import * as NodeServices from "@effect/platform-node/NodeServices";
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import * as Option from "effect/Option";
import * as PlatformError from "effect/PlatformError";
import * as HttpClient from "effect/unstable/http/HttpClient";

import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
import * as CliTokenManager from "./CliTokenManager.ts";

const unusedSecretStoreOperation = () => Effect.die("unused secret-store operation");

function makeSecretStore(
  overrides: Partial<ServerSecretStore.ServerSecretStore["Service"]>,
): ServerSecretStore.ServerSecretStore["Service"] {
  return {
    get: unusedSecretStoreOperation,
    set: unusedSecretStoreOperation,
    create: unusedSecretStoreOperation,
    getOrCreateRandom: unusedSecretStoreOperation,
    remove: unusedSecretStoreOperation,
    ...overrides,
  };
}

function makeTokenManager(secretStore: ServerSecretStore.ServerSecretStore["Service"]) {
  return CliTokenManager.make.pipe(
    Effect.provide(
      Layer.mergeAll(
        NodeServices.layer,
        Layer.succeed(ServerSecretStore.ServerSecretStore, secretStore),
        Layer.succeed(
          HttpClient.HttpClient,
          HttpClient.make(() => Effect.die("unused HTTP client")),
        ),
      ),
    ),
  );
}

describe("CloudCliTokenManager", () => {
  it("redacts OAuth endpoint credentials while retaining exact causes", () => {
    const tokenEndpoint =
      "https://user:password@auth.example.test/private/token?client_secret=secret#fragment";
    const redirectUri =
      "https://callback-user:callback-password@localhost/private/callback?code=secret#fragment";
    const cause = new Error("exchange failed");

    const refreshError = CliTokenManager.CloudCliCredentialRefreshError.fromStage({
      stage: "exchange-token",
      tokenEndpoint,
      cause,
    });
    const authorizationError = CliTokenManager.CloudCliAuthorizationError.fromStage({
      stage: "exchange-token",
      tokenEndpoint,
      redirectUri,
      cause,
    });
    const timeoutError = CliTokenManager.CloudCliAuthorizationTimeoutError.fromRedirectUri({
      redirectUri,
      timeoutMillis: 1000,
      cause,
    });

    expect(refreshError).toMatchObject({
      tokenEndpointInputLength: tokenEndpoint.length,
      tokenEndpointProtocol: "https:",
      tokenEndpointHostname: "auth.example.test",
      cause,
    });
    expect(authorizationError).toMatchObject({
      tokenEndpointInputLength: tokenEndpoint.length,
      tokenEndpointHostname: "auth.example.test",
      redirectUriInputLength: redirectUri.length,
      redirectUriHostname: "localhost",
      cause,
    });
    expect(timeoutError).toMatchObject({
      redirectUriInputLength: redirectUri.length,
      redirectUriHostname: "localhost",
      cause,
    });
    expect(refreshError.cause).toBe(cause);
    expect(authorizationError.cause).toBe(cause);
    expect(timeoutError.cause).toBe(cause);
    for (const error of [refreshError, authorizationError, timeoutError]) {
      expect(error).not.toHaveProperty("tokenEndpoint");
      expect(error).not.toHaveProperty("redirectUri");
      const serialized = JSON.stringify(error);
      for (const secret of [
        "user:password",
        "callback-user:callback-password",
        "/private/",
        "client_secret=secret",
        "code=secret",
        "#fragment",
      ]) {
        expect(error.message).not.toContain(secret);
        expect(serialized).not.toContain(secret);
      }
    }
  });

  it.effect("retains secret context and cause when credential removal fails", () => {
    const failure = new ServerSecretStore.SecretStoreRemoveError({
      secretName: "cloud-cli-oauth-token",
      secretPath: "/tmp/secrets/cloud-cli-oauth-token.bin",
      cause: PlatformError.systemError({
        _tag: "PermissionDenied",
        module: "FileSystem",
        method: "remove",
        pathOrDescriptor: "/tmp/secrets/cloud-cli-oauth-token.bin",
      }),
    });

    return Effect.gen(function* () {
      const tokens = yield* makeTokenManager(
        makeSecretStore({ remove: () => Effect.fail(failure) }),
      );
      const error = yield* Effect.flip(tokens.clear);

      expect(error).toMatchObject({
        _tag: "CloudCliCredentialRemovalError",
        secretName: "cloud-cli-oauth-token",
        cause: failure,
      });
      expect(error.message).toBe(
        "Could not remove the stored T3 Connect CLI credential cloud-cli-oauth-token.",
      );
    });
  });

  it.effect("classifies credential read failures without replacing the cause", () => {
    const failure = new ServerSecretStore.SecretStoreReadError({
      secretName: "cloud-cli-oauth-token",
      secretPath: "/tmp/secrets/cloud-cli-oauth-token.bin",
      cause: PlatformError.systemError({
        _tag: "PermissionDenied",
        module: "FileSystem",
        method: "readFile",
        pathOrDescriptor: "/tmp/secrets/cloud-cli-oauth-token.bin",
      }),
    });

    return Effect.gen(function* () {
      const tokens = yield* makeTokenManager(makeSecretStore({ get: () => Effect.fail(failure) }));
      const error = yield* Effect.flip(tokens.hasCredential);

      expect(error).toMatchObject({
        _tag: "CloudCliCredentialReadError",
        stage: "read-credential",
        secretName: "cloud-cli-oauth-token",
        cause: failure,
      });
      expect(error.message).toBe(
        "Could not inspect the stored T3 Connect CLI credential cloud-cli-oauth-token during read-credential.",
      );
    });
  });

  it.effect("classifies malformed persisted credentials as refresh decode failures", () =>
    Effect.gen(function* () {
      const tokens = yield* makeTokenManager(
        makeSecretStore({
          get: () =>
            Effect.succeed(Option.some(new TextEncoder().encode("not valid credential JSON"))),
        }),
      );
      const error = yield* Effect.flip(tokens.getExisting);

      expect(error).toMatchObject({
        _tag: "CloudCliCredentialRefreshError",
        stage: "decode-credential",
        secretName: "cloud-cli-oauth-token",
        cause: { _tag: "SchemaError" },
      });
      expect(error.message).toBe(
        "Could not refresh the T3 Connect CLI credential cloud-cli-oauth-token during decode-credential.",
      );
    }),
  );
});