// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0

import {
  applyIdentityMappings,
  IDENTITY_MIGRATION_FORMAT,
  type IdentityMigrationBundle,
  identityIssuerCoverage,
  identityMigrationDigest,
} from "@conusai-kit/tenancy"
import { describe, expect, it, vi } from "vitest"
import { createConvexAuthDataSource } from "../apps/web/src/server/convex-auth-data"

const calls = vi.hoisted(() => ({
  queries: [] as { args: unknown }[],
  mutations: [] as { args: unknown }[],
}))

vi.mock("convex/browser", () => ({
  ConvexHttpClient: class {
    setAdminAuth(): void {}
    query(_reference: unknown, args: unknown): Promise<unknown> {
      calls.queries.push({ args })
      return Promise.resolve({ source: 1, target: 1 })
    }
    mutation(_reference: unknown, args: unknown): Promise<unknown> {
      calls.mutations.push({ args })
      return Promise.resolve({ migrationId: "7", applied: 1 })
    }
  },
}))

// The template ships without the platform repository, so the bundle is built here with the kit's own
// digest; the kit's tests pin that digest to the platform's shared fixture.
const unsigned = {
  migration_id: 7,
  source: { issuer: "https://old.example.test", audience: "old-audience" },
  target: { issuer: "https://new.example.test/api/auth", audience: "urn:conusai:identity:2:3:4" },
  mappings: [{ source_subject: "source-1", target_subject: "target-1" }],
}
const sharedBundle: IdentityMigrationBundle = {
  format: IDENTITY_MIGRATION_FORMAT,
  ...unsigned,
  digest: await identityMigrationDigest(unsigned),
}

describe("Convex auth identity migrations", () => {
  it("uses the private mapping mutation and coverage query", async () => {
    calls.queries.length = 0
    calls.mutations.length = 0
    const data = createConvexAuthDataSource({ url: "https://convex.example.test", adminKey: "test-admin-key" })
    const bundle = sharedBundle
    const options = {
      bundle,
      staged: {
        migrationId: String(bundle.migration_id),
        digest: bundle.digest,
        targetIssuer: bundle.target.issuer,
        targetAudience: bundle.target.audience,
      },
      active: bundle.source,
    }

    await applyIdentityMappings(data, options)
    expect(calls.mutations).toEqual([{ args: { options } }])

    expect(await identityIssuerCoverage(data, { source: bundle.source.issuer, target: bundle.target.issuer })).toEqual({
      source: 1,
      target: 1,
    })
    expect(calls.queries).toEqual([
      { args: { issuers: { source: bundle.source.issuer, target: bundle.target.issuer } } },
    ])
  })
})