// ---------------------------------------------------------------------------
// The wire half of the `Redacted` credential contract, asserted against a real
// server rather than against types.
//
// A `Redacted` that never unwraps is not "safe", it is broken: the wrapper's
// toString/toJSON render the literal "<redacted>", so a missed unwrap does not
// throw — it sends that literal upstream and comes back as a 401 with nothing
// pointing at the cause. This asserts the SECRET reached the wire, byte for
// byte, through the rendering path every HTTP plugin shares.
//
// The other half (the credential a plugin receives still serializes redacted)
// lives in `packages/core/sdk/src/redacted-credential.test.ts`, where the
// plugin contract itself is defined.
// ---------------------------------------------------------------------------

import { describe, expect, it } from "@effect/vitest";
import { Effect, Schema } from "effect";
import { HttpApi, HttpApiBuilder, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
import { FetchHttpClient, HttpServerRequest } from "effect/unstable/http";

import {
  createExecutor,
  AuthTemplateSlug,
  ConnectionName,
  IntegrationSlug,
  ToolAddress,
} from "@executor-js/sdk";
import { makeTestConfig, memoryCredentialsPlugin } from "@executor-js/sdk/testing";
import {
  serveOpenApiHttpApiTestServer,
  unwrapInvocation,
} from "@executor-js/plugin-openapi/testing";

import { openApiPlugin } from "./plugin";
import { type AuthenticationInput } from "./types";

// Synthetic throughout: not shaped like any real provider's keys, and the
// assertions are exact-match, so a redacted rendering cannot pass.
const API_SECRET = "synthetic-apikey-value";
const TEAM_SECRET = "synthetic-team-value";

const EchoHeaders = Schema.Struct({
  authorization: Schema.optional(Schema.String),
  "x-team": Schema.optional(Schema.String),
});

const EchoGroup = HttpApiGroup.make("echo").add(
  HttpApiEndpoint.get("headers", "/echo", { success: EchoHeaders }),
);
const EchoApi = HttpApi.make("echoApi").add(EchoGroup);

const EchoGroupLive = HttpApiBuilder.group(EchoApi, "echo", (handlers) =>
  handlers.handle("headers", () =>
    Effect.gen(function* () {
      const request = yield* HttpServerRequest.HttpServerRequest;
      return EchoHeaders.make({
        authorization: request.headers["authorization"],
        "x-team": request.headers["x-team"],
      });
    }),
  ),
);

const serveEcho = () =>
  serveOpenApiHttpApiTestServer({ api: EchoApi, handlersLayer: EchoGroupLive });

// Two placements over two DISTINCT inputs: proves each variable is unwrapped
// against its own entry, not that one lucky value leaked through everywhere.
const twoInputTemplate: AuthenticationInput = {
  slug: AuthTemplateSlug.make("api_key"),
  type: "apiKey",
  headers: {
    authorization: ["Bearer ", { type: "variable" as const, name: "token" }],
    "x-team": [{ type: "variable" as const, name: "team" }],
  },
};

const INTEG = IntegrationSlug.make("echo_api");
const TEMPLATE = AuthTemplateSlug.make("api_key");
const ECHO = "echo.headers";

describe("Redacted credentials on the wire", () => {
  it.effect("every rendered placement carries the real secret, not the wrapper", () =>
    Effect.scoped(
      Effect.gen(function* () {
        const server = yield* serveEcho();
        const executor = yield* createExecutor(
          makeTestConfig({
            plugins: [
              openApiPlugin({ httpClientLayer: FetchHttpClient.layer }),
              memoryCredentialsPlugin(),
            ] as const,
          }),
        );

        yield* executor.openapi.addSpec({
          spec: { kind: "blob", value: server.specJson },
          slug: "echo_api",
          baseUrl: server.baseUrl,
          authenticationTemplate: [twoInputTemplate],
        });

        yield* executor.connections.create({
          owner: "org",
          name: ConnectionName.make("main"),
          integration: INTEG,
          template: TEMPLATE,
          values: { token: API_SECRET, team: TEAM_SECRET },
        });

        const echoed = unwrapInvocation(
          yield* executor.execute(ToolAddress.make(`tools.echo_api.org.main.${ECHO}`), {}),
        ).data as { authorization?: string; "x-team"?: string };

        expect(echoed.authorization).toBe(`Bearer ${API_SECRET}`);
        expect(echoed["x-team"]).toBe(TEAM_SECRET);
        // The failure mode this test exists for: a missed unwrap sends the
        // wrapper's rendering, and the request still leaves the process.
        expect(echoed.authorization).not.toContain("<redacted>");
      }),
    ),
  );
});