import { EnvironmentId } from "@t3tools/contracts";
import {
  RelayAuthInvalidError,
  type RelayClientDeviceRecord,
  type RelayClientEnvironmentRecord,
  type RelayEnvironmentStatusResponse,
} from "@t3tools/contracts/relay";
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Fiber from "effect/Fiber";
import * as Layer from "effect/Layer";
import * as Stream from "effect/Stream";
import { Atom, AtomRegistry } from "effect/unstable/reactivity";
import { afterEach, vi } from "vite-plus/test";

import { DPOP_UNKNOWN_HINT } from "./errorPresentation.ts";
import * as ManagedRelay from "./managedRelay.ts";
import {
  createManagedRelayQueryManager,
  createManagedRelaySession,
  deregisterManagedRelayEnvironment,
  managedRelayAccountChanges,
  type ManagedRelayQueryEvent,
  ManagedRelaySessionError,
  managedRelaySessionAtom,
  readManagedRelaySnapshotState,
  setManagedRelaySession,
} from "./managedRelayState.ts";

let registry = AtomRegistry.make();

const environment = {
  environmentId: EnvironmentId.make("environment-1"),
  label: "Main environment",
  endpoint: {
    httpBaseUrl: "https://environment.example.test",
    wsBaseUrl: "wss://environment.example.test",
    providerKind: "cloudflare_tunnel",
  },
  linkedAt: "2026-06-01T00:00:00.000Z",
} satisfies RelayClientEnvironmentRecord;

const device = {
  deviceId: "device-1",
  label: "Julius iPhone",
  platform: "ios",
  iosMajorVersion: 18,
  appVersion: null,
  notifications: {
    enabled: true,
    notifyOnApproval: true,
    notifyOnInput: true,
    notifyOnCompletion: true,
    notifyOnFailure: true,
  },
  liveActivities: {
    enabled: true,
  },
  updatedAt: "2026-06-01T00:00:00.000Z",
} satisfies RelayClientDeviceRecord;

function resetRegistry() {
  registry.dispose();
  registry = AtomRegistry.make();
}

function createClient(overrides?: Partial<ManagedRelay.ManagedRelayClient["Service"]>) {
  return ManagedRelay.ManagedRelayClient.of({
    relayUrl: "https://relay.example.test",
    listEnvironments: () => Effect.succeed([environment]),
    listDevices: () => Effect.succeed([device]),
    createEnvironmentLinkChallenge: () => Effect.die("unused"),
    linkEnvironment: () => Effect.die("unused"),
    unlinkEnvironment: () => Effect.die("unused"),
    getEnvironmentStatus: () =>
      Effect.succeed({
        environmentId: environment.environmentId,
        endpoint: environment.endpoint,
        status: "online",
        checkedAt: "2026-06-01T00:00:00.000Z",
      }),
    connectEnvironment: () => Effect.die("unused"),
    registerDevice: () => Effect.die("unused"),
    unregisterDevice: () => Effect.die("unused"),
    registerLiveActivity: () => Effect.die("unused"),
    getAgentActivitySnapshot: () => Effect.die("unused"),
    resetTokenCache: Effect.void,
    ...overrides,
  });
}

function createManager(
  overrides?: Partial<ManagedRelay.ManagedRelayClient["Service"]>,
  onQueryEvent?: (event: ManagedRelayQueryEvent) => void,
) {
  const client = createClient(overrides);
  const runtime = Atom.runtime(Layer.succeed(ManagedRelay.ManagedRelayClient, client));
  return createManagedRelayQueryManager(runtime, {
    staleTimeMs: 60_000,
    ...(onQueryEvent ? { onQueryEvent } : {}),
  });
}

function setSession() {
  setManagedRelaySession(registry, {
    accountId: "account-1",
    readClerkToken: () => Promise.resolve("clerk-token"),
  });
}

function clerkToken(expiresAtSeconds: number): string {
  const encode = (value: unknown) =>
    btoa(JSON.stringify(value)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
  return `${encode({ alg: "none" })}.${encode({ exp: expiresAtSeconds })}.signature`;
}

describe("createManagedRelayQueryManager", () => {
  afterEach(resetRegistry);

  it.effect("deregisters an environment through the current Clerk session", () =>
    Effect.gen(function* () {
      const unlinkEnvironment = vi.fn(() => Effect.succeed({ ok: true }));
      setSession();

      yield* deregisterManagedRelayEnvironment(registry, {
        accountId: "account-1",
        environmentId: environment.environmentId,
      }).pipe(
        Effect.provideService(ManagedRelay.ManagedRelayClient, createClient({ unlinkEnvironment })),
      );

      expect(unlinkEnvironment).toHaveBeenCalledWith({
        clerkToken: "clerk-token",
        environmentId: environment.environmentId,
      });
    }),
  );

  it.effect("rejects deregistration after the account changes", () =>
    Effect.gen(function* () {
      const unlinkEnvironment = vi.fn(() => Effect.succeed({ ok: true }));
      setSession();

      const error = yield* deregisterManagedRelayEnvironment(registry, {
        accountId: "previous-account",
        environmentId: environment.environmentId,
      }).pipe(
        Effect.provideService(ManagedRelay.ManagedRelayClient, createClient({ unlinkEnvironment })),
        Effect.flip,
      );

      expect(error).toBeInstanceOf(ManagedRelaySessionError);
      expect(unlinkEnvironment).not.toHaveBeenCalled();
    }),
  );

  it.effect("deduplicates concurrent Clerk token reads and reuses the token until JWT expiry", () =>
    Effect.gen(function* () {
      const token = clerkToken(4_102_444_800);
      let resolveToken!: (value: string) => void;
      const readClerkToken = vi.fn(
        () =>
          new Promise<string>((resolve) => {
            resolveToken = resolve;
          }),
      );
      const session = createManagedRelaySession({
        accountId: "account-1",
        readClerkToken,
      });

      const readsFiber = yield* Effect.all([session.readClerkToken(), session.readClerkToken()], {
        concurrency: "unbounded",
      }).pipe(Effect.forkChild);
      yield* Effect.yieldNow;
      expect(readClerkToken).toHaveBeenCalledTimes(1);

      resolveToken(token);
      expect(yield* Fiber.join(readsFiber)).toEqual([token, token]);
      expect(yield* session.readClerkToken()).toBe(token);
      expect(readClerkToken).toHaveBeenCalledTimes(1);
    }),
  );

  it.effect("updates the token provider without replacing a same-account session", () =>
    Effect.gen(function* () {
      const firstRead = vi.fn(() => Promise.resolve<string | null>(null));
      setManagedRelaySession(registry, {
        accountId: "account-1",
        readClerkToken: firstRead,
      });
      const firstSession = registry.get(managedRelaySessionAtom);
      expect(firstSession).not.toBeNull();
      expect(yield* firstSession!.readClerkToken()).toBeNull();

      const secondRead = vi.fn(() => Promise.resolve<string | null>("refreshed-token"));
      setManagedRelaySession(registry, {
        accountId: "account-1",
        readClerkToken: secondRead,
      });

      expect(registry.get(managedRelaySessionAtom)).toBe(firstSession);
      expect(yield* firstSession!.readClerkToken()).toBe("refreshed-token");
      expect(firstRead).toHaveBeenCalledTimes(1);
      expect(secondRead).toHaveBeenCalledTimes(1);
    }),
  );

  it.effect("does not pin a refreshed session to an older pending token read", () =>
    Effect.gen(function* () {
      let resolveFirst!: (token: string) => void;
      setManagedRelaySession(registry, {
        accountId: "account-1",
        readClerkToken: () =>
          new Promise<string>((resolve) => {
            resolveFirst = resolve;
          }),
      });
      const session = registry.get(managedRelaySessionAtom);
      const firstRead = yield* session!.readClerkToken().pipe(Effect.forkChild);
      yield* Effect.yieldNow;

      setManagedRelaySession(registry, {
        accountId: "account-1",
        readClerkToken: () => Promise.resolve("refreshed-token"),
      });

      expect(yield* session!.readClerkToken()).toBe("refreshed-token");
      resolveFirst("older-token");
      expect(yield* Fiber.join(firstRead)).toBe("older-token");
    }),
  );

  it.effect("emits credential changes only when the managed relay account changes", () =>
    Effect.gen(function* () {
      setManagedRelaySession(registry, {
        accountId: "account-1",
        readClerkToken: () => Promise.resolve("first-token"),
      });
      const changes = yield* managedRelayAccountChanges(registry).pipe(
        Stream.take(2),
        Stream.runCollect,
        Effect.forkChild,
      );
      yield* Effect.promise(() =>
        vi.waitFor(() => {
          expect(registry.getNodes().get(managedRelaySessionAtom)?.listeners.size).toBeGreaterThan(
            0,
          );
        }),
      );

      setManagedRelaySession(registry, {
        accountId: "account-1",
        readClerkToken: () => Promise.resolve("refreshed-token"),
      });
      setManagedRelaySession(registry, {
        accountId: "account-2",
        readClerkToken: () => Promise.resolve("second-token"),
      });
      setManagedRelaySession(registry, null);

      expect(Array.from(yield* Fiber.join(changes))).toEqual(["account-2", null]);
    }),
  );

  it("shares one Clerk token read across concurrent relay list and status queries", async () => {
    const secondEnvironment = {
      ...environment,
      environmentId: EnvironmentId.make("environment-2"),
      label: "Second environment",
      endpoint: {
        ...environment.endpoint,
        httpBaseUrl: "https://environment-2.example.test",
        wsBaseUrl: "wss://environment-2.example.test",
      },
    } satisfies RelayClientEnvironmentRecord;
    const token = clerkToken(4_102_444_800);
    const readClerkToken = vi.fn(() => Promise.resolve(token));
    const manager = createManager({
      listEnvironments: () => Effect.succeed([environment, secondEnvironment]),
      getEnvironmentStatus: ({ environmentId }) => {
        const current =
          environmentId === environment.environmentId ? environment : secondEnvironment;
        return Effect.succeed({
          environmentId: current.environmentId,
          endpoint: current.endpoint,
          status: "online" as const,
          checkedAt: "2026-06-01T00:00:00.000Z",
        });
      },
    });
    setManagedRelaySession(registry, {
      accountId: "account-1",
      readClerkToken,
    });

    const environmentsAtom = manager.environmentsAtom("account-1");
    const firstStatusAtom = manager.environmentStatusAtom({
      accountId: "account-1",
      environment,
    });
    const secondStatusAtom = manager.environmentStatusAtom({
      accountId: "account-1",
      environment: secondEnvironment,
    });
    registry.get(environmentsAtom);
    registry.get(firstStatusAtom);
    registry.get(secondStatusAtom);

    await vi.waitFor(() => {
      expect(readManagedRelaySnapshotState(registry.get(firstStatusAtom)).data?.status).toBe(
        "online",
      );
      expect(readManagedRelaySnapshotState(registry.get(secondStatusAtom)).data?.status).toBe(
        "online",
      );
    });
    expect(readClerkToken).toHaveBeenCalledTimes(1);
  });

  it("keeps environment snapshots cached and refreshes them explicitly", async () => {
    const listEnvironments = vi.fn(() => Effect.succeed([environment]));
    const manager = createManager({ listEnvironments });
    setSession();
    const atom = manager.environmentsAtom("account-1");

    registry.get(atom);
    await vi.waitFor(() => expect(listEnvironments).toHaveBeenCalledTimes(1));

    registry.get(manager.environmentsAtom("account-1"));
    expect(listEnvironments).toHaveBeenCalledTimes(1);

    manager.refreshEnvironments(registry, "account-1");
    await vi.waitFor(() => expect(listEnvironments).toHaveBeenCalledTimes(2));
  });

  it("loads device snapshots through the current account session", async () => {
    const listDevices = vi.fn(() => Effect.succeed([device]));
    const manager = createManager({ listDevices });
    setSession();
    const atom = manager.devicesAtom("account-1");

    registry.get(atom);
    await vi.waitFor(() => {
      expect(readManagedRelaySnapshotState(registry.get(atom)).data).toEqual([device]);
    });
  });

  it("reports token and relay request phases for environment status queries", async () => {
    const onQueryEvent = vi.fn();
    const manager = createManager(undefined, onQueryEvent);
    setSession();
    const atom = manager.environmentStatusAtom({ accountId: "account-1", environment });

    registry.get(atom);
    await vi.waitFor(() => {
      expect(readManagedRelaySnapshotState(registry.get(atom)).data?.status).toBe("online");
    });

    expect(onQueryEvent).toHaveBeenCalledWith({
      operation: "environment-status",
      stage: "clerk-token",
      phase: "start",
      accountId: "account-1",
      environmentId: environment.environmentId,
    });
    expect(onQueryEvent).toHaveBeenCalledWith(
      expect.objectContaining({
        operation: "environment-status",
        stage: "relay-request",
        phase: "success",
        accountId: "account-1",
        environmentId: environment.environmentId,
      }),
    );
  });

  it("rejects status responses for a different environment", async () => {
    const mismatchedStatus = {
      environmentId: EnvironmentId.make("environment-2"),
      endpoint: environment.endpoint,
      status: "online",
      checkedAt: "2026-06-01T00:00:00.000Z",
    } satisfies RelayEnvironmentStatusResponse;
    const manager = createManager({
      getEnvironmentStatus: () => Effect.succeed(mismatchedStatus),
    });
    setSession();
    const atom = manager.environmentStatusAtom({ accountId: "account-1", environment });

    registry.get(atom);
    await vi.waitFor(() => {
      expect(readManagedRelaySnapshotState(registry.get(atom)).error).toBe(
        "Relay returned status for a different environment.",
      );
    });
  });

  it("exposes relay trace IDs alongside snapshot errors", async () => {
    const manager = createManager({
      getEnvironmentStatus: () =>
        Effect.fail(
          new ManagedRelay.ManagedRelayRequestFailedError({
            action: "get relay environment status",
            cause: new Error("Relay request failed."),
            traceId: "trace-status",
          }),
        ),
    });
    setSession();
    const atom = manager.environmentStatusAtom({ accountId: "account-1", environment });

    registry.get(atom);
    await vi.waitFor(() => {
      expect(readManagedRelaySnapshotState(registry.get(atom))).toMatchObject({
        error: "Could not get relay environment status.",
        errorTraceId: "trace-status",
      });
    });
  });

  it("presents clock skew as one possible cause for snapshot requests from older relays", async () => {
    const manager = createManager({
      getEnvironmentStatus: () =>
        Effect.fail(
          new ManagedRelay.ManagedRelayRequestFailedError({
            action: "get relay environment status",
            cause: new Error("Relay request failed."),
            relayError: new RelayAuthInvalidError({
              code: "auth_invalid",
              reason: "invalid_dpop",
              traceId: "trace-status",
            }),
            traceId: "trace-status",
          }),
        ),
    });
    setSession();
    const atom = manager.environmentStatusAtom({ accountId: "account-1", environment });

    registry.get(atom);
    await vi.waitFor(() => {
      expect(readManagedRelaySnapshotState(registry.get(atom)).error).toBe(
        `Relay rejected the DPoP proof. ${DPOP_UNKNOWN_HINT}`,
      );
    });
  });
});