import { describe, expect, it } from "@effect/vitest";
import { Effect, Layer, Redacted } from "effect";

import { ApiKeyService } from "../auth/api-keys";
import { UserStoreService } from "../auth/context";
import { WorkOSClient, type WorkOSClientService } from "../auth/workos";
import { resolveProtectedPrincipal } from "./protected";

const createdAt = new Date("2026-01-01T00:00:00.000Z");

// Records every key the resolver hands the service, so the test can assert the
// bytes that crossed the seam rather than only the principal that came back.
const seenKeys: string[] = [];

const stubApiKeys = Layer.succeed(ApiKeyService)({
  validate: (value: Redacted.Redacted<string>) =>
    Effect.sync(() => {
      const key = Redacted.value(value);
      seenKeys.push(key);
      return key === "valid_user_key"
        ? {
            accountId: "user_123",
            organizationId: "org_123",
            keyId: "api_key_123",
          }
        : null;
    }),
  listUserKeys: () => Effect.succeed([]),
  createUserKey: () => Effect.die("protected API auth test does not create API keys"),
  revokeUserKey: () => Effect.void,
});

const stubWorkOS = Layer.succeed(
  WorkOSClient,
  new Proxy({} as WorkOSClientService, {
    get: (_target, prop) => {
      if (prop === "listUserMemberships") {
        return (userId: string) =>
          Effect.succeed({
            data:
              userId === "user_123"
                ? [{ userId, organizationId: "org_123", status: "active" }]
                : [],
          });
      }
      return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);
    },
  }),
);

const stubUsers = Layer.succeed(UserStoreService)({
  use: (fn) =>
    Effect.promise(() =>
      fn({
        ensureAccount: async (id: string) => ({ id, createdAt }),
        getAccount: async (id: string) => ({ id, createdAt }),
        upsertOrganization: async (org: { id: string; name: string }) => ({
          ...org,
          slug: `org-slug-${org.id}`,
          createdAt,
        }),
        getOrganization: async (id: string) => ({
          id,
          name: `Org ${id}`,
          slug: `org-slug-${id}`,
          createdAt,
        }),
        getOrganizationBySlug: async (slug: string) => ({
          id: "org_by_slug",
          name: `Org ${slug}`,
          slug,
          createdAt,
        }),
        deleteOrganizationCascade: async () => {},
      }),
    ),
});

const run = (request: Request) =>
  resolveProtectedPrincipal(request).pipe(
    Effect.provide(Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers)),
  );

describe("protected API key auth", () => {
  it.effect("resolves a valid bearer API key into protected identity", () =>
    Effect.gen(function* () {
      seenKeys.length = 0;
      const identity = yield* run(
        new Request("https://executor.test/api/tools", {
          headers: { authorization: "Bearer valid_user_key" },
        }),
      );

      // The key the header carried reached the service intact — a `Redacted`
      // that lost its bytes would render "<redacted>" here and reject every
      // caller, and a missed wrap would not be visible in the principal alone.
      expect(seenKeys).toEqual(["valid_user_key"]);

      expect(identity).toEqual({
        accountId: "user_123",
        organizationId: "org_123",
        organizationName: "Org org_123",
        organizationSlug: "org-slug-org_123",
        email: "",
        name: null,
        avatarUrl: null,
        roles: [],
      });
    }),
  );

  it.effect("rejects invalid bearer API keys", () =>
    Effect.gen(function* () {
      const error = yield* Effect.flip(
        run(
          new Request("https://executor.test/api/tools", {
            headers: { authorization: "Bearer invalid_user_key" },
          }),
        ),
      );

      // The resolver now raises the SHARED `Unauthorized` carrying the same
      // machine code; cloud's failure strategy renders it as the byte-identical
      // 401 `{ error: "Invalid API key", code: "invalid_api_key" }`.
      expect(error).toMatchObject({
        _tag: "Unauthorized",
        code: "invalid_api_key",
        message: "Invalid API key",
      });
    }),
  );

  it.effect("keeps the header-shape rejections distinct and never validates them", () =>
    Effect.gen(function* () {
      seenKeys.length = 0;

      // A non-Bearer scheme and an empty Bearer token are separate machine
      // codes; neither is a credential, so neither reaches the service.
      const notBearer = yield* Effect.flip(
        run(
          new Request("https://executor.test/api/tools", {
            headers: { authorization: "Basic valid_user_key" },
          }),
        ),
      );
      expect(notBearer).toMatchObject({
        _tag: "Unauthorized",
        code: "invalid_authorization_header",
      });

      // `Headers` strips trailing ASCII whitespace, so `"Bearer "` would arrive
      // as a bare `"Bearer"` and read as NotBearer. A non-breaking space
      // survives normalization and is what reaches the empty-token branch.
      const empty = yield* Effect.flip(
        run(
          new Request("https://executor.test/api/tools", {
            headers: { authorization: `Bearer ${String.fromCharCode(0xa0)}` },
          }),
        ),
      );
      expect(empty).toMatchObject({ _tag: "Unauthorized", code: "invalid_api_key" });

      expect(seenKeys).toEqual([]);
    }),
  );
});