// Cloud-only (browser): opening another of YOUR orgs by its slug URL just
// works — no switch, no cookie rewrite. The slug in the path is the request
// scope (the `x-executor-organization` header), and the session authenticates
// the user to ALL their orgs at once, so a bookmark or a teammate's link into a
// shared org lands you there regardless of which org the cookie happens to pin.
//
// org-switcher.test.ts covers the account-menu navigation; this covers the URL
// path. (Unknown/unauthorized slugs → 404 is covered by
// scenarios/org-slug-routing.test.ts; two tabs at once by
// org-multitab-cookie.test.ts.)
import { expect } from "@effect/vitest";
import { Effect } from "effect";

import { scenario } from "../src/scenario";
import { Browser, Target } from "../src/services";
import { visit } from "../src/surfaces/browser";

const CLOUD_ORIGIN_HEADERS = (baseUrl: string) => ({ origin: new URL(baseUrl).origin });

scenario(
  "Org URLs · opening another of your orgs by slug works without switching the session",
  {},
  Effect.gen(function* () {
    const target = yield* Target;
    const browser = yield* Browser;

    // Identity starts in org A. Create org B through the real endpoint, which
    // returns its refreshed cookie (the session is now pinned to B).
    const identity = yield* target.newIdentity();
    const cookie = identity.headers?.cookie ?? "";

    const createB = yield* Effect.promise(() =>
      fetch(new URL("/api/auth/create-organization", target.baseUrl), {
        method: "POST",
        headers: {
          "content-type": "application/json",
          cookie,
          ...CLOUD_ORIGIN_HEADERS(target.baseUrl),
        },
        body: JSON.stringify({ name: "Foreign Slug Org B" }),
      }),
    );
    expect(createB.ok, "org B was created").toBe(true);
    const orgB = (yield* Effect.promise(() => createB.json())) as { slug: string };
    const setCookie = createB.headers.get("set-cookie") ?? "";
    const sessionB = /wos-session=([^;]+)/.exec(setCookie)?.[1];
    expect(sessionB, "creating org B pinned the session into it").toBeTruthy();

    // Both orgs' slugs (the org list is the same whichever org the cookie pins).
    const orgs = (yield* Effect.promise(() =>
      fetch(new URL("/api/auth/organizations", target.baseUrl), {
        headers: { cookie: `wos-session=${sessionB}` },
      }).then((r) => r.json()),
    )) as {
      organizations: ReadonlyArray<{ name: string; slug: string }>;
    };
    const slugA = orgs.organizations.find((o) => o.name.startsWith("Org user-"))?.slug;
    expect(slugA, "org A has a slug").toBeTruthy();
    expect(orgB.slug, "org B has a slug").toBeTruthy();
    expect(slugA, "the two orgs have distinct slugs").not.toBe(orgB.slug);

    // Drive the browser as the session pinned to B.
    const inB = {
      ...identity,
      headers: { cookie: `wos-session=${sessionB}` },
      cookies: [{ name: "wos-session", value: sessionB! }],
    };

    yield* browser.session(inB, async ({ page, step }) => {
      await step("Land in org B, then open org A's slug URL directly", async () => {
        await visit(page, `/${orgB.slug}`);
        await page.getByText("Integrations").first().waitFor({ timeout: 30_000 });
        // Open org A by its slug while the cookie is still pinned to B.
        await visit(page, `/${slugA}/policies`);
      });

      await step("Org A's page renders at its slugged URL — the URL is the scope", async () => {
        // Reaching org A's policies at its URL is the proof the request scoped
        // to A off the URL alone: a model that required the cookie to name A
        // would 404 here (the cookie still says B).
        await page.waitForURL((url) => url.pathname === `/${slugA}/policies`, { timeout: 30_000 });
        await page.getByText("Policies").first().waitFor({ timeout: 30_000 });
        // And no switch happened: the session cookie still names org B.
        const sessionCookie = (await page.context().cookies())
          .find((c) => c.name === "wos-session")
          ?.value.split(";")[0];
        expect(sessionCookie, "the session cookie was never rewritten — no switch").toBe(sessionB);
      });
    });
  }),
);