import * as ApiKey from './ApiKey.js'
import * as ApiKeys from './ApiKeys.js'
import * as Store from './internal/Store.js'

describe('schema.ApiKey', () => {
  test('environment defaults to production when omitted', () => {
    const parsed = ApiKey.schema.ApiKey.parse({
      id: 'key_test',
      orgId: 'org_test',
      scopes: ['data:read'],
    })
    expect(parsed.environment).toMatchInlineSnapshot(`"production"`)
    expect(parsed.allowedIps).toEqual([])
  })

  test('accepts an explicit sandbox environment', () => {
    const parsed = ApiKey.schema.ApiKey.parse({
      environment: 'sandbox',
      id: 'key_test',
      orgId: 'org_test',
      scopes: ['data:read'],
    })
    expect(parsed.environment).toMatchInlineSnapshot(`"sandbox"`)
  })

  test('rejects an unknown environment', () => {
    expect(
      ApiKey.schema.ApiKey.safeParse({
        environment: 'staging',
        id: 'key_test',
        orgId: 'org_test',
        scopes: ['data:read'],
      }).success,
    ).toBe(false)
  })

  test('accepts exact IP and CIDR allowlist rules', () => {
    const parsed = ApiKey.schema.ApiKey.parse({
      allowedIps: ['203.0.113.7', '203.0.113.0/24', '2001:db8::/32'],
      id: 'key_test',
      orgId: 'org_test',
      scopes: ['data:read'],
    })
    expect(parsed.allowedIps).toEqual(['203.0.113.7', '203.0.113.0/24', '2001:db8::/32'])
  })

  test.each(['203.0.113.0/33', '2001:db8::/129', '*', 'not-an-ip'])(
    'rejects invalid allowlist rule %s',
    (rule) => {
      expect(
        ApiKey.schema.ApiKey.safeParse({
          allowedIps: [rule],
          id: 'key_test',
          orgId: 'org_test',
          scopes: ['data:read'],
        }).success,
      ).toBe(false)
    },
  )

  test('accepts 100 allowlist rules and rejects 101', () => {
    const base = { id: 'key_test', orgId: 'org_test', scopes: ['data:read'] }
    const rules = Array.from({ length: 101 }, (_, index) => `203.0.113.${index}`)

    expect(
      ApiKey.schema.ApiKey.safeParse({ ...base, allowedIps: rules.slice(0, 100) }).success,
    ).toBe(true)
    expect(ApiKey.schema.ApiKey.safeParse({ ...base, allowedIps: rules }).success).toBe(false)
  })
})

describe('redact', () => {
  test('masks tokens anywhere in a string', () => {
    const token = `tempo:sk:${'a'.repeat(48)}`
    expect(ApiKey.redact(`auth failed for ${token} on /tokens`)).toMatchInlineSnapshot(
      `"auth failed for tempo:sk:… on /tokens"`,
    )
  })

  test('masks sandbox tokens, preserving their prefix', () => {
    const token = `tempo_sandbox:sk:${'a'.repeat(48)}`
    expect(ApiKey.redact(`auth failed for ${token} on /tokens`)).toMatchInlineSnapshot(
      `"auth failed for tempo_sandbox:sk:… on /tokens"`,
    )
  })

  test('masks deprecated v1 tokens', () => {
    const token = `tempo_${'a'.repeat(40)}`
    expect(ApiKey.redact(`auth failed for ${token} on /tokens`)).toMatchInlineSnapshot(
      `"auth failed for tempo_… on /tokens"`,
    )
  })

  test('leaves non-token text untouched', () => {
    expect(ApiKey.redact('nothing secret here')).toMatchInlineSnapshot(`"nothing secret here"`)
  })
})

// The wire layout (record prefix + token hash) is the contract every persisted
// key is stored under; the resolver and every source's `mint` must agree on it.
// These assertions pin it so an accidental change fails loudly.
describe('keyFor', () => {
  test('pins the record prefix and token hash (sha256 of UTF-8 bytes, hex)', () => {
    expect(ApiKey.recordPrefix).toMatchInlineSnapshot(`"apikey:"`)
    expect(ApiKey.keyFor('tempo:sk:test')).toMatchInlineSnapshot(
      `"apikey:9e11781fc2ea4581de193fc7fde09dda7c01151785cdcf2f5fbef52125b225b8"`,
    )
  })

  test('reader resolves a record written with the documented wire layout', async () => {
    const token = `tempo:sk:${'a'.repeat(48)}`
    const record = {
      createdAt: '2026-01-01T00:00:00.000Z',
      id: 'key_smoke',
      orgId: 'org_test',
      scopes: ['data:read'],
      tokenLast4: token.slice(-4),
    }
    const state = Store.memory({ entries: [[ApiKey.keyFor(token), JSON.stringify(record)]] })
    expect(await ApiKeys.resolve(state, token)).toMatchObject({
      id: 'key_smoke',
      orgId: 'org_test',
      scopes: ['data:read'],
    })
  })
})