import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

import { describe, expect, it } from "@effect/vitest";
import { Effect } from "effect";

import { OAuthClientSlug, ToolAddress } from "./ids";
import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";

// removeClient permanently deletes an owner-scoped oauth_client row, keyed by
// (owner, slug). The owner policy on `oauth_client` prevents removing another
// subject's user app. The op is idempotent and never cascades into connections.

const plugins = [memoryCredentialsPlugin()] as const;

const ORG_CLIENT = OAuthClientSlug.make("acme-org");
const USER_CLIENT = OAuthClientSlug.make("acme-user");

describe("oauth.removeClient", () => {
  it.effect("removes a client so it no longer lists", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const { executor } = yield* makeTestWorkspaceHarness({ plugins });

        yield* executor.oauth.createClient({
          owner: "user",
          slug: USER_CLIENT,
          authorizationUrl: "https://acme.test/authorize",
          tokenUrl: "https://acme.test/token",
          grant: "authorization_code",
          clientId: "user-client-id",
          clientSecret: "user-secret",
        });

        const before = yield* executor.oauth.listClients();
        expect(before.map((client) => String(client.slug))).toContain(String(USER_CLIENT));

        yield* executor.oauth.removeClient("user", USER_CLIENT);

        const after = yield* executor.oauth.listClients();
        expect(after.map((client) => String(client.slug))).not.toContain(String(USER_CLIENT));
      }),
    ),
  );

  it.effect("is idempotent — removing a non-existent client succeeds", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const { executor } = yield* makeTestWorkspaceHarness({ plugins });

        // No client was ever created; removing it must not error.
        yield* executor.oauth.removeClient("user", OAuthClientSlug.make("never-existed"));

        const clients = yield* executor.oauth.listClients();
        expect(clients).toEqual([]);
      }),
    ),
  );

  it.effect("removing an org client leaves a user client intact (and vice versa)", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const { executor } = yield* makeTestWorkspaceHarness({ plugins });

        yield* executor.oauth.createClient({
          owner: "org",
          slug: ORG_CLIENT,
          authorizationUrl: "https://acme.test/authorize",
          tokenUrl: "https://acme.test/token",
          grant: "authorization_code",
          clientId: "org-client-id",
          clientSecret: "org-secret",
        });
        yield* executor.oauth.createClient({
          owner: "user",
          slug: USER_CLIENT,
          authorizationUrl: "https://byo.test/authorize",
          tokenUrl: "https://byo.test/token",
          grant: "client_credentials",
          clientId: "user-client-id",
          clientSecret: "user-secret",
        });

        // Removing the org client leaves the user client untouched.
        yield* executor.oauth.removeClient("org", ORG_CLIENT);
        const afterOrg = yield* executor.oauth.listClients();
        expect(afterOrg.map((client) => String(client.slug)).sort()).toEqual([String(USER_CLIENT)]);

        // Removing the remaining user client empties the list.
        yield* executor.oauth.removeClient("user", USER_CLIENT);
        const afterUser = yield* executor.oauth.listClients();
        expect(afterUser).toEqual([]);
      }),
    ),
  );

  it.effect("one subject cannot remove another subject's user client", () =>
    Effect.scoped(
      Effect.gen(function* () {
        // Two executors bind to different subjects in the same tenant against a
        // shared on-disk database, so each owns its own `owner:"user"` rows.
        const dataDir = mkdtempSync(join(tmpdir(), "oauth-remove-client-"));
        const tenant = "shared-tenant";

        const a = yield* makeTestWorkspaceHarness({
          plugins,
          tenant,
          subject: "subject-a",
          dataDir,
        });
        yield* a.executor.oauth.createClient({
          owner: "user",
          slug: OAuthClientSlug.make("a-only"),
          authorizationUrl: "https://a.test/authorize",
          tokenUrl: "https://a.test/token",
          grant: "authorization_code",
          clientId: "a-client-id",
          clientSecret: "a-secret",
        });

        const b = yield* makeTestWorkspaceHarness({
          plugins,
          tenant,
          subject: "subject-b",
          dataDir,
        });

        // B attempts to remove A's user client. The owner policy scopes the
        // delete to B's own subject rows, so A's client is untouched. The op
        // succeeds (idempotent no-op) but must not delete across subjects.
        yield* b.executor.oauth.removeClient("user", OAuthClientSlug.make("a-only"));

        const clientsA = yield* a.executor.oauth.listClients();
        expect(clientsA.map((client) => String(client.slug))).toContain("a-only");
      }),
    ),
  );

  it.effect("removing an org client removes it for all subjects in the tenant", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const dataDir = mkdtempSync(join(tmpdir(), "oauth-remove-client-org-"));
        const tenant = "shared-tenant";

        const a = yield* makeTestWorkspaceHarness({
          plugins,
          tenant,
          subject: "subject-a",
          dataDir,
        });
        yield* a.executor.oauth.createClient({
          owner: "org",
          slug: OAuthClientSlug.make("shared-org"),
          authorizationUrl: "https://shared.test/authorize",
          tokenUrl: "https://shared.test/token",
          grant: "authorization_code",
          clientId: "shared-client-id",
          clientSecret: "shared-secret",
        });

        const b = yield* makeTestWorkspaceHarness({
          plugins,
          tenant,
          subject: "subject-b",
          dataDir,
        });

        // B (a different subject in the same tenant) removes the shared org app.
        yield* b.executor.oauth.removeClient("org", OAuthClientSlug.make("shared-org"));

        // It is gone for A too — org rows are tenant-shared.
        const clientsA = yield* a.executor.oauth.listClients();
        expect(clientsA.map((client) => String(client.slug))).not.toContain("shared-org");
      }),
    ),
  );

  // The `oauth.clients.remove` TOOL reports `removed` honestly on top of the
  // idempotent service call above, so an agent sweeping a list of slugs cannot
  // read a no-op as a deletion.
  it.effect("the remove tool distinguishes a real deletion from a no-op", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const { executor } = yield* makeTestWorkspaceHarness({
          plugins,
          coreTools: {},
        });
        const remove = ToolAddress.make("executor.coreTools.oauth.clients.remove");

        // The same slug registered under BOTH owners — the shape that made a
        // hardcoded `owner: "user"` sweep silently skip the org copy.
        for (const owner of ["org", "user"] as const) {
          yield* executor.oauth.createClient({
            owner,
            slug: ORG_CLIENT,
            authorizationUrl: "https://acme.test/authorize",
            tokenUrl: "https://acme.test/token",
            grant: "authorization_code",
            clientId: `${owner}-client-id`,
            clientSecret: `${owner}-secret`,
          });
        }

        // A slug that never existed is not a removal.
        expect(
          yield* executor.execute(
            remove,
            { owner: "user", slug: "never-existed" },
            { onElicitation: "accept-all" },
          ),
        ).toEqual({ removed: false });

        // Removing the user copy leaves the org copy, which still reports as a
        // real removal of its own rather than as already-gone.
        expect(
          yield* executor.execute(
            remove,
            { owner: "user", slug: String(ORG_CLIENT) },
            { onElicitation: "accept-all" },
          ),
        ).toEqual({ removed: true });
        expect(
          yield* executor.execute(
            remove,
            { owner: "org", slug: String(ORG_CLIENT) },
            { onElicitation: "accept-all" },
          ),
        ).toEqual({ removed: true });

        // Both are gone, and a repeat of either is now a no-op.
        expect(yield* executor.oauth.listClients()).toEqual([]);
        expect(
          yield* executor.execute(
            remove,
            { owner: "org", slug: String(ORG_CLIENT) },
            { onElicitation: "accept-all" },
          ),
        ).toEqual({ removed: false });
      }),
    ),
  );
});