import { describe, expect, it } from "@effect/vitest";
import {
  AuthTemplateSlug,
  ConnectionAddress,
  ConnectionName,
  IntegrationSlug,
  ProviderKey,
  type Connection,
  type HealthCheckResult,
} from "@executor-js/sdk/shared";

import { connectionRowPolicy } from "./managed-connection";

const connection = (overrides: Partial<Connection> = {}): Connection => ({
  owner: "org",
  integration: IntegrationSlug.make("linear_mcp"),
  name: ConnectionName.make("main"),
  template: AuthTemplateSlug.make("oauth2"),
  provider: ProviderKey.make("default"),
  address: ConnectionAddress.make("linear_mcp.org.main"),
  ...overrides,
});

const health = (overrides: Partial<HealthCheckResult> = {}): HealthCheckResult => ({
  status: "healthy",
  checkedAt: 0,
  ...overrides,
});

describe("connectionRowPolicy", () => {
  it("offers Remove and Reconnect on an ordinary connection", () => {
    const policy = connectionRowPolicy(connection(), health());
    expect(policy).toMatchObject({ managed: false, canRemove: true, canReconnect: true });
  });

  it("withholds Remove on an enterprise-managed connection", () => {
    // There is nothing local to delete: renewal re-runs the ID-JAG chain from
    // the stored assertion, so a row that vanished would claim a revocation
    // that did not happen — the provider still authorizes the member.
    expect(connectionRowPolicy(connection({ enterpriseManaged: true }), health()).canRemove).toBe(
      false,
    );
  });

  it("withholds Reconnect on an enterprise-managed connection", () => {
    // Reconnect exists to re-consent through the browser. This profile has no
    // consent step, and the console holds no identity assertion to present.
    expect(
      connectionRowPolicy(connection({ enterpriseManaged: true }), health()).canReconnect,
    ).toBe(false);
  });

  it("withholds Reconnect from an ORDINARY connection an administrator blocked", () => {
    // The interactive flow is exactly the route the identity provider just
    // closed; offering it would route the user around the decision.
    const policy = connectionRowPolicy(
      connection(),
      health({ status: "expired", blockedByAdmin: true }),
    );
    expect(policy.canReconnect).toBe(false);
    // Removing an ordinary connection is still the member's own call.
    expect(policy.canRemove).toBe(true);
  });

  it("reads the administrator verdict from the field, never the status word", () => {
    expect(connectionRowPolicy(connection(), health({ status: "expired" })).blockedByAdmin).toBe(
      false,
    );
  });

  it("surfaces the provider's code only while the block stands", () => {
    expect(
      connectionRowPolicy(
        connection(),
        health({ blockedByAdmin: true, oauthErrorCode: "invalid_target" }),
      ).oauthErrorCode,
    ).toBe("invalid_target");
    // A code left over from some other refusal is not an administrator
    // decision, and must not be presented as one.
    expect(
      connectionRowPolicy(connection(), health({ oauthErrorCode: "invalid_grant" })).oauthErrorCode,
    ).toBeNull();
  });

  it("treats a never-checked connection as unblocked", () => {
    expect(connectionRowPolicy(connection({ enterpriseManaged: true }), null)).toMatchObject({
      managed: true,
      blockedByAdmin: false,
      oauthErrorCode: null,
    });
  });

  it("does not infer managed state from an absent field", () => {
    // `enterpriseManaged` is projected server-side from the connection's
    // persisted state. An older row that carries nothing is ordinary, not
    // ambiguous.
    expect(connectionRowPolicy(connection(), undefined).managed).toBe(false);
  });
});