import { describe, it, expect, beforeAll } from "bun:test";
import app from "../app";
import { SUPPORTED_SCOPES } from "../lib/oauth";

// These endpoints are what claude.ai / Cursor / Copilot read first to learn
// how to authenticate. They must be anonymous, JSON, and advertise only
// endpoints that actually exist.

beforeAll(() => {
  process.env.APP_BASE_URL = "https://gluecron.com";
});

describe("RFC 8414 — authorization server metadata", () => {
  it("serves valid metadata anonymously", async () => {
    const res = await app.request("/.well-known/oauth-authorization-server");
    expect(res.status).toBe(200);
    expect(res.headers.get("content-type") || "").toContain("application/json");
    const doc = await res.json();
    expect(doc.issuer).toBe("https://gluecron.com");
    expect(doc.authorization_endpoint).toBe("https://gluecron.com/oauth/authorize");
    expect(doc.token_endpoint).toBe("https://gluecron.com/oauth/token");
    expect(doc.revocation_endpoint).toBe("https://gluecron.com/oauth/revoke");
  });

  it("advertises PKCE S256 and the authorization_code + refresh grants", async () => {
    const doc = await (
      await app.request("/.well-known/oauth-authorization-server")
    ).json();
    expect(doc.code_challenge_methods_supported).toContain("S256");
    expect(doc.grant_types_supported).toContain("authorization_code");
    expect(doc.grant_types_supported).toContain("refresh_token");
    expect(doc.response_types_supported).toEqual(["code"]);
  });

  it("advertises exactly the supported scopes", async () => {
    const doc = await (
      await app.request("/.well-known/oauth-authorization-server")
    ).json();
    expect(doc.scopes_supported).toEqual([...SUPPORTED_SCOPES]);
  });

  it("supports the public-client (none) auth method for PKCE apps", async () => {
    const doc = await (
      await app.request("/.well-known/oauth-authorization-server")
    ).json();
    expect(doc.token_endpoint_auth_methods_supported).toContain("none");
  });

  it("advertises the registration_endpoint (RFC 7591 DCR is live)", async () => {
    const doc = await (
      await app.request("/.well-known/oauth-authorization-server")
    ).json();
    expect(doc.registration_endpoint).toBe("https://gluecron.com/oauth/register");
  });

  it("does NOT advertise introspection until it ships", async () => {
    const doc = await (
      await app.request("/.well-known/oauth-authorization-server")
    ).json();
    // Guard: only advertise introspection_endpoint once POST /oauth/introspect
    // actually exists, or clients that probe it will 404.
    expect(doc.introspection_endpoint).toBeUndefined();
  });
});

describe("RFC 9728 — protected resource metadata", () => {
  it("serves the resource metadata for the MCP endpoint", async () => {
    const res = await app.request("/.well-known/oauth-protected-resource");
    expect(res.status).toBe(200);
    const doc = await res.json();
    expect(doc.resource).toBe("https://gluecron.com/mcp");
    expect(doc.authorization_servers).toEqual(["https://gluecron.com"]);
    expect(doc.bearer_methods_supported).toContain("header");
  });

  it("also serves the resource-specific /mcp form", async () => {
    const res = await app.request("/.well-known/oauth-protected-resource/mcp");
    expect(res.status).toBe(200);
    const doc = await res.json();
    expect(doc.resource).toBe("https://gluecron.com/mcp");
  });
});