import { describe, it, expect } from "@effect/vitest";
import { Effect } from "effect";

import { ProviderKey, ToolAddress, createExecutor } from "@executor-js/sdk";
import { makeInMemoryBlobStore, pluginBlobStore } from "@executor-js/sdk/core";
import { makeTestConfig } from "@executor-js/sdk/testing";

import { makeOnePasswordStore, onepasswordPlugin, resolveConfiguredRef } from "./plugin";
import type { OnePasswordService } from "./service";
import { OnePasswordError } from "./errors";
import { OnePasswordConfig, DesktopAppAuth } from "./types";

// removed: v1 routed configure/removeConfig through an explicit `ScopeId`
// (`executor.onepassword.configure(config, ScopeId.make("test-scope"))`) and
// asserted provider registration via `executor.secrets.providers()`. v2 deletes
// the scope stack and the secrets table: config is a single owner-partitioned
// blob the extension derives from the executor's owner binding, and credential
// providers are discovered through `executor.providers.list()`.

const ONEPASSWORD = ProviderKey.make("onepassword");

const twoVaultConfig = OnePasswordConfig.make({
  auth: DesktopAppAuth.make({
    kind: "desktop-app",
    accountName: "my.1password.com",
  }),
  vaults: [
    { id: "vault-123", name: "Personal" },
    { id: "vault-456", name: "Work" },
  ],
  name: "1Password",
});

describe("onepassword plugin", () => {
  it.effect("registers onepassword as a credential provider", () =>
    Effect.gen(function* () {
      const executor = yield* createExecutor(
        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
      );
      const providers = yield* executor.providers.list();
      expect(providers).toContain(ONEPASSWORD);
    }),
  );

  it.effect("configure / getConfig / removeConfig round-trip via blob store", () =>
    Effect.gen(function* () {
      const executor = yield* createExecutor(
        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
      );

      const initial = yield* executor.onepassword.getConfig();
      expect(initial).toBeNull();

      yield* executor.onepassword.configure(twoVaultConfig);

      const loaded = yield* executor.onepassword.getConfig();
      expect(loaded?.vaults).toEqual([
        { id: "vault-123", name: "Personal" },
        { id: "vault-456", name: "Work" },
      ]);
      expect(loaded?.name).toBe("1Password");
      expect(loaded?.auth.kind).toBe("desktop-app");

      yield* executor.onepassword.removeConfig();
      const afterRemove = yield* executor.onepassword.getConfig();
      expect(afterRemove).toBeNull();
    }),
  );

  it.effect("getConfig redacts the service-account token", () =>
    Effect.gen(function* () {
      const executor = yield* createExecutor(
        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
      );

      yield* executor.onepassword.configure(
        OnePasswordConfig.make({
          auth: { kind: "service-account", token: "super-secret-token" },
          vaults: [{ id: "vault-123", name: "CI" }],
          name: "CI",
        }),
      );

      const loaded = yield* executor.onepassword.getConfig();
      expect(loaded?.auth.kind).toBe("service-account");
      // The token must never be surfaced through the redacted projection.
      expect(JSON.stringify(loaded)).not.toContain("super-secret-token");
    }),
  );

  it.effect("exposes provider configuration as agent-callable static tools", () =>
    Effect.gen(function* () {
      const executor = yield* createExecutor(
        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
      );

      const configured = yield* executor.execute(
        ToolAddress.make("executor.onepassword.configure"),
        {
          auth: { kind: "desktop-app", accountName: "my.1password.com" },
          vaults: [
            { id: "vault-123", name: "Personal" },
            { id: "vault-456", name: "Work" },
          ],
          name: "1Password",
        },
        { onElicitation: "accept-all" },
      );

      expect(configured).toEqual({ ok: true, data: { configured: true } });
      expect(
        yield* executor.execute(ToolAddress.make("executor.onepassword.getConfig"), {}),
      ).toMatchObject({
        ok: true,
        data: {
          config: {
            vaults: [
              { id: "vault-123", name: "Personal" },
              { id: "vault-456", name: "Work" },
            ],
            name: "1Password",
          },
        },
      });

      const removed = yield* executor.execute(
        ToolAddress.make("executor.onepassword.removeConfig"),
        {},
        { onElicitation: "accept-all" },
      );

      expect(removed).toEqual({ ok: true, data: { removed: true } });
      expect(yield* executor.onepassword.getConfig()).toBeNull();
    }),
  );

  it.effect("status reports not-configured before configure", () =>
    Effect.gen(function* () {
      const executor = yield* createExecutor(
        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
      );
      const status = yield* executor.onepassword.status();
      expect(status.connected).toBe(false);
      expect(status.error).toBe("Not configured");
    }),
  );
});

// ---------------------------------------------------------------------------
// Stored-config compatibility — blobs written before multi-vault support hold
// `{ auth, vaultId, name }`. Reads normalize that to a one-element vaults
// array; the next save writes the current shape.
// ---------------------------------------------------------------------------

describe("onepassword store", () => {
  const makeStore = () => {
    const blobs = pluginBlobStore(
      makeInMemoryBlobStore(),
      { org: "org_test", user: null },
      "onepassword",
    );
    return { blobs, store: makeOnePasswordStore(blobs) };
  };

  it.effect("upgrades a legacy single-vault blob on read", () =>
    Effect.gen(function* () {
      const { blobs, store } = makeStore();
      yield* blobs.put(
        "config",
        JSON.stringify({
          auth: { kind: "desktop-app", accountName: "my.1password.com" },
          vaultId: "vault-123",
          name: "Personal",
        }),
        { owner: "org" },
      );

      const config = yield* store.getConfig();
      expect(config).toEqual({
        auth: { kind: "desktop-app", accountName: "my.1password.com" },
        vaults: [{ id: "vault-123", name: "Personal" }],
        name: "Personal",
      });
    }),
  );

  it.effect("persists and reads back the multi-vault shape", () =>
    Effect.gen(function* () {
      const { store } = makeStore();
      yield* store.saveConfig(twoVaultConfig, "org");
      const config = yield* store.getConfig();
      expect(config).toEqual(twoVaultConfig);
    }),
  );
});

// ---------------------------------------------------------------------------
// Explicit ref resolution — vault-qualified refs resolve directly; bare refs
// must locate exactly one item, and a multi-vault match is an explicit
// ambiguity, never a precedence pick.
// ---------------------------------------------------------------------------

const fakeService = (
  itemsByVault: Readonly<Record<string, readonly { id: string; title: string }[]>>,
  onResolve?: (uri: string) => void,
): OnePasswordService => ({
  resolveSecret: (uri) => {
    onResolve?.(uri);
    return Effect.succeed(`secret:${uri}`);
  },
  listVaults: () => Effect.succeed(Object.keys(itemsByVault).map((id) => ({ id, title: id }))),
  listItems: (vaultId) => {
    const items = itemsByVault[vaultId];
    return items === undefined
      ? Effect.fail(new OnePasswordError({ operation: "item listing", message: "no such vault" }))
      : Effect.succeed(items);
  },
});

describe("resolveConfiguredRef", () => {
  it.effect("resolves a fully-qualified op:// URI in a configured vault as-is", () =>
    Effect.gen(function* () {
      const svc = fakeService({});
      const result = yield* resolveConfiguredRef(
        svc,
        twoVaultConfig,
        "op://vault-456/item-abc/password",
      );
      expect(result).toEqual({
        kind: "resolved",
        value: "secret:op://vault-456/item-abc/password",
      });
    }),
  );

  it.effect("appends the credential field to a picker-shaped op://vault/item ref", () =>
    Effect.gen(function* () {
      const svc = fakeService({});
      const result = yield* resolveConfiguredRef(svc, twoVaultConfig, "op://vault-123/item-abc");
      expect(result).toEqual({
        kind: "resolved",
        value: "secret:op://vault-123/item-abc/credential",
      });
    }),
  );

  it.effect("accepts an op:// URI addressed by vault name", () =>
    Effect.gen(function* () {
      const svc = fakeService({});
      const result = yield* resolveConfiguredRef(svc, twoVaultConfig, "op://Work/item/password");
      expect(result).toEqual({ kind: "resolved", value: "secret:op://Work/item/password" });
    }),
  );

  it.effect("reports an op:// URI outside the configured vaults", () =>
    Effect.gen(function* () {
      const svc = fakeService({});
      const result = yield* resolveConfiguredRef(
        svc,
        twoVaultConfig,
        "op://vault-999/item/password",
      );
      expect(result).toEqual({ kind: "outside-vaults" });
    }),
  );

  it.effect("resolves a bare ref that matches exactly one item across vaults", () =>
    Effect.gen(function* () {
      const svc = fakeService({
        "vault-123": [{ id: "item-1", title: "GitHub Token" }],
        "vault-456": [{ id: "item-2", title: "Stripe Key" }],
      });
      const result = yield* resolveConfiguredRef(svc, twoVaultConfig, "GitHub Token");
      expect(result).toEqual({
        kind: "resolved",
        value: "secret:op://vault-123/item-1/credential",
      });
    }),
  );

  it.effect("fails a bare ref that matches in two vaults with the vaults named", () =>
    Effect.gen(function* () {
      const svc = fakeService({
        "vault-123": [{ id: "item-1", title: "GitHub Token" }],
        "vault-456": [{ id: "item-2", title: "GitHub Token" }],
      });
      const result = yield* resolveConfiguredRef(svc, twoVaultConfig, "GitHub Token");
      expect(result).toEqual({
        kind: "ambiguous",
        matches: [
          {
            vaultId: "vault-123",
            vaultName: "Personal",
            itemId: "item-1",
            itemTitle: "GitHub Token",
          },
          { vaultId: "vault-456", vaultName: "Work", itemId: "item-2", itemTitle: "GitHub Token" },
        ],
      });
    }),
  );

  it.effect("treats duplicate titles inside one vault as ambiguous too", () =>
    Effect.gen(function* () {
      const svc = fakeService({
        "vault-123": [
          { id: "item-1", title: "GitHub Token" },
          { id: "item-9", title: "GitHub Token" },
        ],
        "vault-456": [],
      });
      const result = yield* resolveConfiguredRef(svc, twoVaultConfig, "GitHub Token");
      expect(result.kind).toBe("ambiguous");
    }),
  );

  it.effect("reports not-found for a bare ref matching nothing", () =>
    Effect.gen(function* () {
      const svc = fakeService({ "vault-123": [], "vault-456": [] });
      const result = yield* resolveConfiguredRef(svc, twoVaultConfig, "missing");
      expect(result).toEqual({ kind: "not-found" });
    }),
  );
});