import { describe, expect, it } from "@effect/vitest";
import { OAuthClientSlug, type OAuthClientSummary } from "@executor-js/sdk/shared";

import {
  ENTERPRISE_IDENTITY_PROVIDER_CLIENT_OWNER,
  ENTERPRISE_IDENTITY_PROVIDER_CLIENT_SLUG,
  ENTERPRISE_IDENTITY_PROVIDER_DESCRIPTOR,
  canSubmitEnterpriseIdentityProvider,
  enterpriseIdentityProviderPayload,
  findEnterpriseIdentityProvider,
} from "./enterprise-idp-section";

const client = (overrides: Partial<OAuthClientSummary>): OAuthClientSummary => ({
  owner: "org",
  slug: OAuthClientSlug.make("some-app"),
  grant: "authorization_code",
  authorizationUrl: "https://example.com/authorize",
  tokenUrl: "https://example.com/token",
  clientId: "client-id",
  origin: { kind: "manual" },
  ...overrides,
});

describe("findEnterpriseIdentityProvider", () => {
  it("finds the workspace registration under the reserved slug", () => {
    const provider = client({ slug: ENTERPRISE_IDENTITY_PROVIDER_CLIENT_SLUG });
    expect(findEnterpriseIdentityProvider([client({}), provider])).toBe(provider);
  });

  it("returns null when the organization has registered none", () => {
    expect(findEnterpriseIdentityProvider([client({})])).toBeNull();
  });

  it("ignores a personal app that happens to carry the reserved slug", () => {
    // The provider is an ORGANIZATION control; a user-owned app under the same
    // slug is a different app and must never stand in for it.
    expect(
      findEnterpriseIdentityProvider([
        client({ owner: "user", slug: ENTERPRISE_IDENTITY_PROVIDER_CLIENT_SLUG }),
      ]),
    ).toBeNull();
  });
});

describe("canSubmitEnterpriseIdentityProvider", () => {
  const valid = {
    submitting: false,
    issuerUrl: "https://idp.example/oauth2/default",
    clientId: "abc",
  };

  it("accepts a public client with no secret", () => {
    expect(canSubmitEnterpriseIdentityProvider(valid)).toBe(true);
  });

  it("requires the issuer the endpoints are discovered from", () => {
    // Endpoints are never typed: they are probed off the issuer, so the issuer
    // is the field the registration cannot proceed without.
    expect(canSubmitEnterpriseIdentityProvider({ ...valid, issuerUrl: "   " })).toBe(false);
  });

  it("requires the client id the exchange authenticates as", () => {
    expect(canSubmitEnterpriseIdentityProvider({ ...valid, clientId: "" })).toBe(false);
  });

  it("refuses a second submit while one is in flight", () => {
    expect(canSubmitEnterpriseIdentityProvider({ ...valid, submitting: true })).toBe(false);
  });
});

describe("enterpriseIdentityProviderPayload", () => {
  const discovered = {
    authorizationUrl: "  https://idp.example/authorize  ",
    tokenUrl: "  https://idp.example/token  ",
  };

  it("registers the workspace-owned app under the reserved slug", () => {
    const payload = enterpriseIdentityProviderPayload({
      ...discovered,
      clientId: " abc ",
      clientSecret: " shh ",
    });
    expect(payload.owner).toBe(ENTERPRISE_IDENTITY_PROVIDER_CLIENT_OWNER);
    expect(String(payload.slug)).toBe(String(ENTERPRISE_IDENTITY_PROVIDER_CLIENT_SLUG));
    expect(payload.tokenUrl).toBe("https://idp.example/token");
    expect(payload.clientId).toBe("abc");
    expect(payload.clientSecret).toBe("shh");
  });

  it("records the authorization endpoint the work-identity link needs", () => {
    // The ID-JAG exchange itself only touches the token endpoint. The
    // authorization endpoint is here for the hop that produces the subject
    // token in the first place: an assertion issued BY this provider and
    // audienced to THIS client, which a brokered login does not yield.
    expect(
      enterpriseIdentityProviderPayload({ ...discovered, clientId: "abc", clientSecret: "" })
        .authorizationUrl,
    ).toBe("https://idp.example/authorize");
  });

  it("registers the authorization-code grant, not the enterprise grant", () => {
    // `id_jag` names the registration at an MCP server's authorization server.
    // THIS app is the registration at the identity provider — it authenticates
    // the exchange and runs the work-identity hop, both authorization-code
    // shaped.
    expect(
      enterpriseIdentityProviderPayload({ ...discovered, clientId: "abc", clientSecret: "" }).grant,
    ).toBe("authorization_code");
  });

  it("stamps no originating integration — it backs every managed server", () => {
    expect(
      enterpriseIdentityProviderPayload({ ...discovered, clientId: "abc", clientSecret: "" })
        .originIntegration,
    ).toBeNull();
  });
});

describe("ENTERPRISE_IDENTITY_PROVIDER_DESCRIPTOR", () => {
  it("names the same registration the section writes", () => {
    // A server declaration and a connect request both point at the provider by
    // (owner, slug). If this descriptor and the payload ever disagreed, every
    // managed server would name a registration that does not exist.
    expect(String(ENTERPRISE_IDENTITY_PROVIDER_DESCRIPTOR.client)).toBe(
      String(ENTERPRISE_IDENTITY_PROVIDER_CLIENT_SLUG),
    );
    expect(ENTERPRISE_IDENTITY_PROVIDER_DESCRIPTOR.clientOwner).toBe(
      ENTERPRISE_IDENTITY_PROVIDER_CLIENT_OWNER,
    );
  });
});