import { afterEach, describe, expect, test } from 'bun:test';
import { replicas } from './index.js';

const previous = {
  url: process.env.REPLICAS_MONOLITH_URL,
  secret: process.env.REPLICAS_ENGINE_SECRET,
  workspace: process.env.REPLICAS_WORKSPACE_ID,
};

afterEach(() => {
  if (previous.url === undefined) delete process.env.REPLICAS_MONOLITH_URL;
  else process.env.REPLICAS_MONOLITH_URL = previous.url;
  if (previous.secret === undefined) delete process.env.REPLICAS_ENGINE_SECRET;
  else process.env.REPLICAS_ENGINE_SECRET = previous.secret;
  if (previous.workspace === undefined) delete process.env.REPLICAS_WORKSPACE_ID;
  else process.env.REPLICAS_WORKSPACE_ID = previous.workspace;
});

describe('@replicas/sdk', () => {
  test('sends only workspace identity to the scoped gateway', async () => {
    let observed: { path: string; authorization: string | null; workspace: string | null; body: unknown } | null = null;
    const server = Bun.serve({
      port: 0,
      async fetch(request) {
        observed = {
          path: new URL(request.url).pathname,
          authorization: request.headers.get('authorization'),
          workspace: request.headers.get('x-workspace-id'),
          body: await request.json(),
        };
        return Response.json({ data: { ok: true }, logId: 'log-1' });
      },
    });
    process.env.REPLICAS_MONOLITH_URL = server.url.toString().replace(/\/$/, '');
    process.env.REPLICAS_ENGINE_SECRET = 'engine-secret';
    process.env.REPLICAS_WORKSPACE_ID = 'workspace-1';
    try {
      await replicas.plugins.execute({
        plugin: 'stripe',
        tool: 'STRIPE_RETRIEVE_BALANCE',
      });
      expect(observed).toEqual({
        path: '/v1/engine/plugins/execute',
        authorization: 'Bearer engine-secret',
        workspace: 'workspace-1',
        body: { plugin: 'stripe', tool: 'STRIPE_RETRIEVE_BALANCE' },
      });
    } finally {
      server.stop(true);
    }
  });

  test('refuses to run outside an authenticated workspace', async () => {
    delete process.env.REPLICAS_MONOLITH_URL;
    delete process.env.REPLICAS_ENGINE_SECRET;
    delete process.env.REPLICAS_WORKSPACE_ID;
    await expect(replicas.plugins.list()).rejects.toThrow('missing Replicas workspace credentials');
  });

  test('keeps native provider credentials behind the workspace gateway', async () => {
    let observed: { path: string; authorization: string | null; body: unknown } | null = null;
    const server = Bun.serve({
      port: 0,
      async fetch(request) {
        observed = {
          path: new URL(request.url).pathname,
          authorization: request.headers.get('authorization'),
          body: await request.json(),
        };
        return Response.json({ login: 'replicas' });
      },
    });
    process.env.REPLICAS_MONOLITH_URL = server.url.toString().replace(/\/$/, '');
    process.env.REPLICAS_ENGINE_SECRET = 'engine-secret';
    process.env.REPLICAS_WORKSPACE_ID = 'workspace-1';
    try {
      await replicas.github.request('/user');
      expect(observed).toEqual({
        path: '/v1/engine/github/api',
        authorization: 'Bearer engine-secret',
        body: { path: '/user' },
      });
    } finally {
      server.stop(true);
    }
  });

  test('invokes Modal through the workspace gateway', async () => {
    let observed: { path: string; body: unknown } | null = null;
    const server = Bun.serve({
      port: 0,
      async fetch(request) {
        observed = { path: new URL(request.url).pathname, body: await request.json() };
        return Response.json({ ok: true });
      },
    });
    process.env.REPLICAS_MONOLITH_URL = server.url.toString().replace(/\/$/, '');
    process.env.REPLICAS_ENGINE_SECRET = 'engine-secret';
    process.env.REPLICAS_WORKSPACE_ID = 'workspace-1';
    try {
      await replicas.modal.call({ app: 'example', function: 'run', args: ['input'] });
      expect(observed).toEqual({
        path: '/v1/engine/modal/call',
        body: { app: 'example', function: 'run', args: ['input'] },
      });
    } finally {
      server.stop(true);
    }
  });

  test('rejects provider URLs that can escape the allowed origin', async () => {
    process.env.REPLICAS_MONOLITH_URL = 'https://api.example.com';
    process.env.REPLICAS_ENGINE_SECRET = 'engine-secret';
    process.env.REPLICAS_WORKSPACE_ID = 'workspace-1';
    expect(() => replicas.github.request('//attacker.example/path')).toThrow('relative');
  });

  test('queries turbopuffer through the workspace gateway', async () => {
    let observed: { path: string; body: unknown } | null = null;
    const server = Bun.serve({
      port: 0,
      async fetch(request) {
        observed = { path: new URL(request.url).pathname, body: await request.json() };
        return Response.json({ rows: [] });
      },
    });
    process.env.REPLICAS_MONOLITH_URL = server.url.toString().replace(/\/$/, '');
    process.env.REPLICAS_ENGINE_SECRET = 'engine-secret';
    process.env.REPLICAS_WORKSPACE_ID = 'workspace-1';
    try {
      await replicas.turbopuffer.query('products', { top_k: 10 });
      expect(observed).toEqual({
        path: '/v1/engine/turbopuffer',
        body: { operation: 'query', namespace: 'products', params: { top_k: 10 } },
      });
    } finally {
      server.stop(true);
    }
  });

  test('calls PlanetScale through the workspace gateway', async () => {
    let observed: { path: string; body: unknown } | null = null;
    const server = Bun.serve({
      port: 0,
      async fetch(request) {
        observed = { path: new URL(request.url).pathname, body: await request.json() };
        return Response.json({ data: [] });
      },
    });
    process.env.REPLICAS_MONOLITH_URL = server.url.toString().replace(/\/$/, '');
    process.env.REPLICAS_ENGINE_SECRET = 'engine-secret';
    process.env.REPLICAS_WORKSPACE_ID = 'workspace-1';
    try {
      await replicas.planetscale.request('/organizations');
      expect(observed).toEqual({
        path: '/v1/engine/planetscale/api',
        body: { path: '/organizations' },
      });
    } finally {
      server.stop(true);
    }
  });

  test('runs E2B commands through the workspace gateway', async () => {
    let observed: { path: string; body: unknown } | null = null;
    const server = Bun.serve({
      port: 0,
      async fetch(request) {
        observed = { path: new URL(request.url).pathname, body: await request.json() };
        return Response.json({ exitCode: 0, stdout: 'ok\n', stderr: '' });
      },
    });
    process.env.REPLICAS_MONOLITH_URL = server.url.toString().replace(/\/$/, '');
    process.env.REPLICAS_ENGINE_SECRET = 'engine-secret';
    process.env.REPLICAS_WORKSPACE_ID = 'workspace-1';
    try {
      await replicas.e2b.run('sandbox-1', 'echo ok', { cwd: '/home/user' });
      expect(observed).toEqual({
        path: '/v1/engine/e2b',
        body: { operation: 'run', sandboxId: 'sandbox-1', command: 'echo ok', cwd: '/home/user' },
      });
    } finally {
      server.stop(true);
    }
  });
});

  test('analyzes text with Pangram through the workspace gateway', async () => {
    let observed: { path: string; body: unknown } | null = null;
    const server = Bun.serve({
      port: 0,
      async fetch(request) {
        observed = { path: new URL(request.url).pathname, body: await request.json() };
        return Response.json({ prediction_short: 'Human' });
      },
    });
    process.env.REPLICAS_MONOLITH_URL = server.url.toString().replace(/\/$/, '');
    process.env.REPLICAS_ENGINE_SECRET = 'engine-secret';
    process.env.REPLICAS_WORKSPACE_ID = 'workspace-1';
    try {
      await replicas.pangram.detect({ text: 'Example text' });
      expect(observed).toEqual({
        path: '/v1/engine/pangram',
        body: { operation: 'detect', text: 'Example text' },
      });
    } finally {
      server.stop(true);
    }
  });