import { describe, expect, it } from "@effect/vitest";
import { OAuthClientSlug } from "@executor-js/sdk/shared";
import type { AuthTemplateEditorValue } from "@executor-js/react/components/auth-template-editor";

import {
  authMethodsFromConfig,
  editorValueFromMcpAuthMethod,
  mcpAuthMethodInputFromEditorValue,
  mcpAuthMethodInputsFromPlacements,
  mcpOAuthMethodInput,
  sameEnterpriseIdentityProvider,
} from "./auth-method-config";

describe("mcpAuthMethodInputFromEditorValue", () => {
  it("maps 'none' → { kind: 'none' }", () => {
    expect(mcpAuthMethodInputFromEditorValue({ kind: "none" })).toEqual({ kind: "none" });
  });

  it("maps 'oauth' → { kind: 'oauth2' } (endpoints/scopes are resolved at connect time)", () => {
    const value: AuthTemplateEditorValue = {
      kind: "oauth",
      authorizationUrl: "https://a.example.com/auth",
      tokenUrl: "https://a.example.com/token",
      scopes: ["mcp.read"],
    };
    expect(mcpAuthMethodInputFromEditorValue(value)).toEqual({ kind: "oauth2" });
  });

  it("maps a header placement to an apikey method (prefix preserved)", () => {
    const value: AuthTemplateEditorValue = {
      kind: "apikey",
      placements: [{ carrier: "header", name: "Authorization", prefix: "Bearer " }],
    };
    expect(mcpAuthMethodInputFromEditorValue(value)).toEqual({
      kind: "apikey",
      placements: [{ carrier: "header", name: "Authorization", prefix: "Bearer " }],
    });
  });

  it("maps a query placement to an apikey method (servers like ui.sh use ?token=)", () => {
    const value: AuthTemplateEditorValue = {
      kind: "apikey",
      placements: [{ carrier: "query", name: "token", prefix: "" }],
    };
    expect(mcpAuthMethodInputFromEditorValue(value)).toEqual({
      kind: "apikey",
      placements: [{ carrier: "query", name: "token" }],
    });
  });

  it("keeps EVERY named placement — header + query mix in one method", () => {
    const value: AuthTemplateEditorValue = {
      kind: "apikey",
      placements: [
        { carrier: "header", name: "Authorization", prefix: "Bearer " },
        { carrier: "query", name: "team_id", prefix: "" },
      ],
    };
    expect(mcpAuthMethodInputFromEditorValue(value)).toEqual({
      kind: "apikey",
      placements: [
        { carrier: "header", name: "Authorization", prefix: "Bearer ", variable: "authorization" },
        { carrier: "query", name: "team_id", variable: "team_id" },
      ],
    });
  });

  it("drops unnamed placements and degrades to none when nothing is usable", () => {
    expect(
      mcpAuthMethodInputFromEditorValue({
        kind: "apikey",
        placements: [{ carrier: "header", name: "  ", prefix: "" }],
      }),
    ).toEqual({ kind: "none" });
  });
});

describe("editorValueFromMcpAuthMethod", () => {
  it("round-trips an apikey method, making the shared token variable explicit", () => {
    expect(
      editorValueFromMcpAuthMethod({
        slug: "header",
        kind: "apikey",
        placements: [{ carrier: "header", name: "X-Api-Key", prefix: "Bearer " }],
      }),
    ).toEqual({
      kind: "apikey",
      placements: [{ carrier: "header", name: "X-Api-Key", prefix: "Bearer ", variable: "token" }],
    });
  });

  it("round-trip edit preserves placement variables (sharing survives)", () => {
    const stored = {
      slug: "custom_two_spots",
      kind: "apikey",
      placements: [
        { carrier: "header", name: "X-Token" },
        { carrier: "query", name: "token" },
      ],
    } as const;
    const editor = editorValueFromMcpAuthMethod(stored);
    const back = mcpAuthMethodInputFromEditorValue(editor);
    // Both placements still share the canonical `token` input (stored as
    // absent on the wire) — a round-trip must not split one credential in two.
    expect(back).toEqual({
      kind: "apikey",
      placements: [
        { carrier: "header", name: "X-Token" },
        { carrier: "query", name: "token" },
      ],
    });
  });

  it("maps oauth2 to an oauth editor value with no endpoints or scopes (discovered at connect)", () => {
    expect(
      editorValueFromMcpAuthMethod({
        slug: "oauth2",
        kind: "oauth2",
      }),
    ).toEqual({
      kind: "oauth",
      authorizationUrl: "",
      tokenUrl: "",
      scopes: [],
    });
  });
});

describe("authMethodsFromConfig", () => {
  it("projects every declared method and marks custom_ slugs as custom", () => {
    const methods = authMethodsFromConfig(
      [
        { slug: "oauth2", kind: "oauth2" },
        {
          slug: "custom_abc123",
          kind: "apikey",
          placements: [{ carrier: "header", name: "X-Api-Key" }],
        },
        { slug: "none", kind: "none" },
      ],
      "https://mcp.example.com/mcp",
    );

    expect(
      methods.map((method) => ({
        id: method.id,
        kind: method.kind,
        source: method.source,
        template: String(method.template),
      })),
    ).toEqual([
      { id: "oauth2", kind: "oauth", source: "spec", template: "oauth2" },
      { id: "custom_abc123", kind: "apikey", source: "custom", template: "custom_abc123" },
      { id: "none", kind: "none", source: "spec", template: "none" },
    ]);
    expect(methods[0]?.oauth?.discoveryUrl).toBe("https://mcp.example.com/mcp");
    expect(methods[0]?.oauth?.scopes).toBeUndefined();
  });

  it("carries multi-placement methods through to the hub", () => {
    const methods = authMethodsFromConfig(
      [
        {
          slug: "custom_mix",
          kind: "apikey",
          placements: [
            { carrier: "header", name: "Authorization", prefix: "Bearer ", variable: "api_token" },
            { carrier: "query", name: "team_id", variable: "team_id" },
          ],
        },
      ],
      "https://mcp.example.com/mcp",
    );
    expect(methods[0]?.placements).toEqual([
      { carrier: "header", name: "Authorization", prefix: "Bearer ", variable: "api_token" },
      { carrier: "query", name: "team_id", prefix: "", variable: "team_id" },
    ]);
  });
});

// ---------------------------------------------------------------------------
// Enterprise-Managed Authorization: the per-server declaration.
//
// The declaration is a POINTER at the organization's identity-provider
// registration, and it is what puts a server on the work-identity route
// instead of per-server consent. Two things must hold or the feature silently
// stops working: it has to reach the console (a dropped pointer means the
// connect path offers ordinary consent for a managed server), and it must not
// be invented by any surface that cannot see the organization's registration.
// ---------------------------------------------------------------------------

const PROVIDER = {
  client: OAuthClientSlug.make("enterprise-identity-provider"),
  clientOwner: "org",
} as const;

describe("authMethodsFromConfig · enterprise-managed declaration", () => {
  it("carries the server's identity-provider pointer onto the rendered method", () => {
    const methods = authMethodsFromConfig(
      [{ slug: "oauth2", kind: "oauth2", enterpriseIdentityProvider: PROVIDER }],
      "https://mcp.example.com/mcp",
    );
    expect(methods[0]?.oauth?.enterpriseIdentityProvider).toEqual(PROVIDER);
  });

  it("leaves the interactive route advertised beside it", () => {
    // Declaring a provider asks the connect path to TRY the enterprise branch.
    // Whether it is taken still depends on the server advertising the grant
    // profile, so the ordinary route must remain available.
    const methods = authMethodsFromConfig(
      [{ slug: "oauth2", kind: "oauth2", enterpriseIdentityProvider: PROVIDER }],
      "https://mcp.example.com/mcp",
    );
    expect(methods[0]?.oauth?.supportsDynamicRegistration).toBe(true);
    expect(methods[0]?.oauth?.discoveryUrl).toBe("https://mcp.example.com/mcp");
  });

  it("declares nothing for an ordinary oauth2 server", () => {
    const methods = authMethodsFromConfig(
      [{ slug: "oauth2", kind: "oauth2" }],
      "https://mcp.example.com/mcp",
    );
    expect(methods[0]?.oauth?.enterpriseIdentityProvider).toBeUndefined();
  });
});

describe("mcpOAuthMethodInput", () => {
  it("attaches the organization's registration when the server is managed", () => {
    expect(mcpOAuthMethodInput(PROVIDER)).toEqual({
      kind: "oauth2",
      enterpriseIdentityProvider: PROVIDER,
    });
  });

  it("omits the key entirely when it is not — never an explicit undefined", () => {
    // `configureMcpAuth` decodes this against a union; an explicit
    // `enterpriseIdentityProvider: undefined` is a different wire value and is
    // rejected, so absence has to be real absence.
    const input = mcpOAuthMethodInput(undefined);
    expect(input).toEqual({ kind: "oauth2" });
    expect(Object.hasOwn(input, "enterpriseIdentityProvider")).toBe(false);
  });
});

describe("mcpAuthMethodInputFromEditorValue · enterprise-managed declaration", () => {
  it("invents no declaration from the credential editor", () => {
    // The editor edits credentials. Server policy is not one, and a surface
    // that cannot see the organization's registration must not guess at it —
    // the save path re-attaches it deliberately instead.
    expect(
      mcpAuthMethodInputFromEditorValue({
        kind: "oauth",
        authorizationUrl: "",
        tokenUrl: "",
        scopes: [],
      }),
    ).toEqual({ kind: "oauth2" });
  });
});

describe("sameEnterpriseIdentityProvider", () => {
  it("compares the pointer by value, not by reference", () => {
    // The stored copy is decoded from JSON, so it is never the same object as
    // the one the console just built; a reference check would report every
    // save as a change.
    expect(sameEnterpriseIdentityProvider({ ...PROVIDER }, { ...PROVIDER })).toBe(true);
  });

  it("distinguishes a different registration", () => {
    expect(sameEnterpriseIdentityProvider(PROVIDER, { ...PROVIDER, clientOwner: "user" })).toBe(
      false,
    );
    expect(
      sameEnterpriseIdentityProvider(PROVIDER, {
        ...PROVIDER,
        client: OAuthClientSlug.make("other"),
      }),
    ).toBe(false);
  });

  it("treats declaring and not declaring as different", () => {
    expect(sameEnterpriseIdentityProvider(PROVIDER, undefined)).toBe(false);
    expect(sameEnterpriseIdentityProvider(undefined, undefined)).toBe(true);
  });
});

describe("mcpAuthMethodInputsFromPlacements", () => {
  it("builds ONE method carrying every named placement", () => {
    expect(
      mcpAuthMethodInputsFromPlacements([
        { carrier: "header", name: "X-Token", prefix: "Bearer " },
        { carrier: "query", name: "team_id", prefix: "" },
      ]),
    ).toEqual([
      {
        kind: "apikey",
        placements: [
          { carrier: "header", name: "X-Token", prefix: "Bearer ", variable: "x_token" },
          { carrier: "query", name: "team_id", variable: "team_id" },
        ],
      },
    ]);
  });

  it("builds a query method from a query placement (the ui.sh '?token=' case)", () => {
    expect(
      mcpAuthMethodInputsFromPlacements([{ carrier: "query", name: "token", prefix: "" }]),
    ).toEqual([{ kind: "apikey", placements: [{ carrier: "query", name: "token" }] }]);
  });

  it("skips unnamed placements", () => {
    expect(
      mcpAuthMethodInputsFromPlacements([
        { carrier: "query", name: "", prefix: "" },
        { carrier: "query", name: "token", prefix: "" },
      ]),
    ).toEqual([{ kind: "apikey", placements: [{ carrier: "query", name: "token" }] }]);
  });

  it("is empty when no placement has a usable name", () => {
    expect(
      mcpAuthMethodInputsFromPlacements([{ carrier: "query", name: "  ", prefix: "" }]),
    ).toEqual([]);
  });
});