// Cross-target: multi-method authentication — an integration declares SEVERAL
// auth methods and a connection picks one by template slug. Covers the unified
// placements model: one apikey method can mix header and query placements,
// each rendered from its own credential input; the merge-append configureAuth
// flow (a custom API key must never displace a detected OAuth method);
// declaring a method on a server that advertises none; GraphQL's multi-method
// add — and the EXTREME case end-to-end: an integration declaring
// [oauth] [bearer header + team-id query] [bearer header] [query token],
// one connection per credential method, every invocation asserted against
// what a real recording MCP server received.
import { randomBytes } from "node:crypto";

import { expect } from "@effect/vitest";
import { Effect } from "effect";
import { composePluginApi } from "@executor-js/api/server";
import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api";
import { makeEchoMcpServer, serveMcpServer } from "@executor-js/plugin-mcp/testing";
import { graphqlHttpPlugin } from "@executor-js/plugin-graphql/api";
import { AuthTemplateSlug, ConnectionName, IntegrationSlug } from "@executor-js/sdk/shared";

import { variable } from "@executor-js/sdk/http-auth";

import { scenario } from "../src/scenario";
import { Api, Mcp, Target } from "../src/services";

const api = composePluginApi([mcpHttpPlugin(), graphqlHttpPlugin()] as const);

const freshSlug = (prefix: string): string => `${prefix}_${randomBytes(4).toString("hex")}`;

// Registration never dials the endpoint, so a closed local port is fine for
// the catalog-only scenarios.
const MCP_ENDPOINT = "http://127.0.0.1:59998/mcp";

scenario(
  "Auth methods · an MCP server can declare OAuth and an API key side by side",
  {},
  Effect.gen(function* () {
    const target = yield* Target;
    const { client: makeApiClient } = yield* Api;
    const identity = yield* target.newIdentity();
    const client = yield* makeApiClient(api, identity);
    const slug = freshSlug("mcp_multiauth");

    yield* client.mcp.addServer({
      payload: {
        transport: "remote",
        name: "Multi-auth MCP",
        endpoint: MCP_ENDPOINT,
        slug,
        authenticationTemplate: [
          { kind: "oauth2" },
          { type: "apiKey", headers: { "X-Api-Key": ["Bearer ", variable("token")] } },
        ],
      },
    });

    yield* Effect.gen(function* () {
      const integration = yield* client.integrations.get({
        params: { slug: IntegrationSlug.make(slug) },
      });

      // Both methods project into the catalog (a slug-less single-header
      // apikey method gets the carrier-derived `header` slug), so the
      // connect flow can offer either and a connection binds one by slug.
      expect(
        integration.authMethods.map((m) => ({ kind: m.kind, template: m.template })),
        "the catalog lists both declared methods",
      ).toEqual([
        { kind: "oauth", template: "oauth2" },
        { kind: "apikey", template: "header" },
      ]);

      const apiKey = integration.authMethods.find((m) => m.kind === "apikey");
      expect(apiKey?.placements, "the API key method carries its header placement").toEqual([
        { carrier: "header", name: "X-Api-Key", prefix: "Bearer " },
      ]);
    }).pipe(
      Effect.ensuring(
        client.mcp
          .removeServer({ params: { slug: IntegrationSlug.make(slug) } })
          .pipe(Effect.ignore),
      ),
    );
  }),
);

scenario(
  "Auth methods · adding an API key method keeps a detected OAuth method",
  {},
  Effect.gen(function* () {
    const target = yield* Target;
    const { client: makeApiClient } = yield* Api;
    const identity = yield* target.newIdentity();
    const client = yield* makeApiClient(api, identity);
    const slug = freshSlug("mcp_oauth_plus_key");

    // The add flow registered what the probe detected: OAuth only.
    yield* client.mcp.addServer({
      payload: {
        transport: "remote",
        name: "OAuth MCP",
        endpoint: MCP_ENDPOINT,
        slug,
        authenticationTemplate: [{ kind: "oauth2" }],
      },
    });

    yield* Effect.gen(function* () {
      // "+ Custom method" merge-appends — it must not displace OAuth.
      const configured = yield* client.mcp.configureAuth({
        params: { slug: IntegrationSlug.make(slug) },
        payload: {
          authenticationTemplate: [
            { type: "apiKey", headers: { "X-Api-Key": [variable("token")] } },
          ],
        },
      });
      expect(
        configured.authenticationTemplate.map((m) => m.kind),
        "the declared set now holds both methods",
      ).toEqual(["oauth2", "apikey"]);
      expect(
        configured.authenticationTemplate[1]?.slug,
        "the custom method gets its own custom_ slug",
      ).toMatch(/^custom_/);

      const integration = yield* client.integrations.get({
        params: { slug: IntegrationSlug.make(slug) },
      });
      expect(
        integration.authMethods.map((m) => m.kind),
        "the catalog offers OAuth and the API key",
      ).toEqual(["oauth", "apikey"]);
    }).pipe(
      Effect.ensuring(
        client.mcp
          .removeServer({ params: { slug: IntegrationSlug.make(slug) } })
          .pipe(Effect.ignore),
      ),
    );
  }),
);

scenario(
  "Auth methods · a no-auth MCP server can declare an API key method later",
  {},
  Effect.gen(function* () {
    const target = yield* Target;
    const { client: makeApiClient } = yield* Api;
    const identity = yield* target.newIdentity();
    const client = yield* makeApiClient(api, identity);
    const slug = freshSlug("mcp_open_plus_key");

    // No declared auth — the server advertises nothing.
    yield* client.mcp.addServer({
      payload: { transport: "remote", name: "Open MCP", endpoint: MCP_ENDPOINT, slug },
    });

    yield* Effect.gen(function* () {
      const before = yield* client.integrations.get({
        params: { slug: IntegrationSlug.make(slug) },
      });
      expect(
        before.authMethods.map((m) => m.kind),
        "an open server starts with the no-auth method",
      ).toEqual(["none"]);

      yield* client.mcp.configureAuth({
        params: { slug: IntegrationSlug.make(slug) },
        payload: {
          authenticationTemplate: [
            { type: "apiKey", headers: { Authorization: ["Bearer ", variable("token")] } },
          ],
        },
      });

      const after = yield* client.integrations.get({
        params: { slug: IntegrationSlug.make(slug) },
      });
      expect(
        after.authMethods.map((m) => m.kind),
        "no-auth and the declared API key coexist",
      ).toEqual(["none", "apikey"]);
    }).pipe(
      Effect.ensuring(
        client.mcp
          .removeServer({ params: { slug: IntegrationSlug.make(slug) } })
          .pipe(Effect.ignore),
      ),
    );
  }),
);

scenario(
  "Auth methods · a GraphQL integration registers multiple auth methods at add time",
  {},
  Effect.gen(function* () {
    const target = yield* Target;
    const { client: makeApiClient } = yield* Api;
    const identity = yield* target.newIdentity();
    const client = yield* makeApiClient(api, identity);
    const slug = freshSlug("graphql_multiauth");

    yield* client.graphql.addIntegration({
      payload: {
        endpoint: "http://127.0.0.1:59998/graphql",
        slug,
        name: "Multi-auth GraphQL",
        authenticationTemplate: [
          { slug: "apiKey", type: "apiKey", headers: { "X-Api-Key": [variable("token")] } },
          { slug: "apikey-2", type: "apiKey", queryParams: { api_key: [variable("token")] } },
        ],
      },
    });

    yield* Effect.gen(function* () {
      const integration = yield* client.integrations.get({
        params: { slug: IntegrationSlug.make(slug) },
      });
      expect(
        integration.authMethods.map((m) => ({ template: m.template, kind: m.kind })),
        "both declared methods are in the catalog",
      ).toEqual([
        { template: "apiKey", kind: "apikey" },
        { template: "apikey-2", kind: "apikey" },
      ]);
      expect(
        integration.authMethods[1]?.placements,
        "the second method carries its query placement",
      ).toEqual([{ carrier: "query", name: "api_key", prefix: "" }]);
    }).pipe(
      Effect.ensuring(
        client.integrations
          .remove({ params: { slug: IntegrationSlug.make(slug) } })
          .pipe(Effect.ignore),
      ),
    );
  }),
);

// ---------------------------------------------------------------------------
// THE EXTREME CASE — one integration, four methods, three live connections, every
// invocation asserted against what the server actually received:
//   [oauth2]                              (declared; connect flow not exercised here)
//   [bearer header + team-id query]      (TWO inputs on ONE method)
//   [bearer header]                      (single input)
//   [auth-token query param]             (single input, the ui.sh shape)
// ---------------------------------------------------------------------------

scenario(
  "Auth methods · one integration mixes oauth, a 2-input header+query method, a bearer header, and a query token",
  {},
  Effect.scoped(
    Effect.gen(function* () {
      const target = yield* Target;
      const { client: makeApiClient } = yield* Api;
      const mcp = yield* Mcp;
      const identity = yield* target.newIdentity();
      const client = yield* makeApiClient(api, identity);
      const slug = freshSlug("mcp_extreme");

      // A real MCP server that records every request it receives.
      const server = yield* serveMcpServer(() =>
        makeEchoMcpServer({
          name: "extreme-auth",
          toolName: "whoami",
          toolDescription: "Echoes a marker so the test can prove the invoke reached the server",
          inputName: "marker",
          text: (marker) => `ok:${marker}`,
        }),
      );

      yield* client.mcp.addServer({
        payload: {
          transport: "remote",
          name: "Extreme auth MCP",
          endpoint: server.url,
          slug,
          authenticationTemplate: [
            { kind: "oauth2" },
            {
              slug: "token_and_team",
              type: "apiKey",
              headers: { Authorization: ["Bearer ", variable("api_token")] },
              queryParams: { team_id: [variable("team_id")] },
            },
            {
              slug: "bearer",
              type: "apiKey",
              headers: { Authorization: ["Bearer ", variable("token")] },
            },
            {
              slug: "query_token",
              type: "apiKey",
              queryParams: { auth_token: [variable("token")] },
            },
          ],
        },
      });

      yield* Effect.gen(function* () {
        // All four methods project into the catalog, the 2-input method with
        // both placements and their distinct variables (what drives the two
        // credential fields in the connect modal).
        const integration = yield* client.integrations.get({
          params: { slug: IntegrationSlug.make(slug) },
        });
        expect(
          integration.authMethods.map((m) => ({ kind: m.kind, template: m.template })),
          "the catalog lists all four methods",
        ).toEqual([
          { kind: "oauth", template: "oauth2" },
          { kind: "apikey", template: "token_and_team" },
          { kind: "apikey", template: "bearer" },
          { kind: "apikey", template: "query_token" },
        ]);
        expect(
          integration.authMethods[1]?.placements,
          "the 2-input method carries both placements with their variables",
        ).toEqual([
          { carrier: "header", name: "Authorization", prefix: "Bearer ", variable: "api_token" },
          { carrier: "query", name: "team_id", prefix: "", variable: "team_id" },
        ]);

        // One connection per credential method. The 2-input method takes a
        // `values` map (one entry per placement variable).
        yield* client.connections.create({
          payload: {
            owner: "org",
            name: ConnectionName.make("mixed"),
            integration: IntegrationSlug.make(slug),
            template: AuthTemplateSlug.make("token_and_team"),
            values: { api_token: "tok_mixed", team_id: "team_42" },
          },
        });
        yield* client.connections.create({
          payload: {
            owner: "org",
            name: ConnectionName.make("bearer"),
            integration: IntegrationSlug.make(slug),
            template: AuthTemplateSlug.make("bearer"),
            value: "tok_bearer",
          },
        });
        yield* client.connections.create({
          payload: {
            owner: "org",
            name: ConnectionName.make("token"),
            integration: IntegrationSlug.make(slug),
            template: AuthTemplateSlug.make("query_token"),
            value: "tok_query",
          },
        });

        // Discovery dialed the server per connection; every connection
        // produced its own addressed tool.
        const tools = yield* client.tools.list({ query: {} });
        const names = tools
          .filter((tool) => String(tool.integration) === slug)
          .map((tool) => String(tool.address));
        for (const conn of ["mixed", "bearer", "token"]) {
          expect(names, `connection "${conn}" resolved the server's tool`).toContain(
            `tools.${slug}.org.${conn}.whoami`,
          );
        }

        // Invoke through the MCP surface (the real agent path: execute runs
        // sandbox code that calls the addressed tool), then assert the WIRE:
        // what the recording server received for each connection.
        const session = mcp.session(identity);

        const invokeAndCapture = (conn: string, marker: string) =>
          Effect.gen(function* () {
            const before = (yield* server.requests).length;
            const result = yield* session.call("execute", {
              // Return the whole result — the assertion only needs the echoed
              // marker to prove the call reached the server.
              code: `return JSON.stringify(await tools.${slug}.org.${conn}.whoami({ marker: ${JSON.stringify(marker)} }));`,
            });
            expect(result.text, `the ${conn} invocation reached the server`).toContain(
              `ok:${marker}`,
            );
            return (yield* server.requests).slice(before);
          });

        const mixedRequests = yield* invokeAndCapture("mixed", "m1");
        expect(
          mixedRequests.every((r) => r.authorization === "Bearer tok_mixed"),
          "the 2-input method rendered its bearer header",
        ).toBe(true);
        expect(
          mixedRequests.every((r) => r.url.includes("team_id=team_42")),
          "…and its team-id query param, from the second input",
        ).toBe(true);

        const bearerRequests = yield* invokeAndCapture("bearer", "b1");
        expect(
          bearerRequests.every((r) => r.authorization === "Bearer tok_bearer"),
          "the bearer method rendered only its header",
        ).toBe(true);
        expect(
          bearerRequests.every(
            (r) => !r.url.includes("team_id=") && !r.url.includes("auth_token="),
          ),
          "…with no query credential bleeding in from sibling methods",
        ).toBe(true);

        const queryRequests = yield* invokeAndCapture("token", "q1");
        expect(
          queryRequests.every((r) => r.url.includes("auth_token=tok_query")),
          "the query method rendered its token param",
        ).toBe(true);
        expect(
          queryRequests.every((r) => r.authorization === undefined),
          "…and no Authorization header",
        ).toBe(true);
      }).pipe(
        Effect.ensuring(
          Effect.gen(function* () {
            for (const name of ["mixed", "bearer", "token"]) {
              yield* client.connections
                .remove({
                  params: {
                    owner: "org",
                    integration: IntegrationSlug.make(slug),
                    name: ConnectionName.make(name),
                  },
                })
                .pipe(Effect.ignore);
            }
            yield* client.mcp
              .removeServer({ params: { slug: IntegrationSlug.make(slug) } })
              .pipe(Effect.ignore);
          }),
        ),
      );
    }),
  ),
);