import { describe, expect, it } from "@effect/vitest";
import { Effect } from "effect";

import { collectTables, createExecutor, type Executor } from "./executor";
import { createSqliteTestFumaDb, type SqliteTestFumaDb } from "./sqlite-test-db";
import { Subject, Tenant } from "./ids";
import { resetSubjectTouchCache, touchSubject } from "./subject-registry";

// The platform view: `executor.admin`, an OPT-IN read-only surface that reads
// across every subject in the tenant. Written against the real SQLite bring-up
// so the tenant-reach policy, the bigint `last_seen_at` round-trip, and the
// field allowlist are all live.

const TENANT = "t1";
const OTHER_TENANT = "t2";
const SUBJECT_A = "user_a";
const SUBJECT_B = "user_b";

/** Every column on `connection` that could resolve, or help resolve, a
 *  credential. NONE of these may appear on an admin shape — enumerated so a
 *  future column addition has to be argued with this list. */
const FORBIDDEN_CONNECTION_FIELDS = [
  "item_ids",
  "itemIds",
  "refresh_item_id",
  "refreshItemId",
  "provider",
  "provider_state",
  "providerState",
  "oauth_token_url",
  "oauthTokenUrl",
  "template",
  "client_secret",
  "clientSecret",
  "secret",
  "token",
] as const;

const withDb = <A, E>(body: (db: SqliteTestFumaDb) => Effect.Effect<A, E>): Effect.Effect<A, E> =>
  Effect.acquireUseRelease(
    Effect.promise(() => createSqliteTestFumaDb({ tables: collectTables() })),
    body,
    (db) => Effect.promise(() => db.close()),
  );

const insertConnection = (
  db: SqliteTestFumaDb,
  row: {
    readonly rowId: string;
    readonly tenant: string;
    readonly owner: string;
    readonly subject: string;
    readonly integration: string;
    readonly name: string;
    readonly oauthScope?: string | null;
  },
): Effect.Effect<void> =>
  Effect.promise(async () => {
    await db.client.execute({
      sql: `INSERT INTO connection (
          row_id, tenant, owner, subject, integration, name, template, provider,
          item_ids, refresh_item_id, oauth_scope, last_health, created_at, updated_at
        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
      args: [
        row.rowId,
        row.tenant,
        row.owner,
        row.subject,
        row.integration,
        row.name,
        "oauth2",
        "memory",
        // Deliberately secret-bearing: the assertions below prove these never
        // leave the storage layer.
        JSON.stringify({ token: `SECRET-item-${row.rowId}` }),
        `SECRET-refresh-${row.rowId}`,
        row.oauthScope ?? null,
        JSON.stringify({ status: "healthy", checkedAt: 1_700_000_000_000 }),
        Date.now(),
        Date.now(),
      ],
    });
  });

/** Seed two users and an org connection under `t1`, plus an untouchable other
 *  tenant. Subjects go in through `touchSubject` (the only legitimate writer);
 *  connections go in raw, because no single bound executor could have written
 *  another subject's rows. */
const seed = (db: SqliteTestFumaDb): Effect.Effect<void> =>
  Effect.gen(function* () {
    // `touchSubject` keeps a process-local memory of principals it already
    // filed, so a second seed against a FRESH database would be skipped as a
    // repeat sighting and leave the table empty. Each seed is a new world.
    resetSubjectTouchCache();

    yield* touchSubject(db.db, { tenant: TENANT, externalId: SUBJECT_A });
    yield* touchSubject(db.db, { tenant: TENANT, externalId: SUBJECT_B });
    yield* touchSubject(db.db, { tenant: OTHER_TENANT, externalId: "user_elsewhere" });

    yield* insertConnection(db, {
      rowId: "c-a1",
      tenant: TENANT,
      owner: "user",
      subject: SUBJECT_A,
      integration: "github",
      name: "personal",
      oauthScope: "repo read:user",
    });
    yield* insertConnection(db, {
      rowId: "c-a2",
      tenant: TENANT,
      owner: "user",
      subject: SUBJECT_A,
      integration: "linear",
      name: "work",
    });
    yield* insertConnection(db, {
      rowId: "c-b1",
      tenant: TENANT,
      owner: "user",
      subject: SUBJECT_B,
      integration: "github",
      name: "b-personal",
      oauthScope: "repo",
    });
    yield* insertConnection(db, {
      rowId: "c-org",
      tenant: TENANT,
      owner: "org",
      subject: "",
      integration: "stripe",
      name: "shared",
    });
    yield* insertConnection(db, {
      rowId: "c-other",
      tenant: OTHER_TENANT,
      owner: "user",
      subject: SUBJECT_A,
      integration: "github",
      name: "other-tenant",
    });
  });

const makePlatformExecutor = (
  db: SqliteTestFumaDb,
  options?: { readonly platformView?: boolean; readonly subject?: string | null },
): Effect.Effect<Executor, never> =>
  createExecutor({
    tenant: Tenant.make(TENANT),
    ...(options?.subject === null ? {} : { subject: Subject.make(options?.subject ?? SUBJECT_A) }),
    db: db.db,
    onElicitation: "accept-all",
    ...(options?.platformView === false ? {} : { platformView: true }),
  }).pipe(Effect.orDie);

const requireAdmin = (executor: Executor) => {
  const admin = executor.admin;
  if (!admin) return Effect.die("expected the platform view to be enabled");
  return Effect.succeed(admin);
};

describe("platform view — admin.listSubjects", () => {
  it.effect("lists every subject in the tenant and no other tenant's", () =>
    withDb((db) =>
      Effect.gen(function* () {
        yield* seed(db);
        const executor = yield* makePlatformExecutor(db);
        const admin = yield* requireAdmin(executor);

        const subjects = yield* admin.listSubjects();

        // `user_elsewhere` lives under t2 — invisible at any reach.
        expect(subjects.map((entry) => entry.externalId).sort()).toEqual([SUBJECT_A, SUBJECT_B]);
      }),
    ),
  );

  it.effect("returns created_at and the bigint last_seen_at through the ORM", () =>
    withDb((db) =>
      Effect.gen(function* () {
        const before = Date.now();
        yield* seed(db);
        const executor = yield* makePlatformExecutor(db);
        const admin = yield* requireAdmin(executor);

        const subjects = yield* admin.listSubjects();
        const entry = subjects.find((row) => row.externalId === SUBJECT_A);

        expect(entry?.createdAt).toBeInstanceOf(Date);
        // A raw SQL read would hand back an unusable blob here.
        expect(typeof entry?.lastSeenAt).toBe("number");
        expect(entry?.lastSeenAt ?? 0).toBeGreaterThanOrEqual(before);
        expect(entry?.status).toBeNull();
      }),
    ),
  );

  it.effect("pages with a stable order", () =>
    withDb((db) =>
      Effect.gen(function* () {
        yield* seed(db);
        const executor = yield* makePlatformExecutor(db);
        const admin = yield* requireAdmin(executor);

        const all = yield* admin.listSubjects();
        const first = yield* admin.listSubjects({ limit: 1 });
        const second = yield* admin.listSubjects({ limit: 1, offset: 1 });

        expect(all).toHaveLength(2);
        expect(first.map((entry) => entry.externalId)).toEqual([all[0]?.externalId]);
        expect(second.map((entry) => entry.externalId)).toEqual([all[1]?.externalId]);
      }),
    ),
  );
});

describe("platform view — admin.listSubjectConnections", () => {
  it.effect("lists another subject's connections across the tenant", () =>
    withDb((db) =>
      Effect.gen(function* () {
        yield* seed(db);
        // Bound to A; reading B is exactly what the product view cannot do.
        const executor = yield* makePlatformExecutor(db, { subject: SUBJECT_A });
        const admin = yield* requireAdmin(executor);

        const connections = yield* admin.listSubjectConnections(SUBJECT_B);

        expect(connections.map((entry) => entry.name)).toEqual(["b-personal"]);
        expect(connections[0]?.integration).toBe("github");
        expect(connections[0]?.owner).toBe("user");
        expect(connections[0]?.subject).toBe(SUBJECT_B);
        expect(connections[0]?.oauthScope).toBe("repo");
        expect(connections[0]?.lastHealth?.status).toBe("healthy");
      }),
    ),
  );

  it.effect("does not attribute org-owned connections to a user", () =>
    withDb((db) =>
      Effect.gen(function* () {
        yield* seed(db);
        const executor = yield* makePlatformExecutor(db);
        const admin = yield* requireAdmin(executor);

        const forA = yield* admin.listSubjectConnections(SUBJECT_A);

        // The org's `stripe/shared` belongs to the tenant, not to A.
        expect(forA.map((entry) => entry.integration).sort()).toEqual(["github", "linear"]);
        expect(forA.every((entry) => entry.owner === "user")).toBe(true);
      }),
    ),
  );

  it.effect("never returns credential-bearing fields", () =>
    withDb((db) =>
      Effect.gen(function* () {
        yield* seed(db);
        const executor = yield* makePlatformExecutor(db);
        const admin = yield* requireAdmin(executor);

        const connections = yield* admin.listSubjectConnections(SUBJECT_A);
        expect(connections.length).toBeGreaterThan(0);

        for (const connection of connections) {
          const keys = Object.keys(connection);
          for (const forbidden of FORBIDDEN_CONNECTION_FIELDS) {
            expect(keys).not.toContain(forbidden);
          }
          // Belt and braces: no seeded secret value appears anywhere in the
          // serialized shape, whatever it is keyed under.
          expect(JSON.stringify(connection)).not.toContain("SECRET-");
        }
      }),
    ),
  );
});

describe("platform view — admin.listSubjectsWithConnections", () => {
  it.effect("joins each subject to its own connections", () =>
    withDb((db) =>
      Effect.gen(function* () {
        yield* seed(db);
        const executor = yield* makePlatformExecutor(db);
        const admin = yield* requireAdmin(executor);

        const rows = yield* admin.listSubjectsWithConnections();
        const byId = new Map(rows.map((row) => [row.externalId, row]));

        expect(rows.map((row) => row.externalId).sort()).toEqual([SUBJECT_A, SUBJECT_B]);
        expect(
          byId
            .get(SUBJECT_A)
            ?.connections.map((c) => c.name)
            .sort(),
        ).toEqual(["personal", "work"]);
        expect(byId.get(SUBJECT_B)?.connections.map((c) => c.name)).toEqual(["b-personal"]);
      }),
    ),
  );

  it.effect("never returns credential-bearing fields", () =>
    withDb((db) =>
      Effect.gen(function* () {
        yield* seed(db);
        const executor = yield* makePlatformExecutor(db);
        const admin = yield* requireAdmin(executor);

        const rows = yield* admin.listSubjectsWithConnections();

        for (const row of rows) {
          for (const connection of row.connections) {
            const keys = Object.keys(connection);
            for (const forbidden of FORBIDDEN_CONNECTION_FIELDS) {
              expect(keys).not.toContain(forbidden);
            }
          }
        }
        expect(JSON.stringify(rows)).not.toContain("SECRET-");
      }),
    ),
  );

  it.effect("works for a pure-org executor with no bound subject", () =>
    withDb((db) =>
      Effect.gen(function* () {
        yield* seed(db);
        // The shape an org-level API key produces: platform view on, no
        // subject bound at all.
        const executor = yield* makePlatformExecutor(db, { subject: null });
        const admin = yield* requireAdmin(executor);

        const rows = yield* admin.listSubjectsWithConnections();

        expect(rows.map((row) => row.externalId).sort()).toEqual([SUBJECT_A, SUBJECT_B]);
        expect(rows.flatMap((row) => row.connections)).toHaveLength(3);
      }),
    ),
  );
});

describe("platform view — default off", () => {
  it.effect("an executor without the opt-in has no admin surface", () =>
    withDb((db) =>
      Effect.gen(function* () {
        yield* seed(db);
        const executor = yield* makePlatformExecutor(db, { platformView: false });

        expect(executor.admin).toBeUndefined();
      }),
    ),
  );

  it.effect("the product view still reads only the bound subject when the opt-in is on", () =>
    withDb((db) =>
      Effect.gen(function* () {
        yield* seed(db);
        // Enabling the platform view must not widen ANY existing surface.
        const executor = yield* makePlatformExecutor(db, { subject: SUBJECT_A });

        const connections = yield* executor.connections.list().pipe(Effect.orDie);

        expect(connections.map((entry) => entry.name).sort()).toEqual([
          "personal",
          "shared",
          "work",
        ]);
      }),
    ),
  );
});