import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
import type { AddressInfo } from "node:net";

import { describe, expect, it } from "@effect/vitest";
import { env } from "cloudflare:workers";
import { Effect, Schema } from "effect";
import { defaults as ironDefaults, seal as sealIron } from "iron-webcrypto";
import {
  SignJWT,
  exportJWK,
  generateKeyPair,
  type JSONWebKeySet,
  type JWK,
  type KeyLike,
} from "jose";

import { WorkOSClient, collectRawWorkOSList, collectWorkOSList } from "./workos";

const COOKIE_PASSWORD = "test_cookie_password_at_least_32_chars!";
const CLIENT_ID = "client_test";
const API_KEY = "sk_test";
const USER = {
  id: "user_test",
  email: "test@example.com",
  firstName: "Test",
  lastName: "User",
  profilePictureUrl: "https://example.com/avatar.png",
} as const;

interface Keypair {
  readonly kid: string;
  readonly publicJwk: JWK;
  readonly privateKey: KeyLike;
}

interface RecordedRequest {
  readonly method: string;
  readonly path: string;
  readonly body: unknown;
}

interface WorkOSStub {
  readonly baseUrl: string;
  readonly requests: () => readonly RecordedRequest[];
  readonly setKeys: (keys: ReadonlyArray<JWK>) => void;
}

const generateKeypair = async (kid: string): Promise<Keypair> => {
  const { publicKey, privateKey } = await generateKeyPair("RS256");
  const jwk = await exportJWK(publicKey);
  return { kid, publicJwk: { ...jwk, kid, alg: "RS256" }, privateKey };
};

const signAccessToken = (
  keypair: Keypair,
  claims: {
    readonly subject?: string;
    readonly organizationId?: string;
    readonly sessionId?: string;
    readonly expiresIn?: string | number;
  } = {},
) => {
  const jwt = new SignJWT({
    org_id: claims.organizationId ?? "org_test",
    sid: claims.sessionId ?? "session_test",
  })
    .setProtectedHeader({ alg: "RS256", kid: keypair.kid })
    .setSubject(claims.subject ?? USER.id)
    .setIssuedAt();

  return (
    typeof claims.expiresIn === "number"
      ? jwt.setExpirationTime(claims.expiresIn)
      : jwt.setExpirationTime(claims.expiresIn ?? "5m")
  ).sign(keypair.privateKey);
};

const sealSession = async (accessToken: string, refreshToken = "refresh_test"): Promise<string> =>
  `${await sealIron(
    {
      accessToken,
      refreshToken,
      user: USER,
    },
    { id: "1", secret: COOKIE_PASSWORD },
    { ...ironDefaults, ttl: 0, encode: JSON.stringify },
  )}~2`;

const workosUserResponse = {
  object: "user",
  id: USER.id,
  email: USER.email,
  email_verified: true,
  profile_picture_url: USER.profilePictureUrl,
  first_name: USER.firstName,
  last_name: USER.lastName,
  last_sign_in_at: null,
  locale: null,
  created_at: "2026-07-09T00:00:00.000Z",
  updated_at: "2026-07-09T00:00:00.000Z",
  external_id: null,
  metadata: {},
} as const;

const decodeJsonBody = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Unknown));

const readJsonBody = async (request: IncomingMessage): Promise<unknown> => {
  const chunks: Buffer[] = [];
  for await (const chunk of request) {
    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
  }
  const body = Buffer.concat(chunks).toString("utf8");
  return body ? decodeJsonBody(body) : null;
};

const writeJson = (response: ServerResponse, status: number, body: unknown): void => {
  response.writeHead(status, { "content-type": "application/json" });
  response.end(JSON.stringify(body));
};

const withWorkOSStub = async <A>(
  keypair: Keypair,
  use: (stub: WorkOSStub) => Promise<A>,
): Promise<A> => {
  let keys: ReadonlyArray<JWK> = [keypair.publicJwk];
  const requests: RecordedRequest[] = [];
  const server = createServer((request, response) => {
    // oxlint-disable-next-line executor/no-promise-catch -- boundary: Node's request callback cannot await, so the fixture converts async failures into a stable HTTP 500
    void (async () => {
      const path = request.url ?? "/";
      const body = request.method === "POST" ? await readJsonBody(request) : null;
      requests.push({ method: request.method ?? "GET", path, body });

      if (request.method === "GET" && path === `/sso/jwks/${CLIENT_ID}`) {
        writeJson(response, 200, { keys: keys.map((key) => ({ ...key })) } satisfies JSONWebKeySet);
        return;
      }

      if (request.method === "POST" && path === "/user_management/authenticate") {
        const refreshed = await signAccessToken(keypair, {
          sessionId: "session_refreshed",
        });
        writeJson(response, 200, {
          user: workosUserResponse,
          organization_id: "org_test",
          access_token: refreshed,
          refresh_token: "refresh_next",
          authentication_method: "Password",
        });
        return;
      }

      writeJson(response, 404, { error: "unexpected request" });
    })().catch((_error: unknown) => {
      writeJson(response, 500, {
        error: "fixture server failed",
      });
    });
  });

  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
  const address = server.address() as AddressInfo;
  const stub: WorkOSStub = {
    baseUrl: `http://127.0.0.1:${address.port}`,
    requests: () => requests,
    setKeys: (next) => {
      keys = next;
    },
  };

  return use(stub).finally(() => {
    server.closeAllConnections();
    server.close();
  });
};

const runAuthenticate = (sessionData: string, baseUrl: string) => {
  Object.assign(env, {
    WORKOS_API_KEY: API_KEY,
    WORKOS_CLIENT_ID: CLIENT_ID,
    WORKOS_COOKIE_PASSWORD: COOKIE_PASSWORD,
    WORKOS_API_URL: baseUrl,
  });

  return Effect.runPromise(
    Effect.gen(function* () {
      const workos = yield* WorkOSClient;
      return yield* workos.authenticateSealedSession(sessionData);
    }).pipe(Effect.provide(WorkOSClient.Default)),
  );
};

describe("authenticateSealedSession", () => {
  it("validates a sealed session locally with the cached JWKS", async () => {
    const keypair = await generateKeypair("k_valid");
    await withWorkOSStub(keypair, async (stub) => {
      const token = await signAccessToken(keypair, {
        organizationId: "org_test",
        sessionId: "session_valid",
      });
      const session = await sealSession(token);

      const result = await runAuthenticate(session, stub.baseUrl);

      expect(result).toEqual({
        userId: USER.id,
        email: USER.email,
        firstName: USER.firstName,
        lastName: USER.lastName,
        avatarUrl: USER.profilePictureUrl,
        organizationId: "org_test",
        sessionId: "session_valid",
        refreshedSession: undefined,
      });
      expect(stub.requests()).toEqual([
        { method: "GET", path: `/sso/jwks/${CLIENT_ID}`, body: null },
      ]);
    });
  });

  it("reuses the module cached JWKS for a second sealed session", async () => {
    const keypair = await generateKeypair("k_cached");
    await withWorkOSStub(keypair, async (stub) => {
      const first = await sealSession(
        await signAccessToken(keypair, {
          sessionId: "session_first",
        }),
      );
      const second = await sealSession(
        await signAccessToken(keypair, {
          sessionId: "session_second",
        }),
      );

      await runAuthenticate(first, stub.baseUrl);
      const afterFirst = stub.requests().length;
      const result = await runAuthenticate(second, stub.baseUrl);

      expect(afterFirst).toBe(1);
      expect(result?.sessionId).toBe("session_second");
      expect(stub.requests()).toEqual([
        { method: "GET", path: `/sso/jwks/${CLIENT_ID}`, body: null },
      ]);
    });
  });

  it("falls through to SDK refresh when the access token is expired", async () => {
    const keypair = await generateKeypair("k_expired");
    await withWorkOSStub(keypair, async (stub) => {
      const expiredAt = Math.floor(Date.now() / 1000) - 60;
      const expired = await signAccessToken(keypair, {
        expiresIn: expiredAt,
        sessionId: "session_expired",
      });
      const session = await sealSession(expired, "refresh_expired");

      const result = await runAuthenticate(session, stub.baseUrl);

      expect(result?.sessionId).toBe("session_refreshed");
      expect(result?.refreshedSession).toEqual(expect.any(String));
      expect(stub.requests().map((request) => [request.method, request.path])).toEqual([
        ["GET", `/sso/jwks/${CLIENT_ID}`],
        ["POST", "/user_management/authenticate"],
      ]);
      expect(stub.requests()[1]?.body).toMatchObject({
        grant_type: "refresh_token",
        client_id: CLIENT_ID,
        client_secret: API_KEY,
        refresh_token: "refresh_expired",
        organization_id: "org_test",
      });
    });
  });

  it("returns null for garbage session data", async () => {
    const keypair = await generateKeypair("k_garbage");
    await withWorkOSStub(keypair, async (stub) => {
      const result = await runAuthenticate("not-a-sealed-session", stub.baseUrl);

      expect(result).toBeNull();
      expect(stub.requests()).toEqual([]);
    });
  });
});

describe("collectWorkOSList", () => {
  it("collects memberships beyond the first WorkOS page", async () => {
    const autoPaginationCalls: string[] = [];

    const response = await collectWorkOSList({
      object: "list",
      data: [{ id: "om_first_page" }],
      listMetadata: {
        before: null,
        after: "om_next_page",
      },
      autoPagination: async () => {
        autoPaginationCalls.push("called");
        return [{ id: "om_first_page" }, { id: "om_second_page" }];
      },
    });

    expect(response.data).toEqual([{ id: "om_first_page" }, { id: "om_second_page" }]);
    expect(response.listMetadata).toEqual({ before: null, after: null });
    expect(autoPaginationCalls).toEqual(["called"]);
  });

  it("keeps the first page when WorkOS reports no next page", async () => {
    let autoPaginationCalls = 0;

    const response = await collectWorkOSList({
      object: "list",
      data: [{ id: "om_only_page" }],
      listMetadata: {
        before: null,
        after: null,
      },
      autoPagination: async () => {
        autoPaginationCalls += 1;
        return [{ id: "om_unexpected_page" }];
      },
    });

    expect(response.data).toEqual([{ id: "om_only_page" }]);
    expect(response.listMetadata).toEqual({ before: null, after: null });
    expect(autoPaginationCalls).toBe(0);
  });
});

describe("collectRawWorkOSList", () => {
  it("collects raw WorkOS lists using snake-case cursors", async () => {
    const requestedCursors: Array<string | undefined> = [];

    const response = await collectRawWorkOSList(async (after) => {
      requestedCursors.push(after);
      return after
        ? {
            data: [{ id: "api_key_second_page" }],
            list_metadata: {
              before: null,
              after: null,
            },
          }
        : {
            data: [{ id: "api_key_first_page" }],
            list_metadata: {
              before: null,
              after: "api_key_second_page",
            },
          };
    });

    expect(response.data).toEqual([{ id: "api_key_first_page" }, { id: "api_key_second_page" }]);
    expect(response.listMetadata).toEqual({ before: null, after: null });
    expect(requestedCursors).toEqual([undefined, "api_key_second_page"]);
  });

  it("collects raw WorkOS lists using camel-case cursors", async () => {
    const response = await collectRawWorkOSList(async (after) =>
      after
        ? {
            data: [{ id: "second" }],
            listMetadata: {
              before: null,
              after: null,
            },
          }
        : {
            data: [{ id: "first" }],
            listMetadata: {
              before: null,
              after: "second",
            },
          },
    );

    expect(response.data).toEqual([{ id: "first" }, { id: "second" }]);
  });
});