import { describe, expect, it } from "@effect/vitest";
import { EnvironmentId, ThreadId } from "@t3tools/contracts";
import type { RelayAgentActivityAggregateState } from "@t3tools/contracts/relay";
import * as Redacted from "effect/Redacted";

import {
  makeApnsDeliveryJobPayload,
  signApnsDeliveryJob,
  verifySignedApnsDeliveryJob,
} from "./apnsDeliveryJobs.ts";

const secret = Redacted.make("queue-signing-secret");
const aggregate: RelayAgentActivityAggregateState = {
  title: "T3 Code",
  subtitle: "Agent work in progress",
  activeCount: 1,
  updatedAt: "2026-05-25T00:00:00.000Z",
  activities: [
    {
      environmentId: EnvironmentId.make("env"),
      threadId: ThreadId.make("thread"),
      projectTitle: "Project",
      threadTitle: "Thread",
      modelTitle: "gpt-5.4",
      phase: "running",
      status: "Working",
      updatedAt: "2026-05-25T00:00:00.000Z",
      deepLink: "/threads/env/thread",
    },
  ],
};

const notification = {
  title: "Thread",
  body: "Input: Project",
  environmentId: "env",
  threadId: "thread",
  deepLink: "/threads/env/thread",
};

describe("apnsDeliveryJobs", () => {
  it("rejects tampered signed queue jobs", () => {
    const payload = makeApnsDeliveryJobPayload({
      kind: "live_activity_end",
      userId: "user-1",
      deviceId: "device-1",
      token: "token-1",
      aggregate: null,
      createdAt: "2026-05-25T00:00:00.000Z",
      expiresAt: "2026-05-25T00:05:00.000Z",
      jobId: "job-1",
    });
    const signed = signApnsDeliveryJob({ secret, payload });
    const tampered = {
      ...signed,
      payload: {
        ...signed.payload,
        target: {
          ...signed.payload.target,
          token: "attacker-token",
        },
      },
    };

    const result = verifySignedApnsDeliveryJob({
      secret,
      job: tampered,
      nowMs: 0,
    });

    expect(result).toMatchObject({
      _tag: "ApnsDeliveryJobSignatureInvalid",
      jobId: "job-1",
      kind: "live_activity_end",
      userId: "user-1",
      deviceId: "device-1",
      message: "Invalid signature for APNs delivery job job-1.",
    });
  });

  it("rejects Live Activity start jobs without aggregate state", () => {
    const payload = makeApnsDeliveryJobPayload({
      kind: "live_activity_start",
      userId: "user-1",
      deviceId: "device-1",
      token: "token-1",
      aggregate: null,
      createdAt: "2026-05-25T00:00:00.000Z",
      expiresAt: "2026-05-25T00:05:00.000Z",
      jobId: "job-start-invalid",
    });
    const signed = signApnsDeliveryJob({ secret, payload });

    const result = verifySignedApnsDeliveryJob({
      secret,
      job: signed,
      nowMs: 0,
    });

    expect(result).toMatchObject({
      _tag: "ApnsDeliveryJobLiveActivityAggregateMissing",
      jobId: "job-start-invalid",
      kind: "live_activity_start",
      userId: "user-1",
      deviceId: "device-1",
      message: "APNs live activity start job job-start-invalid requires an aggregate.",
    });
  });

  it("rejects push notification jobs carrying aggregate state", () => {
    const payload = makeApnsDeliveryJobPayload({
      kind: "push_notification",
      userId: "user-1",
      deviceId: "device-1",
      token: "token-1",
      aggregate,
      notification,
      createdAt: "2026-05-25T00:00:00.000Z",
      expiresAt: "2026-05-25T00:05:00.000Z",
      jobId: "job-push-invalid",
    });
    const signed = signApnsDeliveryJob({ secret, payload });

    const result = verifySignedApnsDeliveryJob({
      secret,
      job: signed,
      nowMs: 0,
    });

    expect(result).toMatchObject({
      _tag: "ApnsDeliveryJobPushNotificationAggregateUnexpected",
      jobId: "job-push-invalid",
      userId: "user-1",
      deviceId: "device-1",
      message: "APNs push notification job job-push-invalid must not carry aggregate state.",
    });
  });

  it("accepts minimal kind-specific signed queue jobs", () => {
    const pushPayload = makeApnsDeliveryJobPayload({
      kind: "push_notification",
      userId: "user-1",
      deviceId: "device-1",
      token: "token-1",
      aggregate: null,
      notification,
      createdAt: "2026-05-25T00:00:00.000Z",
      expiresAt: "2026-05-25T00:05:00.000Z",
      jobId: "job-push-valid",
    });
    const liveActivityPayload = makeApnsDeliveryJobPayload({
      kind: "live_activity_update",
      userId: "user-1",
      deviceId: "device-1",
      token: "token-1",
      aggregate,
      createdAt: "2026-05-25T00:00:00.000Z",
      expiresAt: "2026-05-25T00:05:00.000Z",
      jobId: "job-live-valid",
    });

    expect(
      verifySignedApnsDeliveryJob({
        secret,
        job: signApnsDeliveryJob({ secret, payload: pushPayload }),
        nowMs: 0,
      }),
    ).toEqual(pushPayload);
    expect(
      verifySignedApnsDeliveryJob({
        secret,
        job: signApnsDeliveryJob({ secret, payload: liveActivityPayload }),
        nowMs: 0,
      }),
    ).toEqual(liveActivityPayload);
  });

  it("rejects jobs with invalid or overlong time windows", () => {
    const basePayload = makeApnsDeliveryJobPayload({
      kind: "live_activity_end",
      userId: "user-1",
      deviceId: "device-1",
      token: "token-1",
      aggregate: null,
      createdAt: "2026-05-25T00:00:00.000Z",
      expiresAt: "2026-05-25T00:10:00.000Z",
      jobId: "job-window",
    });
    const invalidCreatedAt = {
      ...basePayload,
      createdAt: "not-a-date",
    };
    const invertedWindow = {
      ...basePayload,
      expiresAt: "2026-05-24T23:59:59.000Z",
    };
    const overlongWindow = {
      ...basePayload,
      expiresAt: "2026-05-25T00:10:01.000Z",
    };

    expect(
      verifySignedApnsDeliveryJob({
        secret,
        job: signApnsDeliveryJob({ secret, payload: invalidCreatedAt }),
        nowMs: 0,
      }),
    ).toMatchObject({
      _tag: "ApnsDeliveryJobCreatedAtInvalid",
      jobId: "job-window",
      kind: "live_activity_end",
      userId: "user-1",
      deviceId: "device-1",
      createdAt: "not-a-date",
      message: "APNs delivery job job-window has invalid creation time not-a-date.",
    });
    expect(
      verifySignedApnsDeliveryJob({
        secret,
        job: signApnsDeliveryJob({ secret, payload: invertedWindow }),
        nowMs: 0,
      }),
    ).toMatchObject({
      _tag: "ApnsDeliveryJobTimeWindowInvalid",
      jobId: "job-window",
      kind: "live_activity_end",
      userId: "user-1",
      deviceId: "device-1",
      createdAt: "2026-05-25T00:00:00.000Z",
      expiresAt: "2026-05-24T23:59:59.000Z",
      message:
        "APNs delivery job job-window has invalid time window 2026-05-25T00:00:00.000Z to 2026-05-24T23:59:59.000Z.",
    });
    expect(
      verifySignedApnsDeliveryJob({
        secret,
        job: signApnsDeliveryJob({ secret, payload: overlongWindow }),
        nowMs: 0,
      }),
    ).toMatchObject({
      _tag: "ApnsDeliveryJobTimeWindowTooLong",
      jobId: "job-window",
      kind: "live_activity_end",
      userId: "user-1",
      deviceId: "device-1",
      createdAt: "2026-05-25T00:00:00.000Z",
      expiresAt: "2026-05-25T00:10:01.000Z",
      message:
        "APNs delivery job job-window time window 2026-05-25T00:00:00.000Z to 2026-05-25T00:10:01.000Z is too long.",
    });
  });
});