import { describe, expect, it } from "@effect/vitest";
import { Effect } from "effect";

import {
  ConnectionId,
  CreateConnectionInput,
  TokenMaterial,
  createExecutor,
  makeTestConfig,
  Scope,
  ScopeId,
  SecretId,
  type ConnectionProvider,
  type SecretProvider,
  SetSecretInput,
  definePlugin,
} from "@executor-js/sdk";

import { openApiPlugin } from "./plugin";
import { OpenApiSourceBindingInput } from "./types";

const specJson = JSON.stringify({
  openapi: "3.0.0",
  info: { title: "Scoped Usage", version: "1.0.0" },
  paths: {
    "/ping": {
      get: { operationId: "ping", responses: { "200": { description: "ok" } } },
    },
  },
});

const memorySecretsPlugin = definePlugin(() => {
  const store = new Map<string, string>();

  const provider: SecretProvider = {
    key: "memory",
    writable: true,
    get: (id, scope) => Effect.sync(() => store.get(`${scope}\u0000${id}`) ?? null),
    set: (id, value, scope) =>
      Effect.sync(() => {
        store.set(`${scope}\u0000${id}`, value);
      }),
    delete: (id, scope) => Effect.sync(() => store.delete(`${scope}\u0000${id}`)),
  };

  return {
    id: "test-memory-secrets" as const,
    storage: () => ({}),
    secretProviders: [provider],
  };
});

const connectionProviderPlugin = definePlugin(() => {
  const provider: ConnectionProvider = {
    key: "test-oauth",
  };

  return {
    id: "test-connection-provider" as const,
    storage: () => ({}),
    connectionProviders: [provider],
  };
});

describe("OpenAPI usage scope isolation", () => {
  it.effect("secrets.usages does not expose binding rows outside the scope stack", () =>
    Effect.gen(function* () {
      const orgA = Scope.make({
        id: ScopeId.make("org-a"),
        name: "Org A",
        createdAt: new Date(),
      });
      const orgB = Scope.make({
        id: ScopeId.make("org-b"),
        name: "Org B",
        createdAt: new Date(),
      });
      const plugins = [memorySecretsPlugin(), openApiPlugin()] as const;
      const config = makeTestConfig({ scopes: [orgA], plugins });
      const orgAExec = yield* createExecutor({ ...config, scopes: [orgA] });
      const orgBExec = yield* createExecutor({ ...config, scopes: [orgB] });
      const secretId = SecretId.make("org-a-api-key");

      yield* orgAExec.secrets.set(
        SetSecretInput.make({
          id: secretId,
          scope: orgA.id,
          name: "Org A API Key",
          value: "secret",
          provider: "memory",
        }),
      );
      yield* orgBExec.secrets.set(
        SetSecretInput.make({
          id: secretId,
          scope: orgB.id,
          name: "Org B API Key",
          value: "different-secret",
          provider: "memory",
        }),
      );
      yield* orgAExec.openapi.addSpec({
        spec: specJson,
        scope: String(orgA.id),
        namespace: "private_source",
        baseUrl: "http://example.com",
      });
      yield* orgAExec.openapi.setSourceBinding(
        OpenApiSourceBindingInput.make({
          sourceId: "private_source",
          sourceScope: orgA.id,
          scope: orgA.id,
          slot: "header:authorization",
          value: { kind: "secret", secretId },
        }),
      );

      const usages = yield* orgBExec.secrets.usages(secretId);
      expect(usages).toEqual([]);
    }),
  );

  it.effect("connections.usages does not expose binding rows outside the scope stack", () =>
    Effect.gen(function* () {
      const orgA = Scope.make({
        id: ScopeId.make("org-a"),
        name: "Org A",
        createdAt: new Date(),
      });
      const orgB = Scope.make({
        id: ScopeId.make("org-b"),
        name: "Org B",
        createdAt: new Date(),
      });
      const plugins = [memorySecretsPlugin(), connectionProviderPlugin(), openApiPlugin()] as const;
      const config = makeTestConfig({ scopes: [orgA], plugins });
      const orgAExec = yield* createExecutor({ ...config, scopes: [orgA] });
      const orgBExec = yield* createExecutor({ ...config, scopes: [orgB] });
      const connectionId = ConnectionId.make("org-a-connection");

      yield* orgAExec.connections.create(
        CreateConnectionInput.make({
          id: connectionId,
          scope: orgA.id,
          provider: "test-oauth",
          identityLabel: "Org A connection",
          accessToken: TokenMaterial.make({
            secretId: SecretId.make("org-a-connection-access"),
            name: "Org A access",
            value: "access",
          }),
          refreshToken: null,
          expiresAt: null,
          oauthScope: null,
          providerState: null,
        }),
      );
      yield* orgBExec.connections.create(
        CreateConnectionInput.make({
          id: connectionId,
          scope: orgB.id,
          provider: "test-oauth",
          identityLabel: "Org B connection",
          accessToken: TokenMaterial.make({
            secretId: SecretId.make("org-b-connection-access"),
            name: "Org B access",
            value: "access",
          }),
          refreshToken: null,
          expiresAt: null,
          oauthScope: null,
          providerState: null,
        }),
      );

      yield* orgAExec.openapi.addSpec({
        spec: specJson,
        scope: String(orgA.id),
        namespace: "private_source",
        baseUrl: "http://example.com",
      });
      yield* orgAExec.openapi.setSourceBinding(
        OpenApiSourceBindingInput.make({
          sourceId: "private_source",
          sourceScope: orgA.id,
          scope: orgA.id,
          slot: "oauth:connection",
          value: { kind: "connection", connectionId },
        }),
      );

      const usages = yield* orgBExec.connections.usages(connectionId);
      expect(usages).toEqual([]);
    }),
  );
});