import { expect, it } from "@effect/vitest";
import * as DateTime from "effect/DateTime";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import * as Option from "effect/Option";

import * as AuthConnectClients from "../persistence/AuthConnectClients.ts";
import * as ServerSecretStore from "./ServerSecretStore.ts";
import * as ConnectClientStore from "./ConnectClientStore.ts";

const textEncoder = new TextEncoder();
const requestedAt = DateTime.makeUnsafe("2026-06-27T12:00:00.000Z");
const approvedAt = DateTime.makeUnsafe("2026-06-27T12:05:00.000Z");
const rejectedAt = DateTime.makeUnsafe("2026-06-27T12:06:00.000Z");

const approvedRecord: AuthConnectClients.AuthConnectClientRecord = {
  clientProofKeyThumbprint: "client-thumbprint",
  cloudUserId: "cloud-user",
  deviceId: "device-1",
  status: "approved",
  client: {
    label: "Client",
    ipAddress: null,
    userAgent: null,
    deviceType: "desktop",
    os: "macOS",
    browser: null,
  },
  requestedAt,
  updatedAt: approvedAt,
  approvedAt,
  rejectedAt: null,
  revokedAt: null,
  lastSeenAt: null,
};

const makeSecretStoreLayer = (mode: string) =>
  Layer.succeed(
    ServerSecretStore.ServerSecretStore,
    ServerSecretStore.ServerSecretStore.of({
      get: () => Effect.succeed(Option.some(textEncoder.encode(mode))),
      set: () => Effect.void,
      create: () => Effect.void,
      getOrCreateRandom: () => Effect.succeed(new Uint8Array()),
      remove: () => Effect.void,
    }),
  );

const secretStoreLayer = makeSecretStoreLayer("client-approval");

const makeStoreOnlyLayer = (mode: string) =>
  Layer.effect(ConnectClientStore.ConnectClientStore, ConnectClientStore.make).pipe(
    Layer.provide(makeSecretStoreLayer(mode)),
    Layer.provide(
      Layer.succeed(
        AuthConnectClients.AuthConnectClientRepository,
        AuthConnectClients.AuthConnectClientRepository.of({
          upsertRequest: () => Effect.succeed(approvedRecord),
          updateStatus: () => Effect.succeed(Option.none()),
          revoke: () => Effect.succeed(false),
          markSeen: () => Effect.succeed(Option.some(approvedRecord)),
          listActive: () => Effect.succeed([]),
        }),
      ),
    ),
  );

const makeStoreLayer = (
  overrides: Partial<AuthConnectClients.AuthConnectClientRepository["Service"]>,
) =>
  Layer.effect(ConnectClientStore.ConnectClientStore, ConnectClientStore.make).pipe(
    Layer.provide(secretStoreLayer),
    Layer.provide(
      Layer.succeed(
        AuthConnectClients.AuthConnectClientRepository,
        AuthConnectClients.AuthConnectClientRepository.of({
          upsertRequest: () => Effect.succeed(approvedRecord),
          updateStatus: () => Effect.succeed(Option.none()),
          revoke: () => Effect.succeed(false),
          markSeen: () => Effect.succeed(Option.some(approvedRecord)),
          listActive: () => Effect.succeed([]),
          ...overrides,
        }),
      ),
    ),
  );

it.effect("fails closed when persisted security mode is invalid", () =>
  Effect.gen(function* () {
    const store = yield* ConnectClientStore.ConnectClientStore;
    const error = yield* Effect.flip(store.getSecurityMode());

    expect(error._tag).toBe("ConnectSecurityModeLoadError");
  }).pipe(Effect.provide(makeStoreOnlyLayer("invalid-mode"))),
);

it.effect("returns rejected when an approved client is rejected before last-seen update", () =>
  Effect.gen(function* () {
    const store = yield* ConnectClientStore.ConnectClientStore;
    const authorization = yield* store.requestClient({
      cloudUserId: "cloud-user",
      clientProofKeyThumbprint: "client-thumbprint",
    });

    expect(authorization.mode).toBe("client-approval");
    expect(authorization.status).toBe("rejected");
  }).pipe(
    Effect.provide(
      makeStoreLayer({
        markSeen: () =>
          Effect.succeed(
            Option.some({
              ...approvedRecord,
              status: "rejected",
              updatedAt: rejectedAt,
              rejectedAt,
            }),
          ),
      }),
    ),
  ),
);

it.effect("returns pending when an approved client is revoked before last-seen update", () =>
  Effect.gen(function* () {
    const store = yield* ConnectClientStore.ConnectClientStore;
    const authorization = yield* store.requestClient({
      cloudUserId: "cloud-user",
      clientProofKeyThumbprint: "client-thumbprint",
    });

    expect(authorization.mode).toBe("client-approval");
    expect(authorization.status).toBe("pending");
    if (authorization.mode === "client-approval") {
      expect(authorization.client.status).toBe("pending");
      expect(authorization.client.approvedAt).toBeNull();
      expect(authorization.client.lastSeenAt).toBeNull();
    }
  }).pipe(
    Effect.provide(
      makeStoreLayer({
        markSeen: () => Effect.succeed(Option.none()),
      }),
    ),
  ),
);