import { describe, expect, it } from "@effect/vitest";
import { Effect, Layer } from "effect";

import { AdminUsersForbidden } from "@executor-js/api";
import { MemberDirectory, type DirectoryMember } from "@executor-js/api/server";

import { ApiKeyService } from "../auth/api-keys";
import { UserStoreService } from "../auth/context";
import { ORG_SELECTOR_HEADER } from "../auth/organization";
import { WorkOSClient, type WorkOSClientService } from "../auth/workos";
import { WorkOsMirror, type WorkOsMirrorShape } from "../auth/workos-mirror";
import { authorizeTenant } from "./admin-users-api";

// ---------------------------------------------------------------------------
// The admin plane's SESSION credential: an admin member of the selected org,
// resolved against the membership mirror through the shared `MemberDirectory`.
// The org-key credential is pinned in `auth/org-api-key-auth.node.test.ts`;
// this file pins the session branch of `authorizeTenant`:
//   - an ACTIVE `admin` membership yields the tenant id
//   - an active plain member is refused
//   - a pending admin invite is refused (not an admin until accepted)
//   - no WorkOS call is made past session authentication
// ---------------------------------------------------------------------------

const ORG = "org_tenant";
const createdAt = new Date("2026-01-01T00:00:00.000Z");

const mirrored = (
  accountId: string,
  overrides: Partial<DirectoryMember> = {},
): DirectoryMember => ({
  accountId,
  membershipId: `om_${accountId}`,
  organizationId: ORG,
  email: null,
  name: null,
  avatarUrl: null,
  role: "member",
  status: "active",
  lastActiveAt: null,
  ...overrides,
});

// The mirror as the directory reads it for ORG.
const memberships = new Map<string, DirectoryMember>([
  ["user_admin", mirrored("user_admin", { role: "admin" })],
  ["user_member", mirrored("user_member")],
  ["user_invited_admin", mirrored("user_invited_admin", { role: "admin", status: "pending" })],
]);

const stubDirectory = Layer.succeed(MemberDirectory)({
  membership: (accountId, organizationId) =>
    Effect.succeed(organizationId === ORG ? (memberships.get(accountId) ?? null) : null),
  membershipById: () => Effect.die("tenant authorization does not look up by membership id"),
  membershipsOf: () => Effect.die("tenant authorization reads one membership, not the list"),
  members: () => Effect.die("tenant authorization does not list members"),
  membersById: () => Effect.die("tenant authorization does not batch members"),
  findByEmail: () => Effect.die("tenant authorization does not resolve emails"),
});

// No Authorization header in these tests: the api-key path falls through to
// the session path without validating anything.
const stubApiKeys = Layer.succeed(ApiKeyService)({
  validate: () => Effect.die("no bearer credential is presented"),
  listUserKeys: () => Effect.die("tenant authorization does not list keys"),
  createUserKey: () => Effect.die("tenant authorization does not create keys"),
  revokeUserKey: () => Effect.die("tenant authorization does not revoke keys"),
  listOrgKeys: () => Effect.die("tenant authorization does not list keys"),
  createOrgKey: () => Effect.die("tenant authorization does not create keys"),
  revokeOrgKey: () => Effect.die("tenant authorization does not revoke keys"),
});

// The mirror's account row as `ensureAccount` mints it: id only, profile
// columns unfilled until a WorkOS user payload arrives.
const bareAccount = (id: string) => ({
  id,
  email: null,
  firstName: null,
  lastName: null,
  avatarUrl: null,
  workosUpdatedAt: null,
  lastSignInAt: null,
  createdAt,
});

// The selector is an org id, so only `getOrganization` is reached; the org
// row is already mirrored.
const stubUsers = Layer.succeed(UserStoreService)({
  use: (_op, fn) =>
    Effect.promise(() =>
      fn({
        ensureAccount: async (id: string) => bareAccount(id),
        getAccount: async (id: string) => bareAccount(id),
        upsertOrganization: async (org: { id: string; name: string }) => ({
          ...org,
          slug: org.id,
          backfilledAt: createdAt,
          deletedAt: null,
          workosUpdatedAt: null,
          createdAt,
        }),
        getOrganization: async (id: string) => ({
          id,
          name: `Org ${id}`,
          slug: id,
          backfilledAt: createdAt,
          deletedAt: null,
          workosUpdatedAt: null,
          createdAt,
        }),
        getOrganizationBySlug: async (slug: string) => ({
          id: slug,
          name: `Org ${slug}`,
          slug,
          backfilledAt: createdAt,
          deletedAt: null,
          workosUpdatedAt: null,
          createdAt,
        }),
        markOrganizationDeleted: async () => null,
        deleteOrganizationCascade: async () => {},
      }),
    ),
});

// Authorization scans an organization the backfill never covered before it
// reads the mirror (`auth/organization.ts`); every org row above is marked
// backfilled, so the scan is never reached and the mirror is never written.
const stubMirror = Layer.succeed(
  WorkOsMirror,
  new Proxy({} as WorkOsMirrorShape, {
    get: (_target, prop) => () => Effect.die(`unexpected WorkOsMirror.${String(prop)} call`),
  }),
);

// Only session authentication is served; membership is read from the mirror,
// so any other WorkOS call fails the test.
const stubWorkOS = (userId: string) =>
  Layer.succeed(
    WorkOSClient,
    new Proxy({} as WorkOSClientService, {
      get: (_target, prop) => {
        if (prop === "authenticateRequest") {
          return () =>
            Effect.succeed({
              userId,
              email: `${userId}@placeholder.test`,
              organizationId: null,
            });
        }
        return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);
      },
    }),
  );

const authorizeAs = (userId: string) =>
  authorizeTenant(
    new Request("https://admin.invalid", {
      headers: { cookie: "wos-session=sealed", [ORG_SELECTOR_HEADER]: ORG },
    }),
  ).pipe(
    Effect.provide(
      Layer.mergeAll(stubDirectory, stubApiKeys, stubUsers, stubWorkOS(userId), stubMirror),
    ),
  );

describe("authorizeTenant · admin session", () => {
  it.effect("an active admin resolves the selected org as the tenant", () =>
    Effect.gen(function* () {
      const tenant = yield* authorizeAs("user_admin");
      expect(tenant).toBe(ORG);
    }),
  );

  it.effect("an active plain member is forbidden", () =>
    Effect.gen(function* () {
      const error = yield* Effect.flip(authorizeAs("user_member"));
      expect(error, "this plane serves the whole tenant; a member is not enough").toBeInstanceOf(
        AdminUsersForbidden,
      );
    }),
  );

  it.effect("a pending admin invite is forbidden", () =>
    Effect.gen(function* () {
      const error = yield* Effect.flip(authorizeAs("user_invited_admin"));
      expect(error, "an admin role that is still pending is not an admin").toBeInstanceOf(
        AdminUsersForbidden,
      );
    }),
  );
});