/* oxlint-disable executor/no-error-constructor, executor/no-try-catch-or-throw -- test fake throws on an unexpected query to catch wiring drift */

import { describe, expect, it } from "@effect/vitest";
import { Effect } from "effect";

import { gcDeadDcrOAuthClientsMigration } from "../../scripts/code-migrations/gc-dead-dcr-oauth-clients";
import type { CodeMigrationContext, CodeMigrationSql } from "../../scripts/code-migrations/runner";

// Cloud counterpart of the local libSQL GC migration test. A small in-memory
// fake models the SQL shapes the migration issues (the oauth_client SELECT, the
// single GROUPED connection-count query, and the DELETE/UPDATE mutations) so the
// same shared decision matrix is proven end-to-end over the Postgres wiring.

interface OAuthClientRow {
  readonly tenant: string;
  readonly owner: string;
  readonly slug: string;
  readonly grant: string | null;
  readonly resource: string | null;
  readonly origin_kind: string | null;
  readonly origin_issuer: string | null;
  readonly token_url: string | null;
}

const makeFake = (input: {
  rows: OAuthClientRow[];
  /** connection count keyed by `${tenant}|${owner}|${slug}`. */
  readonly references: Record<string, number>;
}) => {
  const deletes: string[] = [];
  const updates: { slug: string; issuer: string }[] = [];
  const stamps: { slug: string; kind: string }[] = [];

  const sql: CodeMigrationSql = {
    unsafe: (query: string, params?: readonly unknown[]) => {
      const q = query.trim();
      if (q.startsWith("SELECT") && q.includes("FROM oauth_client")) {
        return Promise.resolve(input.rows as never);
      }
      if (q.startsWith("SELECT") && q.includes("FROM connection")) {
        // One grouped pass: emit a row per referenced (tenant, owner, slug).
        const grouped = Object.entries(input.references).map(([composite, count]) => {
          const [tenant, owner, slug] = composite.split("|");
          return { tenant, oauth_client_owner: owner, oauth_client: slug, count };
        });
        return Promise.resolve(grouped as never);
      }
      if (q.startsWith("DELETE FROM oauth_client")) {
        const [tenant, owner, slug] = params as [string, string, string];
        input.rows = input.rows.filter(
          (r) => !(r.tenant === tenant && r.owner === owner && r.slug === slug),
        );
        deletes.push(slug);
        return Promise.resolve([] as never);
      }
      if (q.startsWith("UPDATE oauth_client")) {
        // The slug is always the last positional param. The DCR-survivor UPDATE
        // may set origin_issuer (an `origin_issuer = $N` clause with the issuer
        // as its first param) and/or stamp origin_kind (a literal in the SQL).
        const args = (params ?? []) as readonly string[];
        const slug = args[args.length - 1];
        if (q.includes("origin_kind = 'manual'")) {
          stamps.push({ slug, kind: "manual" });
        }
        if (q.includes("origin_kind = 'dynamic_client_registration'")) {
          stamps.push({ slug, kind: "dynamic_client_registration" });
        }
        if (q.includes("origin_issuer =")) {
          updates.push({ slug, issuer: args[0] });
        }
        return Promise.resolve([] as never);
      }
      throw new Error(`unexpected query: ${q}`);
    },
  };

  return { sql, deletes, updates, stamps, rowsRef: () => input.rows };
};

const row = (over: Partial<OAuthClientRow> & { readonly slug: string }): OAuthClientRow => ({
  tenant: "t1",
  owner: "org",
  slug: over.slug,
  grant: over.grant ?? "authorization_code",
  resource: over.resource ?? null,
  origin_kind: over.origin_kind ?? null,
  origin_issuer: over.origin_issuer ?? null,
  token_url: over.token_url ?? "https://oauth.cloudflare.com/token",
});

const runMigration = (
  fake: ReturnType<typeof makeFake>,
  dryRun: boolean,
): Promise<{ readonly summary: string }> => {
  const context: CodeMigrationContext = { sql: fake.sql, dryRun, log: () => {} };
  return gcDeadDcrOAuthClientsMigration.run(context);
};

describe("gcDeadDcrOAuthClientsMigration", () => {
  it.effect("deletes orphaned DCR, keeps manual + referenced, backfills survivors", () =>
    Effect.promise(async () => {
      const fake = makeFake({
        rows: [
          row({
            slug: "dcr-cloudflare-com",
            resource: "https://cf.example/mcp",
            origin_kind: "dynamic_client_registration",
            origin_issuer: "https://cloudflare.com",
          }),
          row({ slug: "cloudflare-mcp-2", resource: "https://cf.example/mcp" }),
          row({ slug: "cloudflare-mcp", resource: "https://cf.example/mcp" }),
          row({
            slug: "my-github-app",
            token_url: "https://github.com/login/oauth/access_token",
            origin_kind: "manual",
          }),
        ],
        references: { "t1|org|cloudflare-mcp": 1 },
      });

      const result = await runMigration(fake, false);

      expect(fake.deletes.sort()).toEqual(["cloudflare-mcp-2", "dcr-cloudflare-com"]);
      expect(fake.updates).toEqual([{ slug: "cloudflare-mcp", issuer: "https://cloudflare.com" }]);
      // The surviving legacy DCR row gets an explicit DCR stamp; the already
      // explicitly-stamped manual app is never restamped.
      expect(fake.stamps).toEqual([
        { slug: "cloudflare-mcp", kind: "dynamic_client_registration" },
      ]);
      expect(
        fake
          .rowsRef()
          .map((r) => r.slug)
          .sort(),
      ).toEqual(["cloudflare-mcp", "my-github-app"]);
      expect(result.summary).toContain("deleted 2 orphaned DCR client(s)");
      expect(result.summary).toContain("backfilled 1 of 1 referenced DCR client(s)");
      expect(result.summary).toContain("stamped 1 legacy row(s) (1 dcr, 0 manual)");
    }),
  );

  it.effect("stamps a legacy null-origin manual survivor as manual with no issuer", () =>
    Effect.promise(async () => {
      const fake = makeFake({
        rows: [
          // Legacy manual row: null origin_kind, auth-code, NO resource → manual.
          row({
            slug: "legacy-manual",
            token_url: "https://github.com/login/oauth/access_token",
            resource: null,
          }),
        ],
        references: {},
      });

      const result = await runMigration(fake, false);

      expect(fake.deletes).toEqual([]);
      expect(fake.updates).toEqual([]);
      expect(fake.stamps).toEqual([{ slug: "legacy-manual", kind: "manual" }]);
      expect(fake.rowsRef().map((r) => r.slug)).toEqual(["legacy-manual"]);
      expect(result.summary).toContain("stamped 1 legacy row(s) (0 dcr, 1 manual)");
    }),
  );

  it.effect("dry run mutates nothing but reports the plan", () =>
    Effect.promise(async () => {
      const fake = makeFake({
        rows: [
          row({ slug: "cloudflare-mcp-2", resource: "https://cf.example/mcp" }),
          row({ slug: "cloudflare-mcp", resource: "https://cf.example/mcp" }),
        ],
        references: { "t1|org|cloudflare-mcp": 1 },
      });

      const result = await runMigration(fake, true);

      expect(fake.deletes).toEqual([]);
      expect(fake.updates).toEqual([]);
      expect(fake.stamps).toEqual([]);
      expect(fake.rowsRef()).toHaveLength(2);
      expect(result.summary).toContain("would delete 1 orphaned DCR client(s)");
      expect(result.summary).toContain("would backfill 1 of 1 referenced DCR client(s)");
      // The referenced legacy DCR survivor WOULD be stamped, counted but not
      // written.
      expect(result.summary).toContain("would stamp 1 legacy row(s) (1 dcr, 0 manual)");
    }),
  );

  it.effect("never deletes a manual app even when orphaned and MCP-shaped", () =>
    Effect.promise(async () => {
      const fake = makeFake({
        rows: [
          row({
            slug: "cloudflare-mcp",
            resource: "https://cf.example/mcp",
            origin_kind: "manual",
          }),
        ],
        references: {},
      });
      await runMigration(fake, false);
      expect(fake.deletes).toEqual([]);
      expect(fake.rowsRef().map((r) => r.slug)).toEqual(["cloudflare-mcp"]);
    }),
  );
});