import { afterEach, beforeEach, describe, expect, it, vi } from "@effect/vitest";
import {
  existsSync,
  mkdirSync,
  mkdtempSync,
  readFileSync,
  readdirSync,
  rmSync,
  statSync,
  writeFileSync,
} from "node:fs";
import { tmpdir } from "node:os";
import { dirname, join } from "node:path";
import { Effect, Predicate, Result } from "effect";

import { ProviderKey } from "@executor-js/sdk";
import { makeTestWorkspaceHarness } from "@executor-js/sdk/testing";

import { fileSecretsPlugin } from "./index";

const FILE_PROVIDER = ProviderKey.make("file");

const inspectPlugin = (plugin: ReturnType<typeof fileSecretsPlugin>) =>
  Effect.scoped(
    Effect.gen(function* () {
      const workspace = yield* makeTestWorkspaceHarness({ plugins: [plugin] as const });
      const items = yield* workspace.executor.providers.items(FILE_PROVIDER);
      return {
        filePath: workspace.executor.fileSecrets.filePath,
        itemIds: items.map((item) => String(item.id)),
      };
    }),
  );

const writeAuthFile = (filePath: string, contents: string, mode = 0o600): void => {
  mkdirSync(dirname(filePath), { recursive: true });
  writeFileSync(filePath, contents, { mode });
};

describe("file secrets auth location", () => {
  let workDir: string;
  let dataDir: string;
  let otherDataDir: string;
  let xdgDataHome: string;
  let overrideDir: string;
  let legacyFilePath: string;

  beforeEach(() => {
    workDir = mkdtempSync(join(tmpdir(), "executor-file-secrets-location-"));
    dataDir = join(workDir, "data");
    otherDataDir = join(workDir, "other-data");
    xdgDataHome = join(workDir, "xdg");
    overrideDir = join(workDir, "override");
    legacyFilePath = join(xdgDataHome, "executor", "auth.json");
    vi.stubEnv("XDG_DATA_HOME", xdgDataHome);
  });

  afterEach(() => {
    vi.unstubAllEnvs();
    rmSync(workDir, { recursive: true, force: true });
  });

  it.effect("uses auth.json directly under EXECUTOR_DATA_DIR resolved at construction", () =>
    Effect.gen(function* () {
      vi.stubEnv("EXECUTOR_DATA_DIR", dataDir);
      const plugin = fileSecretsPlugin();
      vi.stubEnv("EXECUTOR_DATA_DIR", otherDataDir);

      const inspected = yield* inspectPlugin(plugin);

      expect(inspected.filePath).toBe(join(dataDir, "auth.json"));
    }),
  );

  it.effect("keeps the XDG location when EXECUTOR_DATA_DIR is unset", () =>
    Effect.gen(function* () {
      vi.stubEnv("EXECUTOR_DATA_DIR", "");

      const inspected = yield* inspectPlugin(fileSecretsPlugin());

      expect(inspected.filePath).toBe(legacyFilePath);
    }),
  );

  it.effect("gives an explicit directory precedence without migration", () =>
    Effect.gen(function* () {
      vi.stubEnv("EXECUTOR_DATA_DIR", dataDir);
      writeAuthFile(legacyFilePath, '{"legacy":"legacy-secret"}');

      const inspected = yield* inspectPlugin(fileSecretsPlugin({ directory: overrideDir }));

      expect(inspected.filePath).toBe(join(overrideDir, "auth.json"));
      expect(inspected.itemIds).toEqual([]);
      expect(existsSync(join(dataDir, "auth.json"))).toBe(false);
      expect(readFileSync(legacyFilePath, "utf8")).toBe('{"legacy":"legacy-secret"}');
    }),
  );

  it.effect("copies a valid legacy XDG file once and preserves 0600 permissions", () =>
    Effect.gen(function* () {
      vi.stubEnv("EXECUTOR_DATA_DIR", dataDir);
      const legacyContents = '{"legacy-token":"legacy-secret"}';
      writeAuthFile(legacyFilePath, legacyContents, 0o644);

      const inspected = yield* inspectPlugin(fileSecretsPlugin());
      const migratedFilePath = join(dataDir, "auth.json");

      expect(inspected.filePath).toBe(migratedFilePath);
      expect(inspected.itemIds).toEqual(["legacy-token"]);
      expect(readFileSync(migratedFilePath, "utf8")).toContain('"legacy-token": "legacy-secret"');
      expect(statSync(migratedFilePath).mode & 0o777).toBe(0o600);
      expect(readFileSync(legacyFilePath, "utf8")).toBe(legacyContents);
    }),
  );

  it.effect("uses an existing data-dir file without merging the legacy file", () =>
    Effect.gen(function* () {
      vi.stubEnv("EXECUTOR_DATA_DIR", dataDir);
      const activeFilePath = join(dataDir, "auth.json");
      const activeContents = '{"active-token":"active-secret"}';
      const legacyContents = '{"legacy-token":"legacy-secret"}';
      writeAuthFile(activeFilePath, activeContents);
      writeAuthFile(legacyFilePath, legacyContents);

      const inspected = yield* inspectPlugin(fileSecretsPlugin());

      expect(inspected.itemIds).toEqual(["active-token"]);
      expect(readFileSync(activeFilePath, "utf8")).toBe(activeContents);
      expect(readFileSync(legacyFilePath, "utf8")).toBe(legacyContents);
    }),
  );

  it.effect("leaves the new store empty when the legacy file is corrupt", () =>
    Effect.scoped(
      Effect.gen(function* () {
        vi.stubEnv("EXECUTOR_DATA_DIR", dataDir);
        writeAuthFile(legacyFilePath, "not-json");
        const workspace = yield* makeTestWorkspaceHarness({
          plugins: [fileSecretsPlugin()] as const,
        });

        const initial = yield* workspace.executor.providers.items(FILE_PROVIDER);
        expect(initial).toEqual([]);
        expect(existsSync(join(dataDir, "auth.json"))).toBe(false);
        expect(readFileSync(legacyFilePath, "utf8")).toBe("not-json");

        writeAuthFile(legacyFilePath, '{"repaired-token":"repaired-secret"}');
        const afterRepair = yield* workspace.executor.providers.items(FILE_PROVIDER);
        expect(afterRepair).toEqual([]);
        expect(existsSync(join(dataDir, "auth.json"))).toBe(false);
      }),
    ),
  );

  it.effect("retries migration after a legacy read I/O failure", () =>
    Effect.scoped(
      Effect.gen(function* () {
        vi.stubEnv("EXECUTOR_DATA_DIR", dataDir);
        mkdirSync(legacyFilePath, { recursive: true });
        const workspace = yield* makeTestWorkspaceHarness({
          plugins: [fileSecretsPlugin()] as const,
        });

        const failed = yield* Effect.result(workspace.executor.providers.items(FILE_PROVIDER));
        expect(Result.isFailure(failed)).toBe(true);
        if (!Result.isFailure(failed)) return;
        expect(Predicate.isTagged("StorageError")(failed.failure)).toBe(true);

        rmSync(legacyFilePath, { recursive: true, force: true });
        writeAuthFile(legacyFilePath, '{"recovered-token":"recovered-secret"}');

        const recovered = yield* workspace.executor.providers.items(FILE_PROVIDER);
        expect(recovered.map((item) => String(item.id))).toEqual(["recovered-token"]);
        expect(readFileSync(join(dataDir, "auth.json"), "utf8")).toContain(
          '"recovered-token": "recovered-secret"',
        );
      }),
    ),
  );

  it.effect("shares one migration across concurrent first provider operations", () =>
    Effect.scoped(
      Effect.gen(function* () {
        vi.stubEnv("EXECUTOR_DATA_DIR", dataDir);
        const legacyContents = '{"legacy-token":"legacy-secret"}';
        writeAuthFile(legacyFilePath, legacyContents);
        const workspace = yield* makeTestWorkspaceHarness({
          plugins: [fileSecretsPlugin()] as const,
        });

        const results = yield* Effect.all(
          [
            workspace.executor.providers.items(FILE_PROVIDER),
            workspace.executor.providers.items(FILE_PROVIDER),
          ],
          { concurrency: "unbounded" },
        );

        expect(results.map((items) => items.map((item) => String(item.id)))).toEqual([
          ["legacy-token"],
          ["legacy-token"],
        ]);
        expect(readdirSync(dataDir)).toEqual(["auth.json"]);
        expect(readFileSync(legacyFilePath, "utf8")).toBe(legacyContents);
      }),
    ),
  );
});