// Cross-target: connecting a SECOND account to the same integration must ADD a
// distinct connection, never silently overwrite the first. This is the exact
// data-loss bug that shipped — a human label like "Work Gmail" reaches
// `oauth.start` as the client-derived "workGmail", the mint stored the
// `connectionIdentifier` form, and the free-name guard compared the
// un-re-normalized name case-sensitively, missed the existing row, and the
// second connect re-minted (overwrote) the first account instead of resolving
// to a suffixed name.
//
// The journey: one OpenAPI integration with a single OAuth method; run the
// real authorization-code flow TWICE with `newConnection: true`, using a raw
// human label the client would type (not an already-normalized name). The
// first connect mints `workGmail`; the second must resolve to `workGmail2`,
// and the typed connections API must show BOTH rows persisting.
import { randomBytes } from "node:crypto";
import { createServer } from "node:http";

import { expect } from "@effect/vitest";
import { Effect } from "effect";
import { composePluginApi } from "@executor-js/api/server";
import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
import {
  AuthTemplateSlug,
  ConnectionName,
  IntegrationSlug,
  OAuthClientSlug,
} from "@executor-js/sdk/shared";
import { serveOAuthTestServer } from "@executor-js/sdk/testing";

import { scenario } from "../src/scenario";
import { Api, Target } from "../src/services";

const api = composePluginApi([openApiHttpPlugin()] as const);

const unique = (prefix: string) => `${prefix}_${randomBytes(4).toString("hex")}`;

/** A trivial upstream on 127.0.0.1: `GET /me` is 200 for any bearer. It exists
 *  only to give the OpenAPI integration a `servers` base URL — the guarantee
 *  under test is about connection identity, not the dispatched call. */
const serveUpstream = () =>
  Effect.acquireRelease(
    Effect.callback<{ readonly url: string; readonly close: () => void }>((resume) => {
      const server = createServer((request, response) => {
        if (request.method === "GET" && (request.url ?? "").startsWith("/me")) {
          response.writeHead(200, { "content-type": "application/json" });
          response.end(JSON.stringify({ ok: true }));
          return;
        }
        response.writeHead(404, { "content-type": "application/json" });
        response.end(JSON.stringify({ error: "not_found" }));
      });
      server.listen(0, "127.0.0.1", () => {
        const address = server.address();
        const port = typeof address === "object" && address ? address.port : 0;
        resume(
          Effect.succeed({
            url: `http://127.0.0.1:${port}`,
            close: () => {
              server.close();
              server.closeAllConnections();
            },
          }),
        );
      });
    }),
    (server) => Effect.sync(server.close),
  );

const spec = (
  baseUrl: string,
  oauth: { readonly authorizationEndpoint: string; readonly tokenEndpoint: string },
): string =>
  JSON.stringify({
    openapi: "3.0.3",
    info: { title: "Mail API", version: "1.0.0" },
    servers: [{ url: baseUrl }],
    paths: {
      "/me": {
        get: {
          operationId: "readMe",
          summary: "Read the authenticated profile",
          security: [{ oauth: ["email"] }],
          responses: { "200": { description: "ok" } },
        },
      },
    },
    components: {
      securitySchemes: {
        oauth: {
          type: "oauth2",
          flows: {
            authorizationCode: {
              authorizationUrl: oauth.authorizationEndpoint,
              tokenUrl: oauth.tokenEndpoint,
              scopes: { email: "Read email" },
            },
          },
        },
      },
    },
  });

scenario(
  "Connections · a second OAuth connect adds a distinct account instead of overwriting the first",
  {},
  Effect.scoped(
    Effect.gen(function* () {
      const target = yield* Target;
      const { client: makeClient } = yield* Api;
      const identity = yield* target.newIdentity();
      const client = yield* makeClient(api, identity);
      const upstream = yield* serveUpstream();
      const oauth = yield* serveOAuthTestServer({ scopes: ["email"] });
      const slug = IntegrationSlug.make(unique("oauth2nd"));
      const clientSlug = OAuthClientSlug.make(unique("oauth2ndc"));

      // Run the whole authorization-code flow end to end for a requested name.
      // The mint normalizes the name; the free-name guard must compare against
      // that same normalized form, so a repeat call resolves to a suffix.
      const connect = (requestedName: string) =>
        Effect.gen(function* () {
          const started = yield* client.oauth.start({
            payload: {
              client: clientSlug,
              clientOwner: "org",
              owner: "org",
              name: ConnectionName.make(requestedName),
              integration: slug,
              template: AuthTemplateSlug.make("oauth"),
              newConnection: true,
            },
          });
          expect(started.status, "oauth.start redirects to the authorization server").toBe(
            "redirect",
          );
          if (started.status !== "redirect") return yield* Effect.die("no redirect");

          // Drive the test IdP's consent by hand (authorize -> login -> code).
          // Plain fetch with manual redirects is the e2e-proven path: the
          // Effect HttpClient's manual-redirect layer is overridden by the
          // scenario runtime and silently follows the hop to the login page.
          const code = yield* Effect.promise(async () => {
            const authorize = await fetch(started.authorizationUrl, { redirect: "manual" });
            const loginUrl = authorize.headers.get("location");
            if (!loginUrl) throw new Error(`authorize did not redirect: ${authorize.status}`);
            const login = await fetch(loginUrl, {
              method: "POST",
              headers: {
                authorization: `Basic ${Buffer.from("alice:password").toString("base64")}`,
              },
              redirect: "manual",
            });
            const callbackUrl = login.headers.get("location");
            if (!callbackUrl) throw new Error(`login did not redirect: ${login.status}`);
            const minted = new URL(callbackUrl).searchParams.get("code");
            if (!minted) throw new Error("callback carried no authorization code");
            return minted;
          });
          // `complete` returns the minted connection projection directly.
          const connection = yield* client.oauth.complete({
            payload: { state: started.state, code },
          });
          return String(connection.name);
        });

      yield* Effect.ensuring(
        Effect.gen(function* () {
          yield* client.openapi.addSpec({
            payload: {
              spec: { kind: "blob", value: spec(upstream.url, oauth) },
              slug,
              baseUrl: upstream.url,
              authenticationTemplate: [
                {
                  slug: "oauth",
                  kind: "oauth2",
                  authorizationUrl: oauth.authorizationEndpoint,
                  tokenUrl: oauth.tokenEndpoint,
                  scopes: ["email"],
                },
              ],
            },
          });
          yield* client.oauth.createClient({
            payload: {
              owner: "org",
              slug: clientSlug,
              grant: "authorization_code",
              authorizationUrl: oauth.authorizationEndpoint,
              tokenUrl: oauth.tokenEndpoint,
              clientId: "test-client",
              clientSecret: "test-secret",
              originIntegration: slug,
            },
          });

          // A raw human label the client would type — NOT an already-normalized
          // name. Before the fix, the second connect overwrote the first row.
          const first = yield* connect("Work Gmail");
          const second = yield* connect("Work Gmail");
          expect(first, "the first account is stored under the normalized name").toBe("workGmail");
          expect(second, "the second account resolves to a distinct suffixed name").toBe(
            "workGmail2",
          );

          // The typed API is the black-box proof: both rows persist. Selfhost
          // shares one workspace, so assert "contains mine", not exact length.
          const connections = yield* client.connections.list({ query: { integration: slug } });
          const names = connections.map((connection) => String(connection.name));
          expect(names, "both OAuth accounts persist as distinct connections").toEqual(
            expect.arrayContaining(["workGmail", "workGmail2"]),
          );
        }),
        // Best-effort cleanup even on failure: drop both connections, then the
        // integration — a mid-test failure must not leak state into selfhost.
        Effect.gen(function* () {
          for (const name of ["workGmail", "workGmail2"]) {
            yield* client.connections
              .remove({
                params: {
                  owner: "org",
                  integration: slug,
                  name: ConnectionName.make(name),
                },
              })
              .pipe(Effect.ignore);
          }
          yield* client.openapi.removeSpec({ params: { slug } }).pipe(Effect.ignore);
        }),
      );
    }),
  ),
);