// ---------------------------------------------------------------------------
// The enterprise-managed credential lifecycle, driven through the executor's
// own surfaces: connect mints a connection with no browser step, and the token
// renewal that follows re-runs the ID-JAG chain without a user.
//
// The ID-JAG's own expiry has no tier here on purpose: the client never stores
// one (see `mintEnterpriseManagedAccessToken`), so "the assertion expired" can
// only be observed at the protocol boundary, where `oauth-ema.test.ts` covers
// it against a Resource Authorization Server that enforces `exp`.
// ---------------------------------------------------------------------------

import { assert, describe, expect, it } from "@effect/vitest";
import { Effect, Predicate } from "effect";

import {
  AuthTemplateSlug,
  ConnectionName,
  IntegrationSlug,
  OAuthClientSlug,
  ToolAddress,
  ToolName,
} from "./ids";
import type { OAuthService } from "./oauth-client";
import { definePlugin } from "./plugin";
import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
import { serveOAuthTestServer, type OAuthTestServerShape } from "./testing/oauth-test-server";

const INTEG = IntegrationSlug.make("acme");
const TEMPLATE = AuthTemplateSlug.make("oauth");
const IDP_CLIENT = OAuthClientSlug.make("enterprise-idp");
const RESOURCE_CLIENT = OAuthClientSlug.make("mcp-server-app");
const CONNECTION = ConnectionName.make("work");
const TOOL = ToolAddress.make("tools.acme.org.work.whoami");

const CLIENT_AT_IDP = "client-at-idp";
const CLIENT_AT_RESOURCE = "client-at-resource";
const ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token" as const;

const oauthPlugin = definePlugin(() => ({
  id: "acme" as const,
  storage: () => ({}),
  resolveTools: () =>
    Effect.succeed({ tools: [{ name: ToolName.make("whoami"), description: "whoami" }] }),
  describeAuthMethods: () => [
    {
      id: "oauth",
      label: "OAuth2",
      kind: "oauth" as const,
      template: String(TEMPLATE),
      // A declared scope, so the assertions below follow one concrete scope
      // through the exchange, the assertion, the redemption, and the stored row.
      oauth: { scopes: ["mcp.read"] },
    },
  ],
  invokeTool: ({ credential }) => Effect.succeed({ token: credential.value }),
  extension: (ctx) => ({
    seed: () => ctx.core.integrations.register({ slug: INTEG, description: "Acme", config: {} }),
  }),
}))();

const plugins = [memoryCredentialsPlugin(), oauthPlugin] as const;

interface EnterpriseServers {
  readonly idp: OAuthTestServerShape;
  readonly resource: OAuthTestServerShape;
  readonly subjectToken: string;
}

const enterpriseServers = (options: {
  readonly denyExchangeWith?: { readonly error: string; readonly errorDescription: string };
  readonly advertiseProfile?: boolean;
  /** Short-lived access tokens put every resolve inside the refresh skew, which
   *  is how the renewal path is exercised without waiting an hour. */
  readonly resourceTokenExpiresInSeconds?: number;
}) =>
  Effect.gen(function* () {
    const idp = yield* serveOAuthTestServer({
      clients: { [CLIENT_AT_IDP]: null },
      scopes: ["mcp.read"],
      enterpriseIdp: {
        resourceClientIds: { [CLIENT_AT_IDP]: CLIENT_AT_RESOURCE },
        ...(options.denyExchangeWith ? { denyExchangeWith: options.denyExchangeWith } : {}),
      },
    });
    const resource = yield* serveOAuthTestServer({
      clients: { [CLIENT_AT_RESOURCE]: null },
      scopes: ["mcp.read"],
      ...(options.resourceTokenExpiresInSeconds === undefined
        ? {}
        : { tokenExpiresInSeconds: options.resourceTokenExpiresInSeconds }),
      ...(options.advertiseProfile === false
        ? {}
        : { enterpriseResourceServer: { trustedIdpIssuer: idp.issuerUrl } }),
    });
    const session = yield* idp.completeAuthorizationCodeTokenFlow({
      clientId: CLIENT_AT_IDP,
      clientSecret: "",
      scopes: ["mcp.read"],
    });
    return { idp, resource, subjectToken: session.accessToken } satisfies EnterpriseServers;
  });

/** Register the two client identities the profile needs: one at the enterprise
 *  IdP (authenticates the token exchange) and one at the MCP server's
 *  authorization server (authenticates the redemption, and is the client the
 *  ID-JAG's `client_id` claim names). */
const registerClients = (createClient: OAuthService["createClient"], servers: EnterpriseServers) =>
  Effect.gen(function* () {
    yield* createClient({
      owner: "org",
      slug: IDP_CLIENT,
      authorizationUrl: servers.idp.authorizationEndpoint,
      tokenUrl: servers.idp.tokenEndpoint,
      grant: "authorization_code",
      clientId: CLIENT_AT_IDP,
      clientSecret: "",
    });
    yield* createClient({
      owner: "org",
      slug: RESOURCE_CLIENT,
      authorizationUrl: servers.resource.authorizationEndpoint,
      tokenUrl: servers.resource.tokenEndpoint,
      grant: "id_jag",
      clientId: CLIENT_AT_RESOURCE,
      clientSecret: "",
      resource: servers.resource.mcpResourceUrl,
    });
  });

const startEnterpriseConnect = (servers: EnterpriseServers) =>
  ({
    owner: "org",
    client: RESOURCE_CLIENT,
    clientOwner: "org",
    name: CONNECTION,
    integration: INTEG,
    template: TEMPLATE,
    enterprise: {
      idpClient: IDP_CLIENT,
      idpClientOwner: "org",
      subjectToken: servers.subjectToken,
      subjectTokenType: ACCESS_TOKEN_TYPE,
    },
  }) as const;

const tokenExchangeCount = (servers: EnterpriseServers) =>
  servers.idp.requests.pipe(
    Effect.map(
      (entries) =>
        entries.filter((entry) => entry.path === "/token" && entry.body.includes("token-exchange"))
          .length,
    ),
  );

describe("enterprise-managed connections", () => {
  it.effect("connect mints a usable MCP credential with no browser step", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const servers = yield* enterpriseServers({});
        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
        yield* executor.acme.seed();
        yield* registerClients(executor.oauth.createClient, servers);

        const started = yield* executor.oauth.start(startEnterpriseConnect(servers));
        assert(
          started.status === "connected",
          "the identity assertion replaces per-server consent, so there is nothing to redirect to",
        );
        expect(started.connection.oauthScope).toBe("mcp.read");

        const invoked = (yield* executor.execute(TOOL, {})) as { readonly token: string };
        expect(
          yield* servers.resource.acceptsAccessToken(invoked.token),
          "the tool runs with a token the MCP server's authorization server issued",
        ).toBe(true);
        expect(yield* tokenExchangeCount(servers)).toBe(1);
      }),
    ),
  );

  it.effect("renews an expiring access token by re-running the chain, with no user", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const servers = yield* enterpriseServers({ resourceTokenExpiresInSeconds: 1 });
        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
        yield* executor.acme.seed();
        yield* registerClients(executor.oauth.createClient, servers);
        yield* executor.oauth.start(startEnterpriseConnect(servers));

        const first = (yield* executor.execute(TOOL, {})) as { readonly token: string };
        const second = (yield* executor.execute(TOOL, {})) as { readonly token: string };

        expect(second.token, "the expiring token was replaced").not.toBe(first.token);
        expect(
          yield* servers.resource.acceptsAccessToken(second.token),
          "the replacement came from the resource authorization server",
        ).toBe(true);
        expect(
          yield* tokenExchangeCount(servers),
          "every renewal returns to the IdP, so enterprise policy is re-evaluated each time",
        ).toBeGreaterThan(1);
      }),
    ),
  );

  it.effect("marks the connection expired when the stored identity assertion dies", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const servers = yield* enterpriseServers({ resourceTokenExpiresInSeconds: 1 });
        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
        yield* executor.acme.seed();
        yield* registerClients(executor.oauth.createClient, servers);
        yield* executor.oauth.start(startEnterpriseConnect(servers));

        yield* servers.idp.revokeAccessToken(servers.subjectToken);
        const failure = yield* executor.execute(TOOL, {}).pipe(Effect.flip);
        assert(
          Predicate.isTagged(failure, "CredentialResolutionError"),
          "a dead assertion is a credential verdict, not an execution fault",
        );
        expect(
          failure.reauthRequired,
          "only a fresh single sign-on can replace a revoked assertion",
        ).toBe(true);
        expect(
          failure.blockedByAdmin,
          "the assertion died; the administrator did not withdraw access",
        ).toBeUndefined();

        const connections = yield* executor.connections.list();
        const connection = connections.find((entry) => String(entry.name) === String(CONNECTION));
        expect(
          connection?.lastHealth?.status,
          "a dead assertion is recorded so the accounts list shows it without a probe",
        ).toBe("expired");
      }),
    ),
  );

  it.effect("reports a policy withdrawn after connect as blocked-by-admin, not as re-auth", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const servers = yield* enterpriseServers({ resourceTokenExpiresInSeconds: 1 });
        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
        yield* executor.acme.seed();
        yield* registerClients(executor.oauth.createClient, servers);
        yield* executor.oauth.start(startEnterpriseConnect(servers));
        yield* executor.execute(TOOL, {});

        // The administrator revokes access AFTER the connection exists. Renewal
        // meets the denial where no user is present, which is the only place
        // `blockedByAdmin` is ever produced on a credential failure.
        yield* servers.idp.setTokenExchangeDenial({
          error: "access_denied",
          errorDescription: "This user is no longer approved for the requested MCP server.",
        });

        const failure = yield* executor.execute(TOOL, {}).pipe(Effect.flip);
        assert(
          Predicate.isTagged(failure, "CredentialResolutionError"),
          "an administrator decision is a credential verdict, not a transport failure that retries",
        );
        expect(
          failure.blockedByAdmin,
          "signing in again cannot help, and the interactive per-server flow must not be offered as a way around the policy",
        ).toBe(true);
        expect(failure.oauthErrorCode, "the IdP's own §5.2 code travels structurally").toBe(
          "access_denied",
        );

        const connections = yield* executor.connections.list();
        const connection = connections.find((entry) => String(entry.name) === String(CONNECTION));
        expect(
          connection?.lastHealth?.status,
          "the accounts list shows the blocked connection without another probe",
        ).toBe("expired");
      }),
    ),
  );

  it.effect("refuses to fall back to interactive OAuth when the IdP denies the exchange", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const servers = yield* enterpriseServers({
          denyExchangeWith: {
            error: "unauthorized_client",
            errorDescription: "This client is not approved for the requested MCP server.",
          },
        });
        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
        yield* executor.acme.seed();
        yield* registerClients(executor.oauth.createClient, servers);

        const failure = yield* executor.oauth
          .start(startEnterpriseConnect(servers))
          .pipe(Effect.flip);

        assert(Predicate.isTagged(failure, "OAuthStartError"));
        expect(
          failure.blockedByAdmin,
          "the console must be able to branch on blocked-by-admin without reading prose: it decides whether the interactive flow may be offered as an alternative",
        ).toBe(true);
        expect(
          failure.oauthErrorCode,
          "the IdP's own verdict travels as a code, so support can trace the decision",
        ).toBe("unauthorized_client");
        expect(
          (yield* executor.connections.list()).length,
          "a denied connect leaves no half-made connection behind",
        ).toBe(0);
      }),
    ),
  );

  it.effect("falls back to the interactive flow when the server lacks the grant profile", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const servers = yield* enterpriseServers({ advertiseProfile: false });
        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
        yield* executor.acme.seed();
        yield* registerClients(executor.oauth.createClient, servers);

        const started = yield* executor.oauth.start(startEnterpriseConnect(servers));

        expect(
          started.status,
          "a server that never implemented the profile still gets ordinary per-server consent",
        ).toBe("redirect");
        expect(
          yield* tokenExchangeCount(servers),
          "no identity assertion is spent on a server that cannot accept one",
        ).toBe(0);
      }),
    ),
  );
});