// End-to-end test for the graphql portion of
// GraphQL credential migrations: seed a DB at the pre-migration shape
// with json-blob headers/query_params/auth, run all migrations, and
// assert the final slot model plus shared credential_binding rows.

import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest";
import { Database } from "bun:sqlite";
import { Schema } from "effect";
import { mkdtempSync, rmSync } from "node:fs";
import { join } from "node:path";
import { tmpdir } from "node:os";
import { drizzle } from "drizzle-orm/bun-sqlite";
import { migrate } from "drizzle-orm/bun-sqlite/migrator";

import { PRE_0007_SQL, stampPriorMigrationsApplied } from "./__test-helpers__/pre-0007-schema";

const MIGRATIONS_FOLDER = join(import.meta.dirname, "../../drizzle");

const NullableString = Schema.NullOr(Schema.String);

const GraphqlAuthRow = Schema.Struct({
  auth_kind: Schema.String,
  auth_connection_slot: NullableString,
});

const TableInfoRow = Schema.Struct({
  name: Schema.String,
});

const GraphqlHeaderRow = Schema.Struct({
  name: Schema.String,
  kind: Schema.String,
  text_value: NullableString,
  slot_key: NullableString,
  prefix: NullableString,
});

const GraphqlQueryParamRow = Schema.Struct({
  kind: Schema.String,
  slot_key: Schema.String,
});

const BindingRow = Schema.Struct({
  scope_id: Schema.String,
  plugin_id: Schema.String,
  source_id: Schema.String,
  source_scope_id: Schema.String,
  slot_key: Schema.String,
  kind: Schema.String,
  secret_id: NullableString,
  connection_id: NullableString,
});

const CountRow = Schema.Struct({
  n: Schema.Number,
});

const GraphqlHeaderIdRow = Schema.Struct({
  id: Schema.String,
  source_id: Schema.String,
  name: Schema.String,
  text_value: Schema.String,
});

const decodeAuthRow = Schema.decodeUnknownSync(GraphqlAuthRow);
const decodeTableInfoRows = Schema.decodeUnknownSync(Schema.Array(TableInfoRow));
const decodeHeaderRows = Schema.decodeUnknownSync(Schema.Array(GraphqlHeaderRow));
const decodeQueryParamRow = Schema.decodeUnknownSync(GraphqlQueryParamRow);
const decodeBindingRows = Schema.decodeUnknownSync(Schema.Array(BindingRow));
const decodeCountRow = Schema.decodeUnknownSync(CountRow);
const decodeHeaderIdRows = Schema.decodeUnknownSync(Schema.Array(GraphqlHeaderIdRow));

let dir: string;

beforeEach(() => {
  dir = mkdtempSync(join(tmpdir(), "graphql-mig-"));
});

afterEach(() => {
  rmSync(dir, { recursive: true, force: true });
});

describe("graphql credential migrations", () => {
  it("moves auth json connection refs into a connection slot binding", () => {
    const dbPath = join(dir, "test.sqlite");
    const db = new Database(dbPath);
    db.exec(PRE_0007_SQL);
    stampPriorMigrationsApplied(db);

    db.prepare(
      "INSERT INTO graphql_source (scope_id, id, name, endpoint, auth) VALUES (?, ?, ?, ?, ?)",
    ).run(
      "default-scope",
      "github",
      "GitHub",
      "https://api.github.com/graphql",
      JSON.stringify({ kind: "oauth2", connectionId: "conn-1" }),
    );

    db.close();

    const drizzleDb = drizzle(new Database(dbPath));
    migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER });

    const after = new Database(dbPath, { readonly: true });
    const row = decodeAuthRow(
      after
        .prepare("SELECT auth_kind, auth_connection_slot FROM graphql_source WHERE id = ?")
        .get("github"),
    );
    expect(row.auth_kind).toBe("oauth2");
    expect(row.auth_connection_slot).toBe("auth:oauth2:connection");
    const bindings = decodeBindingRows(
      after
        .prepare(
          "SELECT scope_id, plugin_id, source_id, source_scope_id, slot_key, kind, secret_id, connection_id FROM credential_binding WHERE plugin_id = ? ORDER BY slot_key",
        )
        .all("graphql"),
    );
    expect(bindings).toEqual([
      {
        scope_id: "default-scope",
        plugin_id: "graphql",
        source_id: "github",
        source_scope_id: "default-scope",
        slot_key: "auth:oauth2:connection",
        kind: "connection",
        secret_id: null,
        connection_id: "conn-1",
      },
    ]);
    // Old json column is gone.
    const cols = decodeTableInfoRows(after.prepare("PRAGMA table_info('graphql_source')").all());
    expect(cols.some((c) => c.name === "auth")).toBe(false);
    expect(cols.some((c) => c.name === "headers")).toBe(false);
    expect(cols.some((c) => c.name === "query_params")).toBe(false);
    expect(cols.some((c) => c.name === "auth_connection_id")).toBe(false);
    after.close();
  });

  it("explodes header/query_param json into slots and credential bindings", () => {
    const dbPath = join(dir, "test.sqlite");
    const db = new Database(dbPath);
    db.exec(PRE_0007_SQL);
    stampPriorMigrationsApplied(db);

    const headers = {
      // Literal text header.
      "X-Static": "literal-value",
      // Secret-backed header without prefix.
      Authorization: { secretId: "sec-token" },
      // Secret-backed with prefix.
      "X-Bearer": { secretId: "sec-bearer", prefix: "Bearer " },
    };
    const queryParams = {
      api_key: { secretId: "sec-key" },
    };

    db.prepare(
      "INSERT INTO graphql_source (scope_id, id, name, endpoint, headers, query_params, auth) VALUES (?, ?, ?, ?, ?, ?, ?)",
    ).run(
      "default-scope",
      "example",
      "Example",
      "https://example.com/graphql",
      JSON.stringify(headers),
      JSON.stringify(queryParams),
      JSON.stringify({ kind: "none" }),
    );

    db.close();

    const drizzleDb = drizzle(new Database(dbPath));
    migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER });

    const after = new Database(dbPath, { readonly: true });
    const headerRows = decodeHeaderRows(
      after
        .prepare(
          "SELECT name, kind, text_value, slot_key, prefix FROM graphql_source_header WHERE source_id = ? ORDER BY name",
        )
        .all("example"),
    );
    expect(headerRows).toHaveLength(3);

    const byName = new Map(headerRows.map((r) => [r.name, r]));
    expect(byName.get("X-Static")).toMatchObject({
      kind: "text",
      text_value: "literal-value",
      slot_key: null,
    });
    expect(byName.get("Authorization")).toMatchObject({
      kind: "binding",
      text_value: null,
      slot_key: "header:authorization",
      prefix: null,
    });
    expect(byName.get("X-Bearer")).toMatchObject({
      kind: "binding",
      slot_key: "header:x-bearer",
      prefix: "Bearer ",
    });

    const paramRow = decodeQueryParamRow(
      after
        .prepare("SELECT kind, slot_key FROM graphql_source_query_param WHERE source_id = ?")
        .get("example"),
    );
    expect(paramRow).toMatchObject({ kind: "binding", slot_key: "query_param:api-key" });

    const bindings = decodeBindingRows(
      after
        .prepare(
          "SELECT scope_id, plugin_id, source_id, source_scope_id, slot_key, kind, secret_id, connection_id FROM credential_binding WHERE plugin_id = ? ORDER BY slot_key",
        )
        .all("graphql"),
    );
    expect(bindings.map((binding) => [binding.slot_key, binding.secret_id])).toEqual([
      ["header:authorization", "sec-token"],
      ["header:x-bearer", "sec-bearer"],
      ["query_param:api-key", "sec-key"],
    ]);

    after.close();
  });

  it("fails instead of silently collapsing colliding legacy query parameter slots", () => {
    const dbPath = join(dir, "test.sqlite");
    const db = new Database(dbPath);
    db.exec(PRE_0007_SQL);
    stampPriorMigrationsApplied(db);

    db.prepare(
      "INSERT INTO graphql_source (scope_id, id, name, endpoint, query_params, auth) VALUES (?, ?, ?, ?, ?, ?)",
    ).run(
      "default-scope",
      "collision",
      "Collision",
      "https://example.com/graphql",
      JSON.stringify({
        api_key: { secretId: "sec-underscore" },
        "api-key": { secretId: "sec-dash" },
      }),
      JSON.stringify({ kind: "none" }),
    );

    db.close();

    const sqlite = new Database(dbPath);
    const drizzleDb = drizzle(sqlite);
    expect(() => migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER })).toThrow();
    sqlite.close();
  });

  it("fails instead of silently collapsing colliding legacy header slots", () => {
    const dbPath = join(dir, "test.sqlite");
    const db = new Database(dbPath);
    db.exec(PRE_0007_SQL);
    stampPriorMigrationsApplied(db);

    db.prepare(
      "INSERT INTO graphql_source (scope_id, id, name, endpoint, headers, auth) VALUES (?, ?, ?, ?, ?, ?)",
    ).run(
      "default-scope",
      "collision",
      "Collision",
      "https://example.com/graphql",
      JSON.stringify({
        x_token: { secretId: "sec-underscore" },
        "x-token": { secretId: "sec-dash" },
      }),
      JSON.stringify({ kind: "none" }),
    );

    db.close();

    const sqlite = new Database(dbPath);
    const drizzleDb = drizzle(sqlite);
    expect(() => migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER })).toThrow();
    sqlite.close();
  });

  it("handles graphql_source rows with null json (empty config)", () => {
    const dbPath = join(dir, "test.sqlite");
    const db = new Database(dbPath);
    db.exec(PRE_0007_SQL);
    stampPriorMigrationsApplied(db);

    db.prepare("INSERT INTO graphql_source (scope_id, id, name, endpoint) VALUES (?, ?, ?, ?)").run(
      "default-scope",
      "bare",
      "Bare",
      "https://bare.example/graphql",
    );
    db.close();

    const drizzleDb = drizzle(new Database(dbPath));
    migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER });

    const after = new Database(dbPath, { readonly: true });
    const row = decodeAuthRow(
      after
        .prepare("SELECT auth_kind, auth_connection_slot FROM graphql_source WHERE id = ?")
        .get("bare"),
    );
    expect(row.auth_kind).toBe("none");
    expect(row.auth_connection_slot).toBeNull();

    const headerCount = decodeCountRow(
      after
        .prepare("SELECT count(*) as n FROM graphql_source_header WHERE source_id = ?")
        .get("bare"),
    ).n;
    expect(headerCount).toBe(0);
    after.close();
  });

  it("does not collapse child rows whose source/name pairs share colon-concatenated ids", () => {
    const dbPath = join(dir, "test.sqlite");
    const db = new Database(dbPath);
    db.exec(PRE_0007_SQL);
    stampPriorMigrationsApplied(db);

    const insert = db.prepare(
      "INSERT INTO graphql_source (scope_id, id, name, endpoint, headers) VALUES (?, ?, ?, ?, ?)",
    );
    insert.run(
      "default-scope",
      "a:b",
      "First",
      "https://first.example/graphql",
      JSON.stringify({ c: "first" }),
    );
    insert.run(
      "default-scope",
      "a",
      "Second",
      "https://second.example/graphql",
      JSON.stringify({ "b:c": "second" }),
    );
    db.close();

    const drizzleDb = drizzle(new Database(dbPath));
    migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER });

    const after = new Database(dbPath, { readonly: true });
    const rows = decodeHeaderIdRows(
      after
        .prepare(
          "SELECT id, source_id, name, text_value FROM graphql_source_header ORDER BY source_id, name",
        )
        .all(),
    );
    expect(rows).toHaveLength(2);
    expect(rows).toEqual([
      {
        id: '["a","b:c"]',
        source_id: "a",
        name: "b:c",
        text_value: "second",
      },
      {
        id: '["a:b","c"]',
        source_id: "a:b",
        name: "c",
        text_value: "first",
      },
    ]);
    after.close();
  });
});