import { describe, expect, it } from "@effect/vitest";

import type { LocalWorkspacePolicy } from "#schema";
import {
  PolicyIdSchema,
  SourceIdSchema,
  WorkspaceIdSchema,
} from "#schema";

import {
  evaluateInvocationPolicy,
  type InvocationDescriptor,
} from "./invocation-policy-engine";

const workspaceId = WorkspaceIdSchema.make("ws_policy_engine");
const sourceId = SourceIdSchema.make("src_policy_engine");

const now = 1_700_000_000_000;

const baseDescriptor: InvocationDescriptor = {
  toolPath: "vercel.api.dns.createRecord",
  sourceId,
  sourceName: "Vercel",
  sourceKind: "openapi",
  sourceNamespace: "vercel.api.dns",
  operationKind: "write",
  interaction: "required",
  approvalLabel: "POST /v10/domains/{domain}/records",
};

const basePolicy = (
  patch: Partial<LocalWorkspacePolicy> = {},
): LocalWorkspacePolicy => ({
  id: PolicyIdSchema.make(`pol_${Math.random().toString(36).slice(2, 8)}`),
  key: "vercel-dns",
  workspaceId,
  resourcePattern: "vercel.api.dns.createRecord",
  effect: "allow",
  approvalMode: "auto",
  priority: 0,
  enabled: true,
  createdAt: now,
  updatedAt: now,
  ...patch,
});

describe("invocation-policy-engine", () => {
  it("allows read requests by default", () => {
    const decision = evaluateInvocationPolicy({
      descriptor: {
        ...baseDescriptor,
        toolPath: "vercel.api.dns.getRecords",
        operationKind: "read",
        interaction: "auto",
        approvalLabel: "GET /v4/domains/{domain}/records",
      },
      args: {},
      policies: [],
      context: {
        workspaceId,
      },
    });

    expect(decision.kind).toBe("allow");
  });

  it("requires interaction for mutating requests by default", () => {
    const decision = evaluateInvocationPolicy({
      descriptor: baseDescriptor,
      args: { domain: "testing.executor.sh" },
      policies: [],
      context: {
        workspaceId,
      },
    });

    expect(decision.kind).toBe("require_interaction");
  });

  it("allows a mutating request when a matching policy exists", () => {
    const decision = evaluateInvocationPolicy({
      descriptor: baseDescriptor,
      args: { domain: "testing.executor.sh" },
      policies: [basePolicy({
        id: PolicyIdSchema.make("pol_allow"),
      })],
      context: {
        workspaceId,
      },
    });

    expect(decision.kind).toBe("allow");
    expect(decision.matchedPolicyId).toBe("pol_allow");
  });

  it("prefers a more specific deny over a broad allow", () => {
    const decision = evaluateInvocationPolicy({
      descriptor: baseDescriptor,
      args: { domain: "testing.executor.sh" },
      policies: [
        basePolicy({
          id: PolicyIdSchema.make("pol_allow_all_vercel"),
          key: "allow-all-vercel",
          resourcePattern: "vercel.api.*",
          effect: "allow",
          priority: 0,
        }),
        basePolicy({
          id: PolicyIdSchema.make("pol_deny_create_record"),
          key: "deny-create-record",
          effect: "deny",
          priority: 1,
        }),
      ],
      context: {
        workspaceId,
      },
    });

    expect(decision.kind).toBe("deny");
    expect(decision.matchedPolicyId).toBe("pol_deny_create_record");
  });

  it("ignores disabled policies", () => {
    const decision = evaluateInvocationPolicy({
      descriptor: baseDescriptor,
      args: { domain: "testing.executor.sh" },
      policies: [basePolicy({
        id: PolicyIdSchema.make("pol_disabled"),
        enabled: false,
      })],
      context: {
        workspaceId,
      },
    });

    expect(decision.kind).toBe("require_interaction");
    expect(decision.matchedPolicyId).toBeNull();
  });
});