// The self-host app as a target: its real dev server (`bunx --bun vite dev`)
// on a throwaway data dir, with Better Auth + the bootstrap admin. MCP OAuth is
// headless via `forcedMcpConsent` below. Boot lives in
// setup/selfhost.globalsetup.ts.
import { randomBytes } from "node:crypto";

import { Effect } from "effect";

import { e2ePort } from "../src/ports";
import type { Identity, Target } from "../src/target";

export const SELFHOST_PORT = e2ePort("E2E_SELFHOST_PORT", 4);
export const SELFHOST_BASE_URL =
  process.env.E2E_SELFHOST_URL ?? `http://localhost:${SELFHOST_PORT}`;

export const SELFHOST_ADMIN = {
  email: process.env.E2E_SELFHOST_ADMIN_EMAIL ?? "admin@e2e.test",
  password: process.env.E2E_SELFHOST_ADMIN_PASSWORD ?? "e2e-admin-password-123",
};

// Sign the bootstrap admin in via Better Auth email and return the session
// cookie in both shapes we need: the `Cookie` header the API surface attaches,
// and the {name,value} list Playwright injects into a browser context. The
// `origin` header is required — Better Auth rejects state-changing requests
// without it.
export const signInSession = async (
  baseUrl: string,
  credentials: { readonly email: string; readonly password: string },
): Promise<{
  readonly cookieHeader: string;
  readonly cookies: ReadonlyArray<{ readonly name: string; readonly value: string }>;
}> => {
  const response = await fetch(new URL("/api/auth/sign-in/email", baseUrl), {
    method: "POST",
    headers: { "content-type": "application/json", origin: new URL(baseUrl).origin },
    body: JSON.stringify(credentials),
    redirect: "manual",
  });
  const pairs = (response.headers.getSetCookie?.() ?? []).map((c) => c.split(";")[0]!.trim());
  if (pairs.length === 0) throw new Error(`selfhost: sign-in set no cookie (${response.status})`);
  const cookies = pairs.map((pair) => {
    const eq = pair.indexOf("=");
    return { name: pair.slice(0, eq), value: pair.slice(eq + 1) };
  });
  return { cookieHeader: pairs.join("; "), cookies };
};

// Headless MCP OAuth consent. The self-host serving layer forces
// `prompt=consent` on every MCP authorize (src/auth/force-mcp-consent), so an
// authenticated authorize no longer redirects straight to the callback with a
// `code` — it stops on the `/mcp-consent` approval screen with a `consent_code`.
// mcporter's `cookieConsentStrategy` only handles the old direct-code redirect,
// so this completes the screen the way the page does: sign in, drive authorize,
// then POST the same `/api/auth/oauth2/consent` grant the Allow button fires.
export const forcedMcpConsent =
  (baseUrl: string, credentials: { readonly email: string; readonly password: string }) =>
  async ({ authorizationUrl }: { authorizationUrl: string }): Promise<{ code: string }> => {
    const origin = new URL(baseUrl).origin;
    const { cookieHeader } = await signInSession(baseUrl, credentials);

    const authorize = await fetch(authorizationUrl, {
      headers: { cookie: cookieHeader },
      redirect: "manual",
    });
    const location = authorize.headers.get("location");
    if (!location) {
      throw new Error(`forcedMcpConsent: authorize did not redirect (status ${authorize.status})`);
    }
    // The consent redirect is relative (`/mcp-consent?...`) — resolve it against
    // the instance origin. If the server issued a code directly (consent not
    // forced), use it; otherwise complete the forced approval below.
    const redirect = new URL(location, baseUrl);
    const direct = redirect.searchParams.get("code");
    if (direct) return { code: direct };
    const consentCode = redirect.searchParams.get("consent_code");
    if (!consentCode) {
      throw new Error(`forcedMcpConsent: no consent_code in authorize redirect: ${location}`);
    }

    const decision = await fetch(new URL("/api/auth/oauth2/consent", baseUrl), {
      method: "POST",
      headers: { "content-type": "application/json", origin, cookie: cookieHeader },
      body: JSON.stringify({ accept: true, consent_code: consentCode }),
    });
    if (!decision.ok) {
      throw new Error(`forcedMcpConsent: consent grant failed (status ${decision.status})`);
    }
    const decisionText = await decision.text();
    if (!decisionText) {
      throw new Error(
        `forcedMcpConsent: consent grant returned an empty body (status ${decision.status})`,
      );
    }
    const body = JSON.parse(decisionText) as { redirectURI?: string };
    const code = body.redirectURI ? new URL(body.redirectURI).searchParams.get("code") : null;
    if (!code) {
      throw new Error(
        `forcedMcpConsent: no code in consent redirect: ${body.redirectURI ?? "(none)"}`,
      );
    }
    return { code };
  };

// A second, distinct member of the (single) selfhost org: admin invite →
// invited email signup → Better Auth session. What multi-user scenarios use
// until per-test invite-signup isolation lands in newIdentity itself.
export const createInvitedIdentity = async (
  baseUrl: string,
  admin: Identity,
  options?: { readonly role?: "admin" | "member"; readonly emailPrefix?: string },
): Promise<Identity> => {
  const cookie = admin.headers?.cookie;
  if (typeof cookie !== "string") {
    throw new Error("createInvitedIdentity: the admin identity has no Better Auth session cookie");
  }
  const origin = new URL(baseUrl).origin;

  const invite = await fetch(new URL("/api/admin/invites", baseUrl), {
    method: "POST",
    headers: { "content-type": "application/json", cookie, origin },
    body: JSON.stringify({ role: options?.role ?? "member" }),
  });
  if (invite.status !== 200) {
    throw new Error(`createInvitedIdentity: invite create failed (${await invite.text()})`);
  }
  const inviteBody = (await invite.json()) as { readonly code?: string };
  if (typeof inviteBody.code !== "string") {
    throw new Error("createInvitedIdentity: invite response carried no redeemable code");
  }

  const email = `${options?.emailPrefix ?? "invited-member"}-${randomBytes(5).toString("hex")}@e2e.test`;
  const password = "invited-member-password-123";
  const signup = await fetch(new URL("/api/auth/sign-up/email", baseUrl), {
    method: "POST",
    headers: { "content-type": "application/json", origin },
    body: JSON.stringify({ email, password, name: email, inviteCode: inviteBody.code }),
  });
  if (signup.status !== 200) {
    throw new Error(`createInvitedIdentity: invited signup failed (${await signup.text()})`);
  }

  const session = await signInSession(baseUrl, { email, password });
  return {
    label: email,
    credentials: { email, password },
    headers: { cookie: session.cookieHeader },
    cookies: session.cookies,
  };
};

export const selfhostTarget = (): Target => ({
  name: "selfhost",
  baseUrl: SELFHOST_BASE_URL,
  mcpUrl: `${SELFHOST_BASE_URL}/mcp`,
  // No "billing" (no limits) and no setAccessTokenTtl yet (Better Auth is the
  // authorization server; its token TTL isn't test-adjustable, so token-expiry
  // scenarios skip here). Identity is the bootstrap admin for now —
  // single-tenant; per-test invite-signup isolation is the next step here, so
  // browser scenarios must prefix the resources they create.
  capabilities: new Set(["api", "browser", "mcp-oauth"]),
  newIdentity: () =>
    Effect.promise(async (): Promise<Identity> => {
      // Sign in once and carry the session in both shapes: `headers` for the
      // API surface, `cookies` for an injectable logged-in browser context.
      const { cookieHeader, cookies } = await signInSession(SELFHOST_BASE_URL, SELFHOST_ADMIN);
      return {
        label: SELFHOST_ADMIN.email,
        credentials: SELFHOST_ADMIN,
        headers: { cookie: cookieHeader },
        cookies,
      };
    }),
  mcpConsent: (identity: Identity) =>
    forcedMcpConsent(SELFHOST_BASE_URL, {
      email: identity.credentials?.email ?? SELFHOST_ADMIN.email,
      password: identity.credentials?.password || SELFHOST_ADMIN.password,
    }),
});