          },
        });

        const theirAdmin = yield* apiClient(AdminUsersHttpApi, theirs);
        const theirView = yield* theirAdmin.adminUsers.listUsersWithConnections({ query: {} });

        expect(
          theirView.users.map((user) => user.externalId),
          "another workspace's owner never sees my members",
        ).not.toContain(myId);
        expect(
          theirView.users.map((user) => user.externalId),
          "they do see their own",
        ).toContain(theirId);
        expect(
          JSON.stringify(theirView),
          "and none of my connections leak across the tenant boundary",
        ).not.toContain(connection);

        // Naming my account id directly returns nothing rather than my rows.
        const probe = yield* theirAdmin.adminUsers.listUserConnections({
          params: { externalId: myId },
        });
        expect(probe.connections, "a cross-tenant id resolves to nothing").toEqual([]);
      }),
      Effect.all(
        [
          myClient.connections
            .remove({ params: { owner: "user", integration, name: connection } })
            .pipe(Effect.ignore),
          myClient.openapi.removeSpec({ params: { slug: integration } }).pipe(Effect.ignore),
        ],
        { discard: true },
      ),
    );
  }),
);