import { App } from 'tapimo/server'

import * as Store from '../../internal/Store.js'
import * as Viem from '../../internal/Viem.js'
import * as TestApp from '../../../test/App.js'
import { routes } from './App.js'

const sandbox = {
  environment: 'sandbox',
  id: 'key_sandbox_routes',
  orgId: 'org_test',
  scopes: ['data:read', 'routes:write'],
  token: 'secret_sandbox_routes',
} satisfies TestApp.kvStore.Key

function as(key: { token: string }) {
  return { headers: { authorization: `Bearer ${key.token}` } } as const
}

describe('routes access', () => {
  test.each([
    { method: 'GET', path: '/v1/routes/chains' },
    { method: 'POST', path: '/v1/routes/transfers' },
    { method: 'POST', path: '/v1/routes/transfers/rtr_test/source-transactions' },
  ])('rejects sandbox keys on mainnet: $method $path', async ({ method, path }) => {
    const app = App.create({
      auth: {},
      db: TestApp.database(),
      defaultChainId: Viem.chainId.mainnet,
      kv: { store: TestApp.kvStore({ keys: [sandbox] }) },
    }).route('/', routes())

    const response = await app.request(path, { ...as(sandbox), method })

    expect(response.status).toBe(403)
    expect(await response.json()).toMatchObject({
      error: {
        code: 'api_key_forbidden',
        message: 'Sandbox API keys only support testnet. Pass a testnet `chainId`.',
      },
    })
  })

  test('rejects sandbox keys on a mainnet-backed default Zone', async () => {
    const chainId = 421_700_001
    const key = {
      ...sandbox,
      scopes: [...sandbox.scopes, `zone:${chainId}:read`],
    } satisfies TestApp.kvStore.Key
    const app = App.create({
      auth: {},
      db: TestApp.database(),
      defaultChainId: chainId,
      kv: { store: TestApp.kvStore({ keys: [key] }) },
      zones: [
        TestApp.zone({
          chainId,
          rpcUrl: `https://${chainId}.rpc.test`,
          sourceChainId: Viem.chainId.mainnet,
        }),
      ],
    }).route('/', routes())

    const response = await app.request('/v1/routes/chains', as(key))

    expect(response.status).toBe(403)
    expect((await response.json()).error.code).toBe('api_key_forbidden')
  })

  test.each(['', '?chainId=42431'])(
    'rejects sandbox source claims and subsidized transfers on mainnet with query %j',
    async (query) => {
      const writer = {
        ...sandbox,
        scopes: ['routes:write'],
      } satisfies TestApp.kvStore.Key
      const db = TestApp.database()
      const app = App.create({
        auth: {},
        db,
        defaultChainId: Viem.chainId.mainnet,
        kv: { store: TestApp.kvStore({ keys: [writer] }) },
      }).route('/', routes())
      const requests = [
        {
          body: {
            amount: '1',
            destinationChain: 'base',
            destinationToken: 'usdc',
            mode: 'exactSource',
            recipient: `0x${'aa'.repeat(20)}`,
            sender: `0x${'bb'.repeat(20)}`,
            sourceChain: 'tempo',
            sourceToken: 'usdce',
            subsidize: true,
          },
          path: '/v1/routes/transfers',
        },
        {
          body: { transactionHash: `0x${'cc'.repeat(32)}` },
          path: `/v1/routes/transfers/rtr_${'0'.repeat(15)}_${'a'.repeat(24)}/source-transactions`,
        },
      ]
      for (const request of requests) {
        const response = await app.request(`${request.path}${query}`, {
          body: JSON.stringify(request.body),
          headers: {
            ...as(writer).headers,
            'content-type': 'application/json',
            'idempotency-key': 'sandbox-mainnet-claim',
          },
          method: 'POST',
        })
        expect(response.status).toMatchInlineSnapshot(`403`)
        expect((await response.json()).error.code).toMatchInlineSnapshot(`"api_key_forbidden"`)
      }
      expect(await db.kysely.selectFrom('routes_transfers').select('id').execute()).toEqual([])
      expect(
        await db.kysely.selectFrom('routes_transfer_transactions').select('transferId').execute(),
      ).toEqual([])
    },
  )

  test('requires a matching Zone scope and bypasses the edge cache', async () => {
    const chainId = 421_700_001
    const reader = {
      id: 'key_zone_routes',
      orgId: 'org_test',
      scopes: ['data:read', `zone:${chainId}:read`],
      token: 'secret_zone_routes',
    } satisfies TestApp.kvStore.Key
    const app = App.create({
      auth: {},
      cache: { store: Store.memory() },
      db: TestApp.database(),
      defaultChainId: chainId,
      kv: { store: TestApp.kvStore({ keys: [reader] }) },
      zones: [TestApp.zone({ chainId, rpcUrl: `https://${chainId}.rpc.test` })],
    }).route('/', routes())

    const allowed = await app.request('/v1/routes/chains', as(reader))
    const anonymous = await app.request('/v1/routes/chains')

    expect(allowed.status).toBe(200)
    expect(allowed.headers.get('cache-control')).toContain('private')
    expect(anonymous.status).toBe(403)
  })

  test('keeps public-chain inventory edge-cacheable on a Zone deployment', async () => {
    const chainId = 421_700_001
    const app = App.create({
      auth: false,
      cache: { store: Store.memory() },
      db: TestApp.database(),
      zones: [TestApp.zone({ chainId, rpcUrl: `https://${chainId}.rpc.test` })],
    }).route('/', routes())

    const first = await app.request('/v1/routes/chains')
    const second = await app.request('/v1/routes/chains')

    expect(first.status).toBe(200)
    expect(second.status).toBe(200)
    expect(second.headers.get('cache-control')).toContain('public')
  })
})