import assert from "node:assert/strict";
import { test } from "node:test";
import * as Effect from "effect/Effect";
import { build } from "esbuild";
import { oauthBindings } from "./fixtures/oauth-config.mjs";

const bundle = await build({
  stdin: {
    resolveDir: process.cwd(),
    contents: `export {CloudflareAccount} from './control-plane/cloudflare-account.ts'; export {ensureAttachmentBucket, requireAttachmentCapability} from './control-plane/attachment-storage.ts';`,
  },
  bundle: true,
  platform: "node",
  format: "esm",
  write: false,
});
const {
  CloudflareAccount,
  ensureAttachmentBucket,
  requireAttachmentCapability,
} = await import(
  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
);

test("R2 provisioning recovers lost creation responses without duplicate buckets", async () => {
  const name = "flarebot-attachments-" + "a".repeat(32);
  let bucket = null,
    writes = 0;
  const client = new CloudflareAccount(
    "fixture",
    "b".repeat(32),
    async (url, init) => {
      assert.equal(new URL(url).origin, "https://api.cloudflare.com");
      if (init.method === "POST") {
        writes++;
        bucket = { name: JSON.parse(init.body).name };
        return new Response(null, { status: 503 });
      }
      return bucket
        ? Response.json({ success: true, result: bucket })
        : new Response(null, { status: 404 });
    },
  );
  await assert.rejects(Effect.runPromise(ensureAttachmentBucket(client, name)));
  await Effect.runPromise(ensureAttachmentBucket(client, name));
  assert.equal(writes, 1);
  bucket = { name: "another-bucket" };
  await assert.rejects(
    Effect.runPromise(ensureAttachmentBucket(client, name)),
    /resource_conflict/,
  );
  assert.equal(writes, 1);
});

test("attachment artifacts require reviewed R2 capability and a matching grant", async () => {
  const env = oauthBindings("https://publisher.example.com");
  const config = JSON.parse(env.FLAREBOT_CONTROL_PLANE);
  await Effect.runPromise(requireAttachmentCapability(env, config.oauthScopes));
  await assert.rejects(
    Effect.runPromise(requireAttachmentCapability(env, ["openid"])),
    /reauthorization_required/,
  );
  for (const scope of config.oauthCapabilities.scopes)
    scope.capabilities = scope.capabilities.filter(
      (c) => c !== "attachment-storage",
    );
  env.FLAREBOT_CONTROL_PLANE = JSON.stringify(config);
  await assert.rejects(
    Effect.runPromise(requireAttachmentCapability(env, config.oauthScopes)),
    /setup_required/,
  );
});