// ---------------------------------------------------------------------------
// The single slice point for an inbound bearer credential.
//
// Both cloud bearer planes (the WorkOS api-key/session resolver and the MCP
// edge auth) route through this helper, so this is where the guarantee that a
// raw header never becomes a bare string is asserted. The header shapes are
// enumerated because each one means something different upstream — `Absent`
// falls through to the cookie session while `NotBearer` is a rejection, and
// `Empty` is a shape no call site can recover once the token is wrapped.
// ---------------------------------------------------------------------------

import { describe, expect, it } from "@effect/vitest";
import { Redacted } from "effect";

import { bearerCredential, isBearerPresent, isJwtBearer } from "./bearer";

// Synthetic, and asserted by exact match, so "<redacted>" cannot pass for it.
const TOKEN_SECRET = "synthetic-inbound-token";

// `Headers` strips trailing ASCII optional-whitespace, so a header written
// `"Bearer "` arrives as `"Bearer"` — the prefix no longer matches and the
// shape is NotBearer. A token that is only whitespace `Headers` preserves (a
// non-breaking space) is what actually reaches the Empty branch.
const NON_BREAKING_SPACE = String.fromCharCode(0xa0);

const requestWith = (headers: Record<string, string>) =>
  new Request("https://executor.test/api/tools", { headers });

describe("bearerCredential", () => {
  it("wraps the sliced token and keeps its real bytes", () => {
    const credential = bearerCredential(requestWith({ authorization: `Bearer ${TOKEN_SECRET}` }));

    expect(isBearerPresent(credential)).toBe(true);
    if (!isBearerPresent(credential)) return;
    expect(Redacted.isRedacted(credential.token)).toBe(true);
    expect(Redacted.value(credential.token)).toBe(TOKEN_SECRET);

    // What a log line, a span attribute, or an error payload would produce.
    const serialized = JSON.stringify(credential);
    expect(serialized).not.toContain(TOKEN_SECRET);
    expect(serialized).toContain("<redacted>");
  });

  it("trims surrounding whitespace off the token", () => {
    const credential = bearerCredential(requestWith({ authorization: `Bearer  ${TOKEN_SECRET} ` }));

    expect(isBearerPresent(credential)).toBe(true);
    if (!isBearerPresent(credential)) return;
    expect(Redacted.value(credential.token)).toBe(TOKEN_SECRET);
  });

  it("distinguishes a missing header, a non-Bearer scheme, and an empty token", () => {
    expect(bearerCredential(requestWith({}))).toEqual({ _tag: "Absent" });
    expect(bearerCredential(requestWith({ authorization: `Basic ${TOKEN_SECRET}` }))).toEqual({
      _tag: "NotBearer",
    });
    // A bare scheme with nothing after it: the trailing space is stripped
    // before this code sees it, so it never matches the prefix.
    expect(bearerCredential(requestWith({ authorization: "Bearer " }))).toEqual({
      _tag: "NotBearer",
    });
    expect(
      bearerCredential(requestWith({ authorization: `Bearer ${NON_BREAKING_SPACE}` })),
    ).toEqual({ _tag: "Empty" });
  });
});

describe("isJwtBearer", () => {
  it("splits three-segment access tokens from api keys without unwrapping at the call site", () => {
    expect(isJwtBearer(Redacted.make("header.payload.signature"))).toBe(true);
    expect(isJwtBearer(Redacted.make(TOKEN_SECRET))).toBe(false);
    expect(isJwtBearer(Redacted.make("header.payload"))).toBe(false);
    expect(isJwtBearer(Redacted.make("a.b.c.d"))).toBe(false);
  });
});