import { describe, expect, it } from "@effect/vitest";

import { oauthClientIdMetadataDocumentFromRequest } from "./oauth-client-metadata";

describe("OAuth client ID metadata document", () => {
  it("builds an org-scoped hosted document with a bare callback redirect_uri", () => {
    const metadata = oauthClientIdMetadataDocumentFromRequest({
      requestUrl: "/api/oauth/client-id-metadata/acme.json",
      webRequest: new Request("http://127.0.0.1:42384/api/oauth/client-id-metadata/acme.json", {
        headers: { Host: "100.81.219.45:42384" },
      }),
      mountPrefix: "/api",
    });

    // The org is identified by the per-org client_id URL, not by a query param
    // on redirect_uri (which the client never sends, and the callback reads
    // from `state`). redirect_uri must stay bare for exact-match providers.
    expect(metadata.client_id).toBe(
      "http://100.81.219.45:42384/api/oauth/client-id-metadata/acme.json",
    );
    expect(metadata.redirect_uris).toEqual(["http://100.81.219.45:42384/api/oauth/callback"]);
    expect(metadata.token_endpoint_auth_method).toBe("none");
    expect(metadata.application_type).toBe("web");
  });

  it("uses forwarded host and protocol for proxy-facing hosted documents", () => {
    const metadata = oauthClientIdMetadataDocumentFromRequest({
      requestUrl: "/api/oauth/client-id-metadata/default.json",
      webRequest: new Request("http://127.0.0.1:3000/api/oauth/client-id-metadata/default.json", {
        headers: {
          "x-forwarded-host": "wsl-dev.tail5665af.ts.net",
          "x-forwarded-proto": "https",
          Host: "127.0.0.1:3000",
        },
      }),
      mountPrefix: "/api",
    });

    expect(metadata.client_id).toBe(
      "https://wsl-dev.tail5665af.ts.net/api/oauth/client-id-metadata/default.json",
    );
    expect(metadata.redirect_uris).toEqual([
      "https://wsl-dev.tail5665af.ts.net/api/oauth/callback",
    ]);
  });

  it("serves a hosted local document with portless loopback callbacks", () => {
    const metadata = oauthClientIdMetadataDocumentFromRequest({
      requestUrl: "/api/oauth/client-id-metadata/local.json",
      webRequest: new Request("http://127.0.0.1:3000/api/oauth/client-id-metadata/local.json", {
        headers: {
          "x-forwarded-host": "executor.sh",
          "x-forwarded-proto": "https",
          Host: "127.0.0.1:3000",
        },
      }),
      mountPrefix: "/api",
    });

    expect(metadata.client_id).toBe("https://executor.sh/api/oauth/client-id-metadata/local.json");
    expect(metadata.redirect_uris).toEqual([
      "http://127.0.0.1/api/oauth/callback",
      "http://localhost/api/oauth/callback",
      "http://[::1]/api/oauth/callback",
    ]);
    expect(metadata.application_type).toBe("native");
  });

  it("ignores a legacy executor_org query param when building redirect_uri", () => {
    const metadata = oauthClientIdMetadataDocumentFromRequest({
      requestUrl: "/api/oauth/client-id-metadata.json?executor_org=acme",
      webRequest: new Request("http://127.0.0.1:42384/api/oauth/client-id-metadata.json", {
        headers: { Host: "100.81.219.45:42384" },
      }),
      mountPrefix: "/api",
    });

    // A stray executor_org query param is inert: it stays on the client_id URL
    // (which is just the request URL) but never leaks into redirect_uri.
    expect(metadata.client_id).toBe(
      "http://100.81.219.45:42384/api/oauth/client-id-metadata.json?executor_org=acme",
    );
    expect(metadata.redirect_uris).toEqual(["http://100.81.219.45:42384/api/oauth/callback"]);
  });
});