import { describe, expect, mock, test } from "bun:test";
import type { BranchProtection } from "./protection";
import type { Permission, RepoRow } from "~/lib/types";
import type { RequestCredential, TokenPermissions } from "./token-scope";

mock.module("cloudflare:workers", () => ({
  env: {},
  waitUntil: () => undefined,
  WorkflowEntrypoint: class {},
  DurableObject: class {},
  WorkerEntrypoint: class {},
}));

/** The user's real permission per repo id; tokens can only narrow it. */
const realPermission = new Map<string, Permission>();
const actualRepos = await import("./repos");
mock.module("./repos", () => ({
  ...actualRepos,
  repoPermission: async (repo: RepoRow) => realPermission.get(repo.id) ?? "none",
}));

const { scopedRepoPermission } = await import("./token-scope");
const { bypassesProtection } = await import("./protection");

const rule: BranchProtection = {
  id: "r1",
  pattern: "main",
  requirePullRequest: true,
  requiredApprovals: 1,
  requiredChecks: [],
  dismissStaleReviews: false,
  allowDeletions: false,
  allowForcePushes: false,
  enforceAdmins: false,
  requireCodeOwnerReview: false,
};

function repo(id: string): RepoRow {
  return { id, visibility: "private", artifacts_name: `r-${id}` } as RepoRow;
}

function token(permissions: TokenPermissions): RequestCredential {
  return {
    viewer: { id: "u1", name: "alice", displayName: null, email: "a@x", isAdmin: false, emailVerified: true },
    grant: { kind: "fine", tokenId: "t1", allRepos: true, permissions },
  };
}

async function canBypass(repoId: string, permissions: TokenPermissions): Promise<boolean> {
  return bypassesProtection(rule, await scopedRepoPermission(repo(repoId), token(permissions), "contents"));
}

describe("fine-grained admin through a token", () => {
  realPermission.set("administered", "admin");
  realPermission.set("written", "write");

  test("admin:write plus contents:write on a repo the user administers can bypass protection", async () => {
    expect(await canBypass("administered", { contents: "write", admin: "write" })).toBe(true);
  });

  test("the same token cannot bypass on a repo where the user is only a writer", async () => {
    expect(await canBypass("written", { contents: "write", admin: "write" })).toBe(false);
    expect(await scopedRepoPermission(repo("written"), token({ contents: "write", admin: "write" }), "contents")).toBe(
      "write",
    );
  });

  test("contents:write without admin:write cannot bypass, even for an administrator", async () => {
    expect(await canBypass("administered", { contents: "write" })).toBe(false);
    expect(await canBypass("administered", { contents: "read", admin: "write" })).toBe(false);
  });
});

describe("area hierarchy", () => {
  realPermission.set("written", "write");

  test("pulls grants nothing without contents", async () => {
    expect(await scopedRepoPermission(repo("written"), token({ pulls: "write" }), "pulls")).toBe("none");
    expect(await scopedRepoPermission(repo("written"), token({ pulls: "write", contents: "read" }), "pulls")).toBe(
      "write",
    );
  });

  test("minting refuses pulls without contents", async () => {
    const { assertAreaDependencies } = await import("./token-scope");
    expect(() => assertAreaDependencies({ pulls: "read" })).toThrow("pulls access also needs contents:read");
    expect(() => assertAreaDependencies({ pulls: "read", contents: "read" })).not.toThrow();
  });
});