// A Google 403 for a DISABLED API must NOT read as an expired credential.
//
// Production case (2026-07-10): a user's "Personal Google" connection showed
// the red Expired badge although its OAuth token was alive and refreshing.
// The org's Google OAuth client lives in a GCP project without the Gmail /
// Drive / Calendar APIs enabled, so the health probe gets Google's
// SERVICE_DISABLED 403 ("Gmail API has not been used in project ... or it is
// disabled"). The old status-only classifier mapped every 401/403 to
// "expired", so a healthy credential rendered as Expired and the UI told the
// user to reconnect - advice that cannot fix a disabled upstream API.
//
// The scenario replays that exact journey against the Google emulator: a real
// OAuth grant probes healthy; then the upstream starts answering the probe
// operation with Google's real SERVICE_DISABLED body (fault injection - the
// token stays valid, exactly like prod). The fixed classifier reads the error
// body and reports "misconfigured": on screen that is the amber "API
// disabled" badge with Google's own remediation text (including the console
// link that enables the API), and no reconnect prompt.
import { randomBytes } from "node:crypto";

import { expect } from "@effect/vitest";
import { Effect } from "effect";
import type { HttpApiClient } from "effect/unstable/httpapi";
import { composePluginApi } from "@executor-js/api/server";
import { connectEmulator, type EmulatorClient } from "@executor-js/emulate";
import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
import {
  AuthTemplateSlug,
  ConnectionName,
  IntegrationSlug,
  OAuthClientSlug,
} from "@executor-js/sdk/shared";

import { createEmulatorInstance } from "../src/emulator-instance";
import { scenario } from "../src/scenario";
import { Api, Browser, Target } from "../src/services";
import type { Identity, Target as TargetShape } from "../src/target";
import type { BrowserSurface } from "../src/surfaces/browser";

const api = composePluginApi([openApiHttpPlugin()] as const);
type Client = HttpApiClient.ForApi<typeof api>;
const GOOGLE_AUTH_TEMPLATE = AuthTemplateSlug.make("googleOAuth2");
const CONNECTION = ConnectionName.make("main");

// The Gmail preset's declared health check, and the probe the fault hijacks.
const GMAIL_HEALTH_OPERATION = "gmail.users.labels.list";

// Google's real error body for an API that is not enabled in the OAuth
// client's GCP project. Verbatim shape from production: HTTP 403 with reason
// `accessNotConfigured` - an authorization-configuration error, NOT an
// expired/revoked credential.
const DISABLED_API_MESSAGE =
  "Gmail API has not been used in project 000000000000 before or it is disabled. " +
  "Enable it by visiting https://console.developers.google.com/apis/api/gmail.googleapis.com/overview?project=000000000000 then retry.";
const disabledApiBody = {
  error: {
    code: 403,
    message: DISABLED_API_MESSAGE,
    errors: [
      { message: DISABLED_API_MESSAGE, domain: "usageLimits", reason: "accessNotConfigured" },
    ],
    status: "PERMISSION_DENIED",
  },
};

const unique = (prefix: string) => `${prefix}_${randomBytes(4).toString("hex")}`;

const decodeHtml = (value: string): string =>
  value
    .replaceAll("&amp;", "&")
    .replaceAll("&quot;", '"')
    .replaceAll("&#x27;", "'")
    .replaceAll("&lt;", "<")
    .replaceAll("&gt;", ">");

const inputFields = (html: string): Record<string, string> => {
  const fields: Record<string, string> = {};
  for (const input of html.matchAll(/<input\b[^>]*>/gi)) {
    const tag = input[0];
    const name = tag.match(/\bname=["']([^"']+)["']/i)?.[1];
    const value = tag.match(/\bvalue=["']([^"']*)["']/i)?.[1] ?? "";
    if (name) fields[decodeHtml(name)] = decodeHtml(value);
  }
  return fields;
};

const formAction = (html: string, fallback: string): string => {
  const action = html.match(/<form\b[^>]*\baction=["']([^"']+)["']/i)?.[1];
  return action ? decodeHtml(action) : fallback;
};

const completeGoogleConsent = (authorizationUrl: string) =>
  Effect.promise(async () => {
    const page = await fetch(authorizationUrl);
    if (!page.ok) throw new Error(`Google emulator authorize failed: ${page.status}`);
    const html = await page.text();
    const callback = await fetch(formAction(html, authorizationUrl), {
      method: "POST",
      body: new URLSearchParams(inputFields(html)),
      redirect: "manual",
    });
    const location = callback.headers.get("location");
    if (callback.status !== 302 || !location) {
      throw new Error(`Google emulator consent did not redirect: ${callback.status}`);
    }
    const code = new URL(location).searchParams.get("code");
    if (!code) throw new Error("Google emulator callback did not include a code");
    return code;
  });

const createGoogleEmulator = Effect.gen(function* () {
  const baseUrl = yield* createEmulatorInstance("google", "disabled-api");
  const client = yield* Effect.promise(() => connectEmulator({ baseUrl }));
  return { client, baseUrl };
});

const addGooglePresetFromCatalog = (
  browser: BrowserSurface,
  identity: Identity,
  presetName: string,
  slug: string,
) =>
  browser.session(identity, async ({ page, step }) => {
    await step(`Open ${presetName} from the connect catalog`, async () => {
      await page.goto("/integrations", { waitUntil: "networkidle" });
      await page
        .getByRole("button", { name: /Connect/ })
        .first()
        .click();
      const dialog = page.getByRole("dialog", { name: "Connect an integration" });
      await dialog.waitFor();
      await dialog.getByPlaceholder(/Search or paste a URL/).fill(presetName);
      await dialog.getByRole("link", { name: new RegExp(`^${presetName}\\b`) }).click();
    });

    await step(`Add the ${presetName} integration`, async () => {
      await page.waitForURL(/\/integrations\/add\/openapi/);
      await page.getByRole("heading", { name: "Add OpenAPI integration" }).waitFor();
      const button = page.getByRole("button", { name: "Add integration" });
      await button.waitFor({ timeout: 120_000 });
      await button.click({ timeout: 120_000 });
      await page.waitForURL(new RegExp(`/integrations/${slug}\\b`), { timeout: 120_000 });
    });
  });

const connectGoogleAccount = (input: {
  readonly client: Client;
  readonly emulator: EmulatorClient;
  readonly emulatorBaseUrl: string;
  readonly target: TargetShape;
  readonly integration: IntegrationSlug;
  readonly oauthClient: OAuthClientSlug;
}) =>
  Effect.gen(function* () {
    const redirectUri = new URL("/api/oauth/callback", input.target.baseUrl).toString();
    const credential = yield* Effect.promise(() =>
      input.emulator.credentials.mint({
        type: "oauth-authorization-code",
        redirect_uris: [redirectUri],
      }),
    );
    if (!credential.client_id || !credential.client_secret) {
      return yield* Effect.die(`Google emulator did not mint an OAuth client`);
    }

    yield* input.client.openapi.configure({
      params: { slug: input.integration },
      payload: { baseUrl: input.emulatorBaseUrl },
    });
    yield* input.client.oauth.createClient({
      payload: {
        owner: "org",
        slug: input.oauthClient,
        grant: "authorization_code",
        authorizationUrl: `${input.emulatorBaseUrl}/o/oauth2/v2/auth`,
        tokenUrl: `${input.emulatorBaseUrl}/oauth2/token`,
        clientId: credential.client_id,
        clientSecret: credential.client_secret,
        originIntegration: input.integration,
      },
    });

    const started = yield* input.client.oauth.start({
      payload: {
        client: input.oauthClient,
        clientOwner: "org",
        owner: "org",
        name: CONNECTION,
        integration: input.integration,
        template: GOOGLE_AUTH_TEMPLATE,
        redirectUri,
      },
    });
    expect(started.status, "OAuth starts with an emulator redirect").toBe("redirect");
    if (started.status !== "redirect") return yield* Effect.die("OAuth unexpectedly connected");

    const code = yield* completeGoogleConsent(started.authorizationUrl);
    const completed = yield* input.client.oauth.complete({
      payload: { state: started.state, code },
    });
    expect(completed.integration, "OAuth completion creates the connection").toBe(
      input.integration,
    );
  });

scenario(
  "Google · a disabled upstream API reads as API disabled with the enable link, not Expired",
  { timeout: 300_000 },
  Effect.gen(function* () {
    const target = yield* Target;
    const browser = yield* Browser;
    const { client: makeClient } = yield* Api;
    const identity = yield* target.newIdentity();
    const client = yield* makeClient(api, identity);
    const emulator = yield* createGoogleEmulator;
    const slug = IntegrationSlug.make("google_gmail");
    const oauthClient = OAuthClientSlug.make(unique("google_gmail_oauth"));

    yield* Effect.ensuring(
      Effect.gen(function* () {
        yield* addGooglePresetFromCatalog(browser, identity, "Gmail", String(slug));

        const stored = yield* client.integrations.healthCheckGet({ params: { slug } });
        expect(stored?.operation, "the Gmail preset declares its labels probe").toBe(
          GMAIL_HEALTH_OPERATION,
        );

        yield* connectGoogleAccount({
          client,
          emulator: emulator.client,
          emulatorBaseUrl: emulator.baseUrl,
          target,
          integration: slug,
          oauthClient,
        });

        // Baseline: the freshly granted token probes healthy against the
        // emulator - same as prod the day the account was connected.
        const healthy = yield* client.connections.checkHealth({
          params: { owner: "org", integration: slug, name: CONNECTION },
          query: { ifStaleMs: 0 },
        });
        expect(healthy.status, `the fresh grant probes healthy: ${JSON.stringify(healthy)}`).toBe(
          "healthy",
        );

        // The upstream flips: the probe operation now answers with Google's
        // real SERVICE_DISABLED 403. ONLY that route faults - the OAuth token
        // endpoints stay live, so the credential itself remains valid and
        // refreshable, exactly the production condition. Generous `times`
        // covers the UI's automatic revalidations on top of explicit checks.
        yield* Effect.promise(() =>
          emulator.client.faults.arm({
            match: { operationId: GMAIL_HEALTH_OPERATION },
            response: { status: 403, body: disabledApiBody },
            times: 100,
          }),
        );
        yield* Effect.promise(() => emulator.client.ledger.clear());

        // The fix under test: a 403 that means "enable this API in your GCP
        // project" classifies as misconfigured, not as a dead credential.
        const verdict = yield* client.connections.checkHealth({
          params: { owner: "org", integration: slug, name: CONNECTION },
          query: { ifStaleMs: 0 },
        });
        expect(
          verdict.status,
          `the SERVICE_DISABLED 403 classifies as misconfigured: ${JSON.stringify(verdict)}`,
        ).toBe("misconfigured");
        expect(verdict.httpStatus, "the probe observed the 403").toBe(403);
        expect(
          verdict.detail,
          "the stored detail names the real cause (a disabled API, not an expired token)",
        ).toContain("has not been used in project");

        // The 403 came from the armed fault on the probe route - the token
        // was never rejected by the emulator's auth layer.
        const ledger = yield* Effect.promise(() => emulator.client.ledger.list(50));
        const probeEntry = ledger.find((entry) => entry.operationId === GMAIL_HEALTH_OPERATION);
        expect(probeEntry?.faulted, "the probe was answered by the armed fault").toBe(true);

        yield* browser.session(identity, async ({ page, step }) => {
          const connections = page.locator("section").filter({
            has: page.getByRole("heading", { level: 3, name: "Connections" }),
          });

          await step(
            "The connection shows the amber API disabled badge - not Expired - with no clicks",
            async () => {
              await page.goto(`/integrations/${slug}`, { waitUntil: "networkidle" });
              await connections
                .getByText("API disabled", { exact: true })
                .waitFor({ timeout: 30_000 });
              await connections.getByLabel("Status: API disabled").waitFor();
              // The dead-credential story must be gone entirely.
              expect(
                await connections.getByText("Expired", { exact: true }).count(),
                "no Expired badge on a misconfigured connection",
              ).toBe(0);
            },
          );

          await step(
            "The row carries Google's own instruction, console link included",
            async () => {
              const detail = connections.getByText(/has not been used in project/);
              await detail.waitFor();
              const consoleLink = connections.getByRole("link", {
                name: /console\.developers\.google\.com/,
              });
              await consoleLink.waitFor();
              expect(
                await consoleLink.getAttribute("href"),
                "the enable-API console link is clickable",
              ).toContain("console.developers.google.com");
              // Visible in FULL, not just present in the DOM: a one-line
              // truncate keeps the link in the tree while clipping it from
              // view, which is exactly the regression this guards against.
              // A clipped element overflows horizontally; a wrapped one
              // grows taller instead.
              const clipped = await detail.evaluate(
                (el) =>
                  el.scrollWidth > el.clientWidth + 1 || el.scrollHeight > el.clientHeight + 1,
              );
              expect(clipped, "the remediation text wraps instead of clipping").toBe(false);
              const linkVisible = await consoleLink.evaluate((el) => {
                const rect = el.getBoundingClientRect();
                const detailRect = el.closest("p")?.getBoundingClientRect();
                return detailRect ? rect.right <= detailRect.right + 1 : false;
              });
              expect(linkVisible, "the console link sits inside the visible detail box").toBe(true);
            },
          );

          await step(
            "Check now explains the disabled API instead of prescribing reconnect",
            async () => {
              await connections.locator('button[aria-haspopup="menu"]').click();
              await page.getByRole("menuitem", { name: "Check now" }).click();
              await page
                .getByText(/has not been used in project/)
                .first()
                .waitFor({ timeout: 30_000 });
              expect(
                await page.getByText("Connection expired, reconnect to restore access").count(),
                "the reconnect toast never fires for a configuration 403",
              ).toBe(0);
            },
          );
        });
      }),
      Effect.gen(function* () {
        yield* client.connections
          .remove({ params: { owner: "org", integration: slug, name: CONNECTION } })
          .pipe(Effect.ignore);
        yield* client.oauth
          .removeClient({ params: { slug: oauthClient }, payload: { owner: "org" } })
          .pipe(Effect.ignore);
        yield* client.openapi.removeSpec({ params: { slug } }).pipe(Effect.ignore);
      }),
    );
  }),
);