import { describe, expect, it } from "@effect/vitest";
import { ConnectionId, ScopeId, SecretId } from "@executor-js/sdk";

import {
  effectiveBindingForScope,
  missingCredentialLabels,
  type BindingRowForCredentialStatus,
  type SourceForCredentialStatus,
} from "./credential-status";

const userScope = ScopeId.make("user");
const orgScope = ScopeId.make("org");
const scopeRanks = new Map([
  [userScope, 0],
  [orgScope, 1],
]);

const source: SourceForCredentialStatus = {
  config: {
    headers: {
      Authorization: { kind: "binding", slot: "header:authorization", prefix: "Bearer " },
    },
    oauth2: {
      securitySchemeName: "oauth2",
      flow: "clientCredentials",
      clientIdSlot: "oauth2:oauth2:client-id",
      clientSecretSlot: "oauth2:oauth2:client-secret",
      connectionSlot: "oauth2:oauth2:connection",
    },
  },
};

const bindings = (
  scopeId: ScopeId,
  slots: readonly string[],
): readonly BindingRowForCredentialStatus[] =>
  slots.map((slot) => ({
    slot,
    scopeId,
    value:
      slot === "oauth2:oauth2:connection"
        ? {
            kind: "connection",
            connectionId: ConnectionId.make(`${scopeId}-connection`),
          }
        : {
            kind: "secret",
            secretId: SecretId.make(`${scopeId}-${slot}`),
          },
  }));

const allSlots = [
  "header:authorization",
  "oauth2:oauth2:client-id",
  "oauth2:oauth2:client-secret",
  "oauth2:oauth2:connection",
] as const;

describe("OpenAPI credential status", () => {
  it("treats personal bindings as satisfying the user's credential status for an org source", () => {
    expect(
      missingCredentialLabels(source, bindings(userScope, allSlots), userScope, scopeRanks, {
        liveConnectionIds: [ConnectionId.make("user-connection")],
      }),
    ).toEqual([]);
  });

  it("falls back to shared org bindings when the user has no personal override", () => {
    expect(
      missingCredentialLabels(source, bindings(orgScope, allSlots), userScope, scopeRanks, {
        liveConnectionIds: [ConnectionId.make("org-connection")],
      }),
    ).toEqual([]);
  });

  it("treats a stale connection binding as missing OAuth credentials", () => {
    expect(
      missingCredentialLabels(source, bindings(userScope, allSlots), userScope, scopeRanks, {
        liveConnectionIds: [],
      }),
    ).toEqual(["OAuth client connection"]);
  });

  it("does not treat personal bindings as satisfying org-level credential status", () => {
    expect(
      missingCredentialLabels(source, bindings(userScope, allSlots), orgScope, scopeRanks),
    ).toEqual(["Authorization", "Client ID", "Client Secret", "OAuth client connection"]);
  });

  it("prefers the personal binding over a shared org binding", () => {
    const binding = effectiveBindingForScope(
      [
        ...bindings(orgScope, ["oauth2:oauth2:connection"]),
        ...bindings(userScope, ["oauth2:oauth2:connection"]),
      ],
      "oauth2:oauth2:connection",
      userScope,
      scopeRanks,
    );

    expect(binding?.scopeId).toEqual(userScope);
  });
});