// Selfhost-only: MCP Enterprise-Managed Authorization (the ID-JAG grant
// profile of draft-ietf-oauth-identity-assertion-authz-grant) driven all the
// way through the product against TWO emulators.
//
//   Okta  — the enterprise identity provider. Runs the real OIDC single
//           sign-on that hands the host an ID token, mints ID-JAGs from it
//           over RFC 8693 token exchange, and enforces an administrator
//           policy table while doing so.
//   MCP   — the Resource Authorization Server AND the MCP server. Advertises
//           `urn:ietf:params:oauth:grant-profile:id-jag` in its RFC 8414
//           metadata, redeems ID-JAGs over RFC 7523 jwt-bearer, and serves the
//           tools behind the resulting access token.
//
// The claim under test is the whole point of the profile: a user who is
// already signed in to the enterprise IdP connects an MCP server with NO
// browser consent step, and the IdP — not the user, and not executor — decides
// whether that is allowed. So there are two phases against the same wiring:
//
//   1. empty policy table → `oauth.start` returns `connected` outright (never
//      `redirect`), and a tool call rides the minted token.
//   2. one DENY policy    → `oauth.start` FAILS as blocked-by-admin. Executor
//      must NOT quietly fall back to the interactive per-server OAuth flow,
//      because that would route the user straight around the control the
//      enterprise just exercised.
//
// Both emulators' request ledgers are the proof. Assertions on executor's own
// responses only show what executor believes; the ledgers show the upstream
// calls it actually made — and, for the denial, the ones it did NOT make.
import { randomBytes } from "node:crypto";
import { createServer } from "node:net";

import { assert, expect } from "@effect/vitest";
import { Effect, Predicate } from "effect";
import { composePluginApi } from "@executor-js/api/server";
import { createEmulator, type Emulator, type LedgerEntry } from "@executor-js/emulate";
import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api";
import {
  AuthTemplateSlug,
  ConnectionName,
  IntegrationSlug,
  OAuthClientSlug,
} from "@executor-js/sdk/shared";

import { scenario } from "../src/scenario";
import { Api, Target } from "../src/services";

const api = composePluginApi([mcpHttpPlugin()] as const);

const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
const JWT_BEARER_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
const ID_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:id_token";

// The Okta emulator's default seed: one user on the `default` authorization
// server. The OAuth client is minted per run so nothing depends on the sample
// client's id.
const OKTA_USER = "testuser@okta.local";
const OKTA_AUTH_SERVER = "default";
// Where the IdP sends the SSO code. Nothing listens on it — the scenario reads
// the code straight off the 302, exactly as a host embedding this flow would
// after its own callback fired.
const SSO_REDIRECT_URI = "http://localhost:3000/callback";

// What the MCP emulator advertises in both its RFC 9728 and RFC 8414 metadata.
// The integration declares no scopes of its own, so executor discovers these
// at connect and asks the IdP for exactly them.
const SERVER_SCOPES = ["repo", "read:user"] as const;

const freshSlug = (prefix: string): string => `${prefix}_${randomBytes(4).toString("hex")}`;

const availablePort = Effect.callback<number>((resume) => {
  const probe = createServer();
  probe.listen(0, "127.0.0.1", () => {
    const address = probe.address();
    const port = typeof address === "object" && address ? address.port : 0;
    probe.close(() => {
      resume(Effect.succeed(port));
    });
  });
});

/** A locally spawned emulator on an OS-assigned port, closed with the scope.
 *  Local rather than hosted on purpose: this scenario asserts on behavior that
 *  shipped in `@executor-js/emulate` 0.14.0, and the npm package is the version
 *  this checkout pins — a hosted instance is whatever was last deployed. */
const emulator = (service: "okta" | "mcp") =>
  Effect.acquireRelease(
    Effect.gen(function* () {
      const port = yield* availablePort;
      return yield* Effect.promise(() => createEmulator({ service, port }));
    }),
    (instance: Emulator) => Effect.promise(() => instance.close()).pipe(Effect.ignore),
  );

const requireString = (value: string | undefined | null, what: string): string => {
  if (!value) throw new Error(`emulator returned no ${what}`);
  return value;
};

/** Single sign-on to the IdP, ending with the ID token the host holds on the
 *  user's behalf (EMA profile §3). This is the ONE step outside the product:
 *  the profile leaves "where the identity assertion comes from" to the host,
 *  and executor is handed the result on the connect request. */
const singleSignOn = (input: {
  readonly issuerBaseUrl: string;
  readonly clientId: string;
  readonly clientSecret: string;
}) =>
  Effect.promise(async (): Promise<string> => {
    const authorize = await fetch(
      `${input.issuerBaseUrl}/oauth2/${OKTA_AUTH_SERVER}/v1/authorize/callback`,
      {
        method: "POST",
        headers: { "content-type": "application/x-www-form-urlencoded" },
        redirect: "manual",
        body: new URLSearchParams({
          user_ref: OKTA_USER,
          redirect_uri: SSO_REDIRECT_URI,
          scope: "openid profile email",
          client_id: input.clientId,
          response_mode: "query",
          auth_server_id: OKTA_AUTH_SERVER,
        }),
      },
    );
    if (authorize.status !== 302) {
      throw new Error(`IdP authorize answered ${authorize.status}, expected a 302`);
    }
    const location = requireString(authorize.headers.get("location"), "authorize redirect");
    const code = requireString(new URL(location).searchParams.get("code"), "authorization code");

    const token = await fetch(`${input.issuerBaseUrl}/oauth2/${OKTA_AUTH_SERVER}/v1/token`, {
      method: "POST",
      headers: { "content-type": "application/x-www-form-urlencoded" },
      body: new URLSearchParams({
        grant_type: "authorization_code",
        code,
        redirect_uri: SSO_REDIRECT_URI,
        client_id: input.clientId,
        client_secret: input.clientSecret,
      }),
    });
    if (!token.ok) throw new Error(`IdP token endpoint answered ${token.status}`);
    const body = (await token.json()) as { readonly id_token?: string };
    return requireString(body.id_token, "id_token");
  });

const ledger = (instance: Emulator) => Effect.promise(() => instance.ledger.list());

const entryFor = (entries: readonly LedgerEntry[], operationId: string): LedgerEntry | undefined =>
  entries.find((entry) => entry.operationId === operationId);

// Sandbox code for the agent path: one addressed MCP tool call, with the
// ToolResult envelope returned as a value (tool failures are values here).
const callGetMeCode = (slug: string, connection: string) => `
const result = await tools.${slug}.org.${connection}.get_me({});
return { ok: result.ok, payload: result.ok ? result.data : result.error };
`;

type SandboxToolOutcome = {
  readonly ok: boolean;
  readonly payload?: { readonly login?: string };
};

scenario(
  "MCP enterprise-managed authorization · an Okta ID-JAG connects and calls an MCP server with no consent step, and admin policy blocks it",
  { timeout: 180_000 },
  Effect.scoped(
    Effect.gen(function* () {
      const target = yield* Target;
      const { client: makeApiClient } = yield* Api;
      const identity = yield* target.newIdentity();
      const client = yield* makeApiClient(api, identity);

      const okta = yield* emulator("okta");
      const mcp = yield* emulator("mcp");
      const mcpEndpoint = `${mcp.url}/mcp`;

      // One client identity across BOTH registrations — the same client the
      // user signed in to, presenting itself to the Resource Authorization
      // Server (draft §5 client continuity: the ID-JAG's `client_id` claim
      // names it, and the redemption authenticates as it).
      const credential = yield* Effect.promise(() =>
        okta.credentials.mint({
          type: "oauth-authorization-code",
          name: "Executor E2E enterprise client",
          redirect_uris: [SSO_REDIRECT_URI],
        }),
      );
      const clientId = requireString(credential.client_id, "IdP client_id");
      const clientSecret = requireString(credential.client_secret, "IdP client_secret");
      const idpTokenUrl = requireString(credential.token_url, "IdP token endpoint");
      const idpAuthorizationUrl = requireString(credential.authorization_url, "IdP authorize URL");

      const subjectToken = yield* singleSignOn({
        issuerBaseUrl: okta.url,
        clientId,
        clientSecret,
      });

      const integration = IntegrationSlug.make(freshSlug("mcp_ema"));
      const idpClient = OAuthClientSlug.make(freshSlug("ema_idp"));
      const serverClient = OAuthClientSlug.make(freshSlug("ema_server"));
      const template = AuthTemplateSlug.make("oauth2");

      // The MCP server, declaring which registered app plays its enterprise
      // IdP. That declaration is the ONLY opt-in: the connect path still has
      // to see the grant profile in the server's own metadata.
      yield* client.mcp.addServer({
        payload: {
          transport: "remote",
          name: "Enterprise-managed MCP (emulate)",
          endpoint: mcpEndpoint,
          slug: String(integration),
          authenticationTemplate: [
            {
              kind: "oauth2",
              enterpriseIdentityProvider: { client: idpClient, clientOwner: "org" },
            },
          ],
        },
      });

      yield* Effect.ensuring(
        Effect.gen(function* () {
          // The client's registration AT THE IdP. Never run as a flow — it
          // exists so the token exchange can authenticate as this client.
          yield* client.oauth.createClient({
            payload: {
              owner: "org",
              slug: idpClient,
              authorizationUrl: idpAuthorizationUrl,
              tokenUrl: idpTokenUrl,
              grant: "authorization_code",
              clientId,
              clientSecret,
            },
          });
          // The client's registration AT THE RESOURCE AUTHORIZATION SERVER.
          // `id_jag` is what puts the connect path on the enterprise-managed
          // branch; `resource` is the RFC 9728 identifier discovery starts from.
          yield* client.oauth.createClient({
            payload: {
              owner: "org",
              slug: serverClient,
              authorizationUrl: `${mcp.url}/authorize`,
              tokenUrl: `${mcp.url}/token`,
              grant: "id_jag",
              clientId,
              clientSecret,
              resource: mcpEndpoint,
            },
          });

          // The catalog carries the pointer through to the client, which is
          // how a real console knows WHICH app to name on the connect request.
          // Everything below drives off the projected descriptor, not the
          // local variable, so a broken projection fails this scenario.
          const catalog = yield* client.integrations.get({ params: { slug: integration } });
          const declared = catalog.authMethods.find((method) => method.kind === "oauth");
          expect(
            declared?.oauth?.enterpriseIdentityProvider,
            "the catalog names the enterprise identity provider for this server",
          ).toEqual({ client: String(idpClient), clientOwner: "org" });
          expect(
            declared?.oauth?.supportsDynamicRegistration,
            "declaring an IdP leaves the interactive flow advertised",
          ).toBe(true);
          const enterprise = declared?.oauth?.enterpriseIdentityProvider;
          assert(enterprise, "every connect request below drives off the projected pointer");

          // ---------------------------------------------------------------
          // Phase 1 — empty policy table: the IdP authorizes the exchange.
          // ---------------------------------------------------------------
          const connected = yield* client.oauth.start({
            payload: {
              owner: "org",
              client: serverClient,
              clientOwner: "org",
              name: ConnectionName.make("main"),
              integration,
              template,
              enterprise: {
                idpClient: enterprise.client,
                idpClientOwner: enterprise.clientOwner,
                subjectToken,
                subjectTokenType: ID_TOKEN_TYPE,
              },
            },
          });

          // The headline: connected outright. A `redirect` here would mean the
          // user was sent through per-server consent after all.
          assert(
            connected.status === "connected",
            "the enterprise grant connects with no authorize redirect",
          );
          expect(
            connected.connection.oauthScope?.split(" ").sort(),
            "the connection carries the scopes the IdP granted",
          ).toEqual([...SERVER_SCOPES].sort());

          const executed = yield* client.executions.execute({
            payload: { code: callGetMeCode(String(integration), "main"), autoApprove: true },
          });
          expect(executed.status, "the tool call completed").toBe("completed");
          const outcome = JSON.parse(executed.text) as SandboxToolOutcome;
          expect(outcome.ok, executed.text).toBe(true);

          // --- Ledger: what executor actually asked the IdP for. -----------
          const oktaEntries = yield* ledger(okta);
          const exchange = entryFor(oktaEntries, "okta.oauth.tokenExchange");
          expect(exchange, "executor ran an RFC 8693 exchange at the IdP").toBeTruthy();
          expect(exchange?.response.status).toBe(200);
          // `requested_token_type` / `subject_token_type` are absent here
          // because the ledger redacts every `*token*` field before recording
          // it — the assertion that they carry the id-jag and id_token URNs
          // belongs to the hermetic protocol tests, which read the wire.
          expect(
            exchange?.request.body,
            "the exchange names the MCP server's authorization server and resource",
          ).toMatchObject({
            grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
            audience: mcp.url,
            resource: mcpEndpoint,
            client_id: clientId,
            scope: SERVER_SCOPES.join(" "),
          });

          // --- Ledger: what executor did with the ID-JAG it got back. ------
          const mcpEntries = yield* ledger(mcp);
          const redemption = entryFor(mcpEntries, "mcp.oauth.jwtBearer");
          expect(
            redemption,
            "executor redeemed the ID-JAG at the resource authorization server",
          ).toBeTruthy();
          expect(redemption?.response.status).toBe(200);
          expect(redemption?.request.body).toMatchObject({
            grant_type: JWT_BEARER_GRANT_TYPE,
            client_id: clientId,
          });
          expect(
            mcpEntries.filter((entry) => entry.path === "/authorize"),
            "no interactive authorization request was ever made",
          ).toEqual([]);

          // --- Ledger: the tool call rode the token the chain minted. ------
          const toolCall = mcpEntries.find(
            (entry) => entry.path === "/mcp" && entry.method === "POST",
          );
          expect(
            toolCall?.identity.user,
            "the MCP server saw the enterprise user with the granted scopes",
          ).toMatchObject({ scopes: [...SERVER_SCOPES] });

          // ---------------------------------------------------------------
          // Phase 2 — administrator policy denies this client. Clear both
          // ledgers first so every entry below belongs to the blocked attempt.
          // ---------------------------------------------------------------
          yield* Effect.promise(() => okta.ledger.clear());
          yield* Effect.promise(() => mcp.ledger.clear());
          yield* Effect.promise(() =>
            okta.seed({
              token_exchange_policies: [
                { name: "Block the executor client", client_id: clientId, effect: "DENY" },
              ],
            }),
          );

          const blocked = yield* client.oauth
            .start({
              payload: {
                owner: "org",
                client: serverClient,
                clientOwner: "org",
                name: ConnectionName.make("blocked"),
                integration,
                template,
                enterprise: {
                  idpClient: enterprise.client,
                  idpClientOwner: enterprise.clientOwner,
                  subjectToken,
                  subjectTokenType: ID_TOKEN_TYPE,
                },
              },
            })
            .pipe(Effect.flip);

          // Blocked-by-admin survives the HTTP boundary as STRUCTURE, not as a
          // sentence: the fields below are what a console branches on.
          assert(
            Predicate.isTagged(blocked, "OAuthStartError"),
            "a policy denial is a start failure, not a transport or decoding fault",
          );
          expect(
            blocked.blockedByAdmin,
            "the denial reaches the client as a FIELD — a console decides from it whether the interactive flow may be offered, and it cannot decide that from a sentence",
          ).toBe(true);
          expect(
            blocked.oauthErrorCode,
            "the IdP's own RFC 8693 §2.2.2 code travels structurally, so support can trace the decision",
          ).toBe("invalid_target");

          const deniedEntries = yield* ledger(okta);
          const denied = entryFor(deniedEntries, "okta.oauth.tokenExchange");
          expect(denied?.response.status, "the IdP refused the exchange").toBe(400);
          expect(denied?.response.body).toMatchObject({ error: "invalid_target" });

          // THE anti-fallback claim. If executor had quietly offered the
          // ordinary per-server flow, the MCP server would have seen an
          // authorize request — or another redemption attempt.
          const afterDenial = yield* ledger(mcp);
          expect(
            afterDenial.filter(
              (entry) =>
                entry.path === "/authorize" ||
                entry.path === "/register" ||
                entry.operationId === "mcp.oauth.jwtBearer",
            ),
            "a policy denial does not fall back to interactive OAuth",
          ).toEqual([]);

          const connections = yield* client.connections.list({ query: { integration } });
          expect(
            connections.map((connection) => String(connection.name)).sort(),
            "the blocked attempt minted no connection",
          ).toEqual(["main"]);
        }),
        Effect.gen(function* () {
          yield* client.connections
            .remove({ params: { owner: "org", integration, name: ConnectionName.make("main") } })
            .pipe(Effect.ignore);
          yield* client.oauth
            .removeClient({ params: { slug: serverClient }, payload: { owner: "org" } })
            .pipe(Effect.ignore);
          yield* client.oauth
            .removeClient({ params: { slug: idpClient }, payload: { owner: "org" } })
            .pipe(Effect.ignore);
          yield* client.mcp.removeServer({ params: { slug: integration } }).pipe(Effect.ignore);
        }),
      );
    }),
  ),
);