import { Effect, Exit } from "effect";
import { describe, expect, test } from "@effect/vitest";

import { Owner, ProviderItemId, type CredentialProvider, type PluginCtx } from "@executor-js/sdk";

import { decryptSecret, deriveKey, encryptSecret, encryptedSecretsPlugin } from "./index";

// ---------------------------------------------------------------------------
// In-memory PluginStorageFacade fake (owner-partitioned), enough to exercise
// the provider exactly as the executor's plugin-storage table would.
//
// v2: the provider keys values by the opaque `ProviderItemId` (the storage
// `key`); writes carry an `owner` the host supplies. Reads via `get`/`list`
// are not owner-filtered — the connection row that references the id owns the
// partition.
// ---------------------------------------------------------------------------

const makeFakeStorage = () => {
  const rows = new Map<string, { owner: Owner; key: string; collection: string; data: unknown }>();
  const composite = (collection: string, key: string) => `${collection} ${key}`;
  const toEntry = (row: { owner: Owner; key: string; collection: string; data: unknown }) => ({
    id: composite(row.collection, row.key),
    owner: row.owner,
    pluginId: "encryptedSecrets",
    collection: row.collection,
    key: row.key,
    data: row.data,
    createdAt: new Date(0),
    updatedAt: new Date(0),
  });
  const facade = {
    get: (input: { collection: string; key: string }) =>
      Effect.sync(() => {
        const row = rows.get(composite(input.collection, input.key));
        return row ? (toEntry(row) as never) : null;
      }),
    getForOwner: (input: { collection: string; key: string; owner: Owner }) =>
      Effect.sync(() => {
        const row = rows.get(composite(input.collection, input.key));
        return row && row.owner === input.owner ? (toEntry(row) as never) : null;
      }),
    list: (input: { collection: string }) =>
      Effect.sync(
        () =>
          [...rows.values()]
            .filter((row) => row.collection === input.collection)
            .map((row) => toEntry(row)) as never,
      ),
    put: (input: { collection: string; key: string; owner: Owner; data: unknown }) =>
      Effect.sync(() => {
        const row = {
          owner: input.owner,
          key: input.key,
          collection: input.collection,
          data: input.data,
        };
        rows.set(composite(input.collection, input.key), row);
        return toEntry(row) as never;
      }),
    remove: (input: { collection: string; key: string; owner: Owner }) =>
      Effect.sync(() => {
        // Owner-filtered like the real facade: a remove aimed at the wrong
        // partition deletes nothing.
        const row = rows.get(composite(input.collection, input.key));
        if (row && row.owner === input.owner) rows.delete(composite(input.collection, input.key));
      }),
  };
  return { facade, rows };
};

const makeProvider = (key: string, owner: Owner = Owner.make("org")) => {
  const { facade, rows } = makeFakeStorage();
  // oxlint-disable-next-line executor/no-double-cast -- test boundary: minimal PluginCtx fake for the provider under test
  const ctx = {
    owner: { tenant: "tenant-a", subject: owner === Owner.make("user") ? "subject-a" : null },
    pluginStorage: facade,
  } as unknown as PluginCtx<unknown>;
  const plugin = encryptedSecretsPlugin({ key });
  const credentialProviders = plugin.credentialProviders as (
    ctx: PluginCtx<unknown>,
  ) => readonly CredentialProvider[];
  const provider = credentialProviders(ctx)[0]!;
  return { provider, rows };
};

const id = (value: string) => ProviderItemId.make(value);

const expectFailure = async <A, E>(effect: Effect.Effect<A, E>) => {
  const exit = await Effect.runPromiseExit(effect);
  expect(Exit.isFailure(exit)).toBe(true);
};

describe("crypto", () => {
  test("round-trips through encrypt/decrypt", async () => {
    const key = deriveKey("master-key-1");
    const payload = await Effect.runPromise(encryptSecret(key, "ghp_secret_value"));
    expect(payload.startsWith("v1.")).toBe(true);
    const back = await Effect.runPromise(decryptSecret(key, payload));
    expect(back).toBe("ghp_secret_value");
  });

  test("a different key cannot decrypt", async () => {
    const payload = await Effect.runPromise(encryptSecret(deriveKey("key-a"), "value"));
    await expectFailure(decryptSecret(deriveKey("key-b"), payload));
  });

  test("tampered ciphertext fails the auth tag", async () => {
    const key = deriveKey("master-key-1");
    const payload = await Effect.runPromise(encryptSecret(key, "value"));
    const parts = payload.split(".");
    const tampered = [
      parts[0],
      parts[1],
      parts[2],
      Buffer.from("tampered").toString("base64"),
    ].join(".");
    await expectFailure(decryptSecret(key, tampered));
  });
});

describe("provider", () => {
  test("set then get returns the plaintext", async () => {
    const { provider } = makeProvider("master");
    await Effect.runPromise(provider.set!(id("github"), "ghp_xyz"));
    const got = await Effect.runPromise(provider.get(id("github")));
    expect(got).toBe("ghp_xyz");
  });

  test("stores ciphertext at rest, not plaintext", async () => {
    const { provider, rows } = makeProvider("master");
    await Effect.runPromise(provider.set!(id("github"), "ghp_plaintext"));
    const stored = String([...rows.values()][0]!.data);
    expect(stored).not.toContain("ghp_plaintext");
    expect(stored.startsWith("v1.")).toBe(true);
  });

  // removed: "a secret in one scope is invisible to another scope" — v2 drops
  // the scope arg entirely. The provider keys solely by the opaque
  // `ProviderItemId`; the referencing connection row owns the (tenant, owner,
  // subject) partition, so cross-scope isolation is no longer the provider's
  // concern to enforce or test. Filing rows into the RIGHT partition still is
  // — see the partitioning describe below (issue #1453).

  test("get returns null for a missing id", async () => {
    const { provider } = makeProvider("master");
    expect(await Effect.runPromise(provider.get(id("absent")))).toBeNull();
  });

  test("has and delete reflect presence", async () => {
    const { provider } = makeProvider("master");
    expect(await Effect.runPromise(provider.has!(id("k")))).toBe(false);
    await Effect.runPromise(provider.set!(id("k"), "v"));
    expect(await Effect.runPromise(provider.has!(id("k")))).toBe(true);
    await Effect.runPromise(provider.delete!(id("k")));
    expect(await Effect.runPromise(provider.has!(id("k")))).toBe(false);
    // delete is idempotent and returns void; deleting an absent id is a no-op.
    await Effect.runPromise(provider.delete!(id("k")));
    expect(await Effect.runPromise(provider.has!(id("k")))).toBe(false);
  });

  test("list surfaces stored ids", async () => {
    const { provider } = makeProvider("master");
    await Effect.runPromise(provider.set!(id("alpha"), "a"));
    await Effect.runPromise(provider.set!(id("beta"), "b"));
    const entries = await Effect.runPromise(provider.list!());
    expect(entries.map((e) => e.id).sort()).toEqual(["alpha", "beta"]);
  });
});

// The partition a write files under is the CREDENTIAL's owner (embedded in
// the item id), not the acting caller's binding. Issue #1453: a user-bound
// caller completing an org connection's OAuth consent filed the tokens under
// their private partition, so every other org principal resolved nothing and
// failed with `oauth_connection_missing`.
describe("owner partitioning", () => {
  const storedOwner = (
    rows: Map<string, { owner: Owner; key: string; collection: string; data: unknown }>,
    key: string,
  ) => [...rows.values()].find((row) => row.key === key)?.owner;

  test("an org-embedded id written by a user-bound caller files org-shared", async () => {
    const { provider, rows } = makeProvider("master", Owner.make("user"));
    await Effect.runPromise(provider.set!(id("oauth:org:slack:workspace"), "access_tok"));
    await Effect.runPromise(provider.set!(id("oauth:org:slack:workspace:refresh"), "refresh_tok"));
    await Effect.runPromise(provider.set!(id("connection:org:exa:main:token"), "api_key"));
    await Effect.runPromise(provider.set!(id("oauth-client:org:my_app:secret"), "client_sec"));
    expect(storedOwner(rows, "oauth:org:slack:workspace")).toBe("org");
    expect(storedOwner(rows, "oauth:org:slack:workspace:refresh")).toBe("org");
    expect(storedOwner(rows, "connection:org:exa:main:token")).toBe("org");
    expect(storedOwner(rows, "oauth-client:org:my_app:secret")).toBe("org");
  });

  test("a user-embedded id written by an org-bound caller files user-private", async () => {
    const { provider, rows } = makeProvider("master", Owner.make("org"));
    await Effect.runPromise(provider.set!(id("connection:user:notion:personal:token"), "private"));
    expect(storedOwner(rows, "connection:user:notion:personal:token")).toBe("user");
  });

  test("an id with no embedded owner falls back to the caller binding", async () => {
    const asUser = makeProvider("master", Owner.make("user"));
    await Effect.runPromise(asUser.provider.set!(id("github"), "v"));
    expect(storedOwner(asUser.rows, "github")).toBe("user");

    const asOrg = makeProvider("master", Owner.make("org"));
    await Effect.runPromise(asOrg.provider.set!(id("github"), "v"));
    expect(storedOwner(asOrg.rows, "github")).toBe("org");
  });

  test("delete targets the embedded owner's partition", async () => {
    const { provider, rows } = makeProvider("master", Owner.make("user"));
    await Effect.runPromise(provider.set!(id("oauth:org:slack:workspace"), "tok"));
    await Effect.runPromise(provider.delete!(id("oauth:org:slack:workspace")));
    expect(rows.size).toBe(0);
  });
});