import { describe, expect, it } from "@effect/vitest";
import { ConnectionId, ScopeId, SecretId } from "@executor-js/sdk";

import {
  effectiveSourceCredentialBinding,
  missingSourceCredentialLabels,
  type SourceCredentialBindingRef,
  type SourceCredentialSlot,
} from "./source-credential-status-core";

const userScope = ScopeId.make("user");
const orgScope = ScopeId.make("org");
const scopeRanks = new Map([
  [userScope, 0],
  [orgScope, 1],
]);

const slots: readonly SourceCredentialSlot[] = [
  { kind: "secret", slot: "header:authorization", label: "Authorization" },
  { kind: "connection", slot: "auth:oauth2:connection", label: "OAuth sign-in" },
];

const bindings = (scopeId: ScopeId): readonly SourceCredentialBindingRef[] => [
  {
    slot: "header:authorization",
    scopeId,
    value: {
      kind: "secret",
      secretId: SecretId.make(`${scopeId}-token`),
    },
  },
  {
    slot: "auth:oauth2:connection",
    scopeId,
    value: {
      kind: "connection",
      connectionId: ConnectionId.make(`${scopeId}-connection`),
    },
  },
];

describe("source credential status", () => {
  it("treats inherited source-scope credentials as satisfying a user target", () => {
    expect(
      missingSourceCredentialLabels({
        slots,
        bindings: bindings(orgScope),
        targetScope: userScope,
        scopeRanks,
        liveConnectionIds: [ConnectionId.make("org-connection")],
      }),
    ).toEqual([]);
  });

  it("does not let inner-scope credentials satisfy an outer target", () => {
    expect(
      missingSourceCredentialLabels({
        slots,
        bindings: bindings(userScope),
        targetScope: orgScope,
        scopeRanks,
      }),
    ).toEqual(["Authorization", "OAuth sign-in"]);
  });

  it("treats stale connection bindings as missing", () => {
    expect(
      missingSourceCredentialLabels({
        slots,
        bindings: bindings(userScope),
        targetScope: userScope,
        scopeRanks,
        liveConnectionIds: [],
      }),
    ).toEqual(["OAuth sign-in"]);
  });

  it("prefers the inner exact binding over inherited credentials", () => {
    const binding = effectiveSourceCredentialBinding(
      [...bindings(orgScope), ...bindings(userScope)],
      "header:authorization",
      userScope,
      scopeRanks,
    );

    expect(binding?.scopeId).toEqual(userScope);
  });
});