// Cloud: the DCR root-domain collision, end to end over the product API.
//
// The bug this guards (issue #1120): two DIFFERENT integrations can share one
// registrable root domain but differ by host, e.g. a "Cloudflare" MCP
// integration whose OAuth lives on mcp.cloudflare.com vs the plain "Cloudflare"
// REST integration on api.cloudflare.com. When the MCP integration is connected
// it Dynamic-Client-Registers an oauth_client automatically. That auto-minted
// client must NEVER leak into the REST integration's Add-connection app picker
// (it is plumbing, not an app the user picked), and connecting the MCP
// integration a second time must REUSE the same client rather than mint a
// "name 2" duplicate.
//
// Everything here is over the wire: the typed product client drives the real
// cloud API, and a real authorization server (with an RFC 7591 registration
// endpoint) runs inside the scenario on 127.0.0.1. To reproduce the collision
// the scenario stores mcp.cloudflare.com / api.cloudflare.com as the clients'
// endpoint URLs (the classifier keys off those strings, never the network)
// while pointing the actual registration round-trip at the local server.
//
// This e2e proves the SERVER-SIDE half over the wire: (b) DCR mints a client
// against the MCP host, (d) reconnecting reuses it with no duplicate row, and
// the REAL `listClients` projection marks that client as
// `dynamic_client_registration` while preserving its mcp.cloudflare.com
// endpoints. Those two facts (origin kind + persisted host) are the entire
// input the picker classifier keys off. The picker's own verdict for the REST
// integration (that the DCR client is offered in no tier) is asserted against
// the exact production classifier in the React package's integration test
// (packages/react/src/plugins/dcr-root-domain-isolation.test.ts); it lives
// there because that pure function ships in @executor-js/react, and the e2e
// package deliberately does not depend on the React layer. See the report.
import { randomBytes } from "node:crypto";

import { expect } from "@effect/vitest";
import { Effect } from "effect";
import { composePluginApi } from "@executor-js/api/server";
import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
import { IntegrationSlug, OAuthClientSlug } from "@executor-js/sdk/shared";
import { serveOAuthTestServer } from "@executor-js/sdk/testing";

import { scenario } from "../src/scenario";
import { Api, Target } from "../src/services";

const api = composePluginApi([openApiHttpPlugin()] as const);

const unique = (prefix: string) => `${prefix}_${randomBytes(4).toString("hex")}`;

// A same-provider, different-host pair: same registrable root (cloudflare.com),
// distinct hosts. These are the endpoint URLs the clients are PERSISTED with,
// which is all the classifier looks at.
const MCP_ISSUER = "https://mcp.cloudflare.com";
const MCP_AUTHORIZE = "https://mcp.cloudflare.com/authorize";
const MCP_TOKEN = "https://mcp.cloudflare.com/token";
const REST_AUTHORIZE = "https://api.cloudflare.com/client/v4/oauth/authorize";
const REST_TOKEN = "https://api.cloudflare.com/client/v4/oauth/token";

scenario(
  "OAuth DCR · an MCP integration's auto-registered client never leaks into a same-root REST integration's app picker, and reconnecting reuses it",
  {},
  Effect.scoped(
    Effect.gen(function* () {
      const target = yield* Target;
      const { client: makeClient } = yield* Api;
      // A real authorization server with an RFC 7591 registration endpoint. Its
      // /register mints a client_id; the mcp.cloudflare.com URLs above are what
      // we persist so the classifier sees the real-world collision shape.
      const oauth = yield* serveOAuthTestServer();
      const identity = yield* target.newIdentity();
      const client = yield* makeClient(api, identity);

      // Two integrations on the SAME provider root, different hosts: an MCP-style
      // one (mcp.cloudflare.com) and a plain REST one (api.cloudflare.com).
      const mcpIntegration = IntegrationSlug.make(unique("cloudflare_mcp"));
      const restIntegration = IntegrationSlug.make(unique("cloudflare_api"));

      // The REST integration declares its OAuth endpoints up front (api.cloudflare.com).
      yield* client.openapi.addSpec({
        payload: {
          spec: {
            kind: "blob",
            value: JSON.stringify({
              openapi: "3.0.3",
              info: { title: "Cloudflare REST API", version: "1.0.0" },
              paths: {
                "/zones": {
                  get: {
                    operationId: "listZones",
                    tags: ["default"],
                    responses: { "200": { description: "zones" } },
                  },
                },
              },
            }),
          },
          slug: restIntegration,
          baseUrl: "https://api.cloudflare.com/client/v4",
          authenticationTemplate: [
            {
              slug: "oauth",
              kind: "oauth2",
              authorizationUrl: REST_AUTHORIZE,
              tokenUrl: REST_TOKEN,
              scopes: ["read"],
            },
          ],
        },
      });

      // (b) Connect the MCP-style integration via Dynamic Client Registration.
      // The registration round-trip hits the real local server; the persisted
      // client carries the mcp.cloudflare.com endpoints and its issuer.
      const registerMcp = () =>
        client.oauth.registerDynamic({
          payload: {
            owner: "org",
            // Passed but overridden by the server's deterministic dcr-<host> slug
            // when an issuer is present; kept as a fallback for the no-issuer path.
            slug: OAuthClientSlug.make(unique("cloudflare-mcp")),
            issuer: MCP_ISSUER,
            registrationEndpoint: oauth.registrationEndpoint,
            authorizationUrl: MCP_AUTHORIZE,
            tokenUrl: MCP_TOKEN,
            scopes: ["read"],
            clientName: "Cloudflare MCP",
            originIntegration: mcpIntegration,
          },
        });

      const first = yield* registerMcp();
      expect(
        String(first.client),
        "the auto-registered client gets a deterministic issuer-host slug",
      ).toBe("dcr-mcp-cloudflare-com");

      // (d) Reconnect the MCP integration: the SAME authorization server (issuer)
      // must reuse the existing client, not mint a duplicate "…-2".
      const second = yield* registerMcp();
      expect(
        String(second.client),
        "reconnecting the MCP integration reuses the same DCR client (no duplicate row)",
      ).toBe(String(first.client));

      // The REAL API projection of every client the owner can see. This is the
      // exact shape the picker classifier consumes.
      const clients = yield* client.oauth.listClients();
      const dcrRows = clients.filter(
        (entry) => entry.origin.kind === "dynamic_client_registration",
      );
      expect(
        dcrRows.map((entry) => String(entry.slug)),
        "exactly one DCR client exists for the shared authorization server (no duplicate)",
      ).toEqual(["dcr-mcp-cloudflare-com"]);

      const dcrRow = dcrRows[0]!;
      // The picker excludes a client iff its origin is DCR — assert the API
      // projects that origin so the classifier will hide it.
      expect(
        dcrRow.origin.kind,
        "the auto-registered client is projected as a DCR client (the flag the picker hides on)",
      ).toBe("dynamic_client_registration");
      // The persisted endpoints are the MCP host, NOT the local registration
      // server: this is the same-root/different-host collision the classifier
      // must not silently promote into the REST integration's picker.
      expect(
        dcrRow.tokenUrl,
        "the DCR client keeps the MCP host it was registered for, not the registration endpoint",
      ).toBe(MCP_TOKEN);
      // Sanity: the REST integration itself has NO manual app, so its picker
      // would fall back to near/other tiers if the DCR client were ever
      // classified as a real app — the React test proves it never is.
      expect(
        clients.some((entry) => entry.origin.kind === "manual"),
        "no manual OAuth app was registered in this scenario",
      ).toBe(false);
    }),
  ),
);