import { describe, expect, it } from "@effect/vitest";

import { authToolFailure } from "./auth-tool-failure";
import { detectInsufficientScope } from "./insufficient-scope";

describe("detectInsufficientScope", () => {
  it("detects Google's ErrorInfo reason nested in an error body", () => {
    const body = {
      error: {
        code: 403,
        message: "Request had insufficient authentication scopes.",
        status: "PERMISSION_DENIED",
        details: [
          {
            "@type": "type.googleapis.com/google.rpc.ErrorInfo",
            reason: "ACCESS_TOKEN_SCOPE_INSUFFICIENT",
            domain: "googleapis.com",
            metadata: { service: "drive.googleapis.com" },
          },
        ],
      },
    };
    expect(detectInsufficientScope({ body })).toEqual({ requiredScopes: [] });
  });

  it("detects the RFC 6750 error body", () => {
    expect(detectInsufficientScope({ body: { error: "insufficient_scope" } })).toEqual({
      requiredScopes: [],
    });
  });

  it("reads required scopes from a WWW-Authenticate challenge", () => {
    expect(
      detectInsufficientScope({
        body: null,
        headers: {
          "www-authenticate":
            'Bearer realm="example", error="insufficient_scope", scope="files.read files.meta"',
        },
      }),
    ).toEqual({ requiredScopes: ["files.read", "files.meta"] });
  });

  it("detects the signal inside a JSON text body", () => {
    expect(detectInsufficientScope({ body: '{"error":"insufficient_scope"}' })).toEqual({
      requiredScopes: [],
    });
  });

  it("never classifies non-JSON text, even when it embeds example JSON", () => {
    expect(
      detectInsufficientScope({
        body: "Proxy note: error=insufficient_scope was returned upstream",
      }),
    ).toBeNull();
    expect(
      detectInsufficientScope({
        body: 'The docs show {"error":"insufficient_scope"} as an example response',
      }),
    ).toBeNull();
  });

  it("ignores quoted challenge parameter values that embed the error token", () => {
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate":
            'Bearer error_description="Example: error=insufficient_scope for missing grants"',
        },
      }),
    ).toBeNull();
  });

  it("ignores prose that merely mentions the tokens", () => {
    expect(
      detectInsufficientScope({
        body: {
          error: {
            message:
              "If the token lacks access you may see insufficient_scope or ACCESS_TOKEN_SCOPE_INSUFFICIENT in provider docs",
          },
        },
      }),
    ).toBeNull();
    expect(
      detectInsufficientScope({
        body: "Consult the OAuth guide about insufficient_scope errors",
      }),
    ).toBeNull();
  });

  it("ignores the tokens under other field names and inside data lists", () => {
    expect(
      detectInsufficientScope({
        body: { supportedErrors: ["invalid_token", "insufficient_scope"] },
      }),
    ).toBeNull();
    expect(detectInsufficientScope({ body: { code: "insufficient_scope" } })).toBeNull();
  });

  it("ignores look-alike challenge parameters and values", () => {
    expect(
      detectInsufficientScope({
        headers: { "www-authenticate": 'Bearer x-error="insufficient_scope"' },
      }),
    ).toBeNull();
    expect(
      detectInsufficientScope({
        headers: { "www-authenticate": 'Bearer error="insufficient_scope_extra"' },
      }),
    ).toBeNull();
  });

  it("consumes quoted-pairs, so an escaped quote cannot fabricate a parameter", () => {
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate": 'Bearer error_description="Example: \\"error=insufficient_scope"',
        },
      }),
    ).toBeNull();
  });

  it("never discovers a scheme inside another challenge's quoted value", () => {
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate":
            'Basic error_description="Proxy saw Bearer error=insufficient_scope upstream"',
        },
      }),
    ).toBeNull();
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate":
            'Digest realm="x", qop="auth Bearer error=insufficient_scope", nonce="n"',
        },
      }),
    ).toBeNull();
    // A Basic challenge followed by a harmless real Bearer challenge: the
    // Bearer params are read, and they do not include the Basic params.
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate": 'Basic error=insufficient_scope, Bearer realm="api"',
        },
      }),
    ).toBeNull();
  });

  it("only reads the Bearer scheme's parameters", () => {
    expect(
      detectInsufficientScope({
        headers: { "www-authenticate": 'Basic realm="example", error=insufficient_scope' },
      }),
    ).toBeNull();
    // Multi-challenge: params after the NEXT scheme are not Bearer's.
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate": 'Bearer realm="api", Basic error=insufficient_scope',
        },
      }),
    ).toBeNull();
  });

  it("evaluates repeated Bearer challenges independently", () => {
    // The second Bearer challenge carries the signal; the first must not
    // shadow it (params are per challenge, not first-wins across the header).
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate":
            "Bearer error=invalid_token, Basic realm=x, Bearer error=insufficient_scope",
        },
      }),
    ).toEqual({ requiredScopes: [] });
    // And a scope attr from an unrelated Bearer challenge does not leak into
    // the one that matched.
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate": 'Bearer scope="other.scope", Bearer error=insufficient_scope',
        },
      }),
    ).toEqual({ requiredScopes: [] });
  });

  it("recognizes a new scheme only at a comma boundary", () => {
    // Comma-less run-ons are malformed and must not fabricate a Bearer
    // challenge out of a bare word.
    expect(
      detectInsufficientScope({
        headers: { "www-authenticate": "Basic realm=x Bearer error=insufficient_scope" },
      }),
    ).toBeNull();
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate": "Basic error_description=Proxy Bearer error=insufficient_scope",
        },
      }),
    ).toBeNull();
  });

  it("steps over a token68 blob to a later legitimate Bearer challenge", () => {
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate": "Negotiate abc/def==, Bearer error=insufficient_scope",
        },
      }),
    ).toEqual({ requiredScopes: [] });
  });

  it("never classifies malformed headers", () => {
    // Unterminated quoted-string.
    expect(
      detectInsufficientScope({
        headers: { "www-authenticate": 'Bearer error="insufficient_scope' },
      }),
    ).toBeNull();
    // Quoted value run into the next token with no separator.
    expect(
      detectInsufficientScope({
        headers: { "www-authenticate": 'Basic realm="x"Bearer error=insufficient_scope' },
      }),
    ).toBeNull();
  });

  it("accepts BWS around the auth-param equals sign", () => {
    for (const header of [
      "Bearer error =insufficient_scope",
      "Bearer error= insufficient_scope",
      'Bearer error = "insufficient_scope"',
    ]) {
      expect(detectInsufficientScope({ headers: { "www-authenticate": header } })).toEqual({
        requiredScopes: [],
      });
    }
  });

  it("rejects params attached to token68 or scheme-only challenges", () => {
    for (const header of [
      "Bearer a=, error=insufficient_scope",
      "Bearer abc, error=insufficient_scope",
      "Bearer, error=insufficient_scope",
      'Bearer realm="x" error=insufficient_scope',
    ]) {
      expect(
        detectInsufficientScope({ headers: { "www-authenticate": header } }),
        header,
      ).toBeNull();
    }
  });

  it("accepts full HTTP token characters in schemes and param names", () => {
    for (const header of [
      "Bearer foo!=bar, error=insufficient_scope",
      "Bearer x#=bar, error=insufficient_scope",
      "Bearer x|=bar, error=insufficient_scope",
      "Foo! realm=x, Bearer error=insufficient_scope",
    ]) {
      expect(detectInsufficientScope({ headers: { "www-authenticate": header } }), header).toEqual({
        requiredScopes: [],
      });
    }
  });

  it("rejects empty values, non-token values, and duplicate param names", () => {
    for (const header of [
      "Bearer realm =, error=insufficient_scope",
      "Bearer realm=;, error=insufficient_scope",
      "Bearer error=insufficient_scope, error=invalid_token",
      // `/` and `=` are token68-only; schemes, param names, and unquoted
      // values are HTTP tokens.
      "Bearer foo/bar=baz, error=insufficient_scope",
      "Foo/Bar realm=x, Bearer error=insufficient_scope",
      "Bearer realm=foo/bar, error=insufficient_scope",
      "Bearer realm=foo=bar, error=insufficient_scope",
      // `!` is token-only, not token68.
      "Bearer abc!==, error=insufficient_scope",
    ]) {
      expect(
        detectInsufficientScope({ headers: { "www-authenticate": header } }),
        header,
      ).toBeNull();
    }
  });

  it("tolerates real-provider header quirks without weakening the signal params", () => {
    // Stripe (live snapshot): unquoted resource_metadata URL.
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate":
            "Bearer resource_metadata=https://mcp.stripe.com/.well-known/oauth-protected-resource, error=insufficient_scope",
        },
      }),
    ).toEqual({ requiredScopes: [] });
    // Sentry (live snapshot): duplicated resource_metadata param.
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate":
            'Bearer realm="OAuth", resource_metadata="https://mcp.sentry.dev/.well-known/oauth-protected-resource", error="insufficient_scope", resource_metadata="https://mcp.sentry.dev/.well-known/oauth-protected-resource"',
        },
      }),
    ).toEqual({ requiredScopes: [] });
    // But a duplicated SIGNAL param still fails closed.
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate": "Bearer error=insufficient_scope, error=invalid_token",
        },
      }),
    ).toBeNull();
  });

  it("accepts comma-separated params within one Bearer challenge", () => {
    expect(
      detectInsufficientScope({
        headers: {
          "www-authenticate": 'Bearer realm="api", error="insufficient_scope", scope="a.b"',
        },
      }),
    ).toEqual({ requiredScopes: ["a.b"] });
  });

  it("accepts an unquoted RFC 6750 challenge value", () => {
    expect(
      detectInsufficientScope({
        headers: { "www-authenticate": "Bearer error=insufficient_scope" },
      }),
    ).toEqual({ requiredScopes: [] });
  });

  it("returns null for an ordinary 403 body", () => {
    expect(
      detectInsufficientScope({
        body: { error: { status: "PERMISSION_DENIED", message: "Caller lacks permission" } },
        headers: { "www-authenticate": 'Bearer realm="example", error="invalid_token"' },
      }),
    ).toBeNull();
  });

  it("returns null for empty input", () => {
    expect(detectInsufficientScope({})).toBeNull();
  });
});

describe("authToolFailure recovery for oauth_scope_insufficient", () => {
  const recoveryOf = (result: ReturnType<typeof authToolFailure>) => {
    const details = (result as { error: { details: { recovery: Record<string, string> } } }).error
      .details;
    return details.recovery;
  };

  it("omits the oauth.start hint, which would re-run the identical grant", () => {
    const recovery = recoveryOf(
      authToolFailure({ code: "oauth_scope_insufficient", message: "scope shortfall" }),
    );
    expect(recovery.startOAuthTool).toBeUndefined();
    expect(recovery.oauthInstructions).toBeUndefined();
    expect(recovery.scopeInstructions).toContain("does not cover the scope");
    expect(recovery.listConnectionsTool).toBe("executor.coreTools.connections.list");
  });

  it("keeps the full recovery block for connection_rejected", () => {
    const recovery = recoveryOf(
      authToolFailure({ code: "connection_rejected", message: "rejected" }),
    );
    expect(recovery.startOAuthTool).toBe("executor.coreTools.oauth.start");
    expect(recovery.oauthInstructions).toBeDefined();
  });
});