import { describe, expect, it } from "@effect/vitest";
import { Effect, Predicate, Result } from "effect";
import { resolveProjectedPolicy, ToolAddress } from "@executor-js/sdk/core";
import { makeTestExecutor } from "@executor-js/sdk/testing";

import { toolkitsPlugin } from "./server";

describe("toolkitsPlugin", () => {
  it.effect("creates toolkits and manages ordered policy rules", () =>
    Effect.gen(function* () {
      const executor = yield* makeTestExecutor({
        plugins: [toolkitsPlugin()] as const,
      });

      const toolkit = yield* executor.toolkits.create({
        owner: "org",
        name: "Deploy Kit",
      });
      expect(toolkit.slug).toBe("deploy-kit");

      const connection = yield* executor.toolkits.createConnection(toolkit.id, {
        pattern: "github.org.main.*",
      });
      const duplicateConnection = yield* executor.toolkits.createConnection(toolkit.id, {
        pattern: "github.org.main.*",
      });
      expect(duplicateConnection.id).toBe(connection.id);

      const first = yield* executor.toolkits.createPolicy(toolkit.id, {
        pattern: "github.org.main.repos.*",
        action: "approve",
      });
      const second = yield* executor.toolkits.createPolicy(toolkit.id, {
        pattern: "github.*",
        action: "block",
      });

      const policies = yield* executor.toolkits.listPolicies(toolkit.id);
      expect(policies.map((policy) => policy.id)).toEqual([second.id, first.id]);

      yield* executor.toolkits.updatePolicy(toolkit.id, first.id, {
        action: "require_approval",
      });
      const projection = yield* executor.toolkits.projectionForSlug("deploy-kit");
      expect(projection?.rules.find((rule) => rule.id === first.id)?.action).toBe(
        "require_approval",
      );

      const connections = yield* executor.toolkits.listConnections(toolkit.id);
      expect(connections.map((row) => row.pattern)).toEqual(["github.org.main.*"]);
    }),
  );

  it.effect("rejects duplicate visible slugs", () =>
    Effect.gen(function* () {
      const executor = yield* makeTestExecutor({
        plugins: [toolkitsPlugin()] as const,
      });
      yield* executor.toolkits.create({ owner: "org", name: "Deploy Kit" });

      const duplicate = yield* Effect.result(
        executor.toolkits.create({ owner: "user", name: "Deploy Kit" }),
      );
      expect(Result.isFailure(duplicate)).toBe(true);
      if (!Result.isFailure(duplicate)) return;
      expect(Predicate.isTagged("ToolkitError")(duplicate.failure)).toBe(true);
    }),
  );

  it.effect("projects toolkit policies with implicit deny and workspace owner limits", () =>
    Effect.gen(function* () {
      const executor = yield* makeTestExecutor({
        plugins: [toolkitsPlugin()] as const,
      });
      // The workspace has no rule for these tools, so its answer is the plugin
      // default — the same one the projection falls through to.
      const resolve = (slug: string, toolId: string, defaultRequiresApproval?: boolean) =>
        executor.toolkits
          .projectionForSlug(slug)
          .pipe(
            Effect.map((projection) =>
              resolveProjectedPolicy(
                projection ?? { visible: [], rules: [] },
                toolId,
                defaultRequiresApproval
                  ? { action: "require_approval", source: "plugin-default" }
                  : { action: "approve", source: "plugin-default" },
                defaultRequiresApproval,
              ),
            ),
          );

      const workspace = yield* executor.toolkits.create({
        owner: "org",
        name: "Workspace Kit",
      });
      yield* executor.toolkits.createConnection(workspace.id, {
        pattern: "github.org.main.*",
      });

      const workspaceTool = yield* resolve(workspace.slug, "github.org.main.repos.list");
      expect(workspaceTool.action).toBe("approve");
      expect(workspaceTool.source).toBe("plugin-default");

      const defaultApprovalTool = yield* resolve(
        workspace.slug,
        "github.org.main.repos.delete",
        true,
      );
      expect(defaultApprovalTool.action).toBe("require_approval");
      expect(defaultApprovalTool.source).toBe("plugin-default");

      yield* executor.toolkits.createPolicy(workspace.id, {
        pattern: "github.org.main.repos.delete",
        action: "approve",
      });
      const explicitTool = yield* resolve(workspace.slug, "github.org.main.repos.delete", true);
      expect(explicitTool.action).toBe("approve");
      expect(explicitTool.source).toBe("user");

      const personalTool = yield* resolve(workspace.slug, "github.user.main.repos.list");
      expect(personalTool.action).toBe("block");

      const missingTool = yield* resolve(workspace.slug, "slack.org.main.chat.post");
      expect(missingTool.action).toBe("block");

      const unknownToolkit = yield* resolve("no-such-kit", "github.org.main.repos.list");
      expect(unknownToolkit.action).toBe("block");

      const personal = yield* executor.toolkits.create({
        owner: "user",
        name: "Personal Kit",
      });
      yield* executor.toolkits.createConnection(personal.id, {
        pattern: "github.user.main.*",
      });
      const personalToolkitTool = yield* resolve(personal.slug, "github.user.main.repos.list");
      expect(personalToolkitTool.action).toBe("approve");
    }),
  );

  it.effect("a projected executor keeps the workspace policy underneath the toolkit", () =>
    Effect.gen(function* () {
      const executor = yield* makeTestExecutor({
        plugins: [toolkitsPlugin()] as const,
        coreTools: { webBaseUrl: "https://executor.test" },
      });

      const toolkit = yield* executor.toolkits.create({ owner: "org", name: "Core Kit" });
      yield* executor.toolkits.createConnection(toolkit.id, {
        pattern: "executor.coreTools.*",
      });
      yield* executor.toolkits.createPolicy(toolkit.id, {
        pattern: "executor.coreTools.policies.create",
        action: "approve",
      });
      // The workspace gates the same tool. A toolkit "approve" must not undo it.
      yield* executor.policies.create({
        owner: "org",
        pattern: "executor.coreTools.policies.create",
        action: "require_approval",
      });

      const projected = yield* executor.project(toolkit.slug);
      const gated = yield* projected.policies.resolve(
        ToolAddress.make("executor.coreTools.policies.create"),
      );
      expect(gated.action).toBe("require_approval");

      // Outside the toolkit's connections the tool is blocked, even though the
      // workspace itself would allow it.
      const outside = yield* projected.policies.resolve(
        ToolAddress.make("executor.coreTools.integrations.list"),
      );
      expect(outside.action).toBe("approve");
      const hidden = yield* projected.tools.list();
      expect(hidden.every((tool) => String(tool.address).startsWith("executor.coreTools."))).toBe(
        true,
      );

      // The parent view is untouched by the projection.
      const parent = yield* executor.policies.resolve(
        ToolAddress.make("executor.coreTools.policies.create"),
      );
      expect(parent.action).toBe("require_approval");
    }),
  );

  it.effect("treats a persisted connection-root approve as an access policy", () =>
    Effect.gen(function* () {
      const executor = yield* makeTestExecutor({
        plugins: [toolkitsPlugin()] as const,
      });

      const toolkit = yield* executor.toolkits.create({
        owner: "org",
        name: "Core Tools Kit",
      });
      yield* executor.toolkits.createConnection(toolkit.id, {
        pattern: "executor.coreTools.*",
      });
      yield* executor.toolkits.createPolicy(toolkit.id, {
        pattern: "executor.coreTools.*",
        action: "approve",
      });

      const projection = yield* executor.toolkits.projectionForSlug(toolkit.slug);
      const result = resolveProjectedPolicy(
        projection!,
        "executor.coreTools.connections.remove",
        { action: "approve", source: "plugin-default" },
        true,
      );
      expect(result.action).toBe("approve");
      expect(result.source).toBe("user");
      expect(
        projection!.rules.map((rule) => `${rule.pattern} ${rule.action}`),
        "policy listing agrees with toolkit enforcement",
      ).toContain("executor.coreTools.* approve");
    }),
  );

  it.effect("applies a broad approve policy over a narrower connection", () =>
    Effect.gen(function* () {
      const executor = yield* makeTestExecutor({
        plugins: [toolkitsPlugin()] as const,
      });

      const toolkit = yield* executor.toolkits.create({
        owner: "org",
        name: "Docs Kit",
      });
      yield* executor.toolkits.createConnection(toolkit.id, {
        pattern: "google_docs.org.main.*",
      });
      yield* executor.toolkits.createPolicy(toolkit.id, {
        pattern: "google_docs.org.*",
        action: "approve",
      });

      const projection = yield* executor.toolkits.projectionForSlug(toolkit.slug);
      const result = resolveProjectedPolicy(
        projection!,
        "google_docs.org.main.documents.update",
        { action: "approve", source: "plugin-default" },
        true,
      );
      expect(result.action).toBe("approve");
      expect(result.source).toBe("user");
      expect(
        projection!.rules.map((rule) => `${rule.pattern} ${rule.action}`),
        "policy listing agrees with toolkit enforcement",
      ).toContain("google_docs.org.* approve");
    }),
  );
});