import { describe, expect, it } from "@effect/vitest";

import { isAppOwnedPath, servedByAppPlane, servedByAuthPlane } from "./app-paths";

// Guards the start.ts dispatch decision: every surface the unified app handler
// serves must be classified app-owned (forwarded to `app.handler`), and Start's
// own routes must NOT be. The billing proxy + Swagger live under `/api`
// (`/api/billing/*`, `/api/docs`) — the React app posts to `/api/billing/*` via
// <AutumnProvider> — so a request there must reach the handler, not the SPA.
describe("isAppOwnedPath", () => {
  const appOwned = [
    "/api",
    "/api/executions",
    "/api/auth/me",
    "/api/openapi.json",
    "/api/oauth/client-id-metadata/default.json",
    "/api/billing/customer", // AutumnProvider pathPrefix — the billing UI
    "/api/billing/attach",
    "/api/docs", // Swagger UI
    "/mcp",
    "/mcp/toolkits/deploy-kit",
    "/.well-known/oauth-protected-resource/mcp",
    "/.well-known/oauth-protected-resource/mcp/toolkits/deploy-kit",
    "/.well-known/oauth-authorization-server",
    // Org-pinned MCP: the org's URL slug (what the install card prints) and
    // the legacy WorkOS org-id form both select an org on the MCP plane.
    "/acme-corp/mcp",
    "/acme-corp/mcp/toolkits/deploy-kit",
    "/org_01ABCDEF/mcp",
    "/org_01ABCDEF/mcp/toolkits/deploy-kit",
    "/.well-known/oauth-protected-resource/acme-corp/mcp",
    "/.well-known/oauth-protected-resource/acme-corp/mcp/toolkits/deploy-kit",
    "/.well-known/oauth-protected-resource/org_01ABCDEF/mcp",
    "/.well-known/oauth-protected-resource/org_01ABCDEF/mcp/toolkits/deploy-kit",
  ];
  for (const pathname of appOwned) {
    it(`forwards ${pathname} to the app handler`, () => {
      expect(isAppOwnedPath(pathname)).toBe(true);
    });
  }

  // Start-owned: the React shell + its routes. Note `/billing` (the React page)
  // is distinct from `/api/billing/*` (the proxy) — only the latter is app-owned.
  // `/settings/mcp` guards the slug-selector grammar: a RESERVED first segment
  // can never be an org slug, so console-route-shaped paths ending in /mcp fall
  // through to the SPA instead of being swallowed by the MCP plane.
  const startOwned = [
    "/",
    "/policies",
    "/login",
    "/billing",
    "/org",
    "/assets/app.js",
    "/settings/mcp",
    "/settings/mcp/toolkits/deploy-kit",
    "/integrations/mcp",
    "/integrations/mcp/toolkits/deploy-kit",
  ];
  for (const pathname of startOwned) {
    it(`leaves ${pathname} to the Start router`, () => {
      expect(isAppOwnedPath(pathname)).toBe(false);
    });
  }
});

describe("app-plane dispatch", () => {
  // These two are the whole risk of dispatching `/api` before Start: both still
  // return a response if routed early, just the wrong one, so nothing else would
  // catch a regression here.
  it("leaves the Sentry tunnel POST to Start's middleware", () => {
    expect(servedByAppPlane("/api/sentry-tunnel", "POST")).toBe(false);
    // Only the POST is claimed; anything else under that path is ordinary API.
    expect(servedByAppPlane("/api/sentry-tunnel", "GET")).toBe(true);
  });

  it("leaves the OAuth callback to Start, for the signed-out redirect", () => {
    expect(servedByAppPlane("/api/oauth/callback", "GET")).toBe(false);
    expect(servedByAppPlane("/api/oauth/callback", "POST")).toBe(false);
  });

  const appPlane = [
    "/api/connections",
    "/api/tools",
    "/api/integrations",
    "/api/account/members",
    "/api/docs",
    "/api/billing/checkout",
  ];
  for (const pathname of appPlane) {
    it(`serves ${pathname} without entering Start`, () => {
      expect(servedByAppPlane(pathname, "GET")).toBe(true);
    });
  }

  it("never claims a non-API path, however app-owned", () => {
    expect(servedByAppPlane("/mcp", "POST")).toBe(false);
    expect(servedByAppPlane("/", "GET")).toBe(false);
    expect(servedByAppPlane("/.well-known/oauth-authorization-server", "GET")).toBe(false);
  });
});

// The auth plane (`app-auth.ts`) is dispatched BEFORE the app plane, so this
// list is load-bearing twice over: a path it claims but the auth handler does
// not mount answers 404 from the wrong router, and a session path it misses
// keeps paying the full app-graph cold start it exists to avoid.
describe("auth-plane dispatch", () => {
  const authPlane = [
    ["GET", "/api/auth/login"],
    ["POST", "/api/auth/logout"],
    ["GET", "/api/auth/callback"],
    ["GET", "/api/auth/cli-login"],
    ["GET", "/api/auth/me"],
    ["GET", "/api/auth/organizations"],
    ["POST", "/api/auth/create-organization"],
    ["POST", "/api/auth/delete-organization"],
    ["GET", "/api/auth/pending-invitations"],
    ["POST", "/api/auth/accept-invitation"],
    ["GET", "/api/mcp-sessions/sess_1/executions/exec_1"],
    ["POST", "/api/mcp-sessions/sess_1/executions/exec_1/resume"],
    ["GET", "/api/org/domains"],
    ["POST", "/api/org/domains/verify-link"],
    ["DELETE", "/api/org/domains/dom_1"],
  ] as const;
  for (const [method, pathname] of authPlane) {
    it(`serves ${method} ${pathname} on the auth plane`, () => {
      expect(servedByAuthPlane(pathname, method)).toBe(true);
      // Still app-owned: the auth plane is a subset of `/api`, not a new namespace.
      expect(servedByAppPlane(pathname, method)).toBe(true);
    });
  }

  // Everything else under `/api` stays on the full app plane. `/api/account/*`
  // is the closest neighbour — it is the shared account API behind the WorkOS
  // AccountProvider, NOT a session route, and it is not mounted here.
  const appPlaneOnly = [
    ["GET", "/api/account/members"],
    ["GET", "/api/connections"],
    ["GET", "/api/docs"],
    ["GET", "/api/openapi.json"],
    ["POST", "/api/billing/attach"],
    ["POST", "/api/webhooks/workos"],
    ["GET", "/api/admin/users"],
  ] as const;
  for (const [method, pathname] of appPlaneOnly) {
    it(`leaves ${method} ${pathname} to the app plane`, () => {
      expect(servedByAuthPlane(pathname, method)).toBe(false);
    });
  }

  it("matches the method as well as the path", () => {
    // `logout` is POST-only; a GET to it is not a route either plane mounts,
    // and must not be claimed by the auth plane's router.
    expect(servedByAuthPlane("/api/auth/logout", "GET")).toBe(false);
    expect(servedByAuthPlane("/api/auth/me", "POST")).toBe(false);
    expect(servedByAuthPlane("/api/org/domains", "DELETE")).toBe(false);
  });

  it("claims no unlisted path under /api/auth", () => {
    expect(servedByAuthPlane("/api/auth/switch-organization", "POST")).toBe(false);
    expect(servedByAuthPlane("/api/auth", "GET")).toBe(false);
  });

  it("matches one segment per route parameter", () => {
    expect(servedByAuthPlane("/api/mcp-sessions/a/executions/b/c", "GET")).toBe(false);
    expect(servedByAuthPlane("/api/org/domains/a/b", "DELETE")).toBe(false);
  });

  it("never overrides a Start-owned path", () => {
    expect(servedByAuthPlane("/api/oauth/callback", "GET")).toBe(false);
    expect(servedByAuthPlane("/api/sentry-tunnel", "POST")).toBe(false);
    expect(servedByAuthPlane("/", "GET")).toBe(false);
    expect(servedByAuthPlane("/mcp", "POST")).toBe(false);
  });
});