src/github-apps/tests/metadata-permissions.ts

import { describe, expect, test } from 'vitest'
import { shouldFilterMetadataPermission, calculateAdditionalPermissions } from '../scripts/sync'

type PermissionSet = Record<string, string>

interface Operation {
  operationId: string
  permissionSets: PermissionSet[]
}

interface ProgAccessData {
  userToServerRest: boolean
  serverToServer: boolean
  permissions: PermissionSet[]
}

interface ActorResource {
  title: string
  visibility: string
}

interface FilteredOperation {
  operationId: string
  permission: string
  additionalPermissions: boolean
}

interface MetadataPermission {
  operationId: string
  additionalPermissions: boolean
}

describe('metadata permissions filtering', () => {
  // Mock data structure representing operations with metadata permissions
  const mockOperationsWithMetadata: Operation[] = [
    {
      operationId: 'repos/enable-automated-security-fixes',
      permissionSets: [{ metadata: 'read', administration: 'write' }],
    },
    {
      operationId: 'repos/get-readme',
      permissionSets: [{ metadata: 'read' }],
    },
    {
      operationId: 'orgs/update-webhook',
      permissionSets: [{ metadata: 'read', organization_administration: 'write' }],
    },
    {
      operationId: 'repos/get-content',
      permissionSets: [{ contents: 'read' }],
    },
  ]

  // Mock programmatic access data
  const mockProgAccessData: Record<string, ProgAccessData> = {
    'repos/enable-automated-security-fixes': {
      userToServerRest: true,
      serverToServer: true,
      permissions: [{ metadata: 'read', administration: 'write' }],
    },
    'repos/get-readme': {
      userToServerRest: true,
      serverToServer: true,
      permissions: [{ metadata: 'read' }],
    },
    'orgs/update-webhook': {
      userToServerRest: true,
      serverToServer: true,
      permissions: [{ metadata: 'read', organization_administration: 'write' }],
    },
    'repos/get-content': {
      userToServerRest: true,
      serverToServer: true,
      permissions: [{ contents: 'read' }],
    },
  }

  // Mock actor resources
  const mockProgActorResources: Record<string, ActorResource> = {
    metadata: {
      title: 'Metadata',
      visibility: 'public',
    },
    administration: {
      title: 'Administration',
      visibility: 'public',
    },
    organization_administration: {
      title: 'Organization administration',
      visibility: 'public',
    },
    contents: {
      title: 'Contents',
      visibility: 'public',
    },
  }

  test('calculateAdditionalPermissions works correctly', () => {
    // Single permission set with multiple permissions
    expect(calculateAdditionalPermissions([{ metadata: 'read', admin: 'write' }])).toBe(true)

    // Single permission set with single permission
    expect(calculateAdditionalPermissions([{ metadata: 'read' }])).toBe(false)

    // Multiple permission sets
    expect(calculateAdditionalPermissions([{ metadata: 'read' }, { admin: 'write' }])).toBe(true)

    // Empty permission sets
    expect(calculateAdditionalPermissions([])).toBe(false)
  })

  test('identifies metadata with additional permissions correctly', () => {
    // Case 1: metadata + administration (should be filtered)
    const metadataWithAdmin = [{ metadata: 'read', administration: 'write' }]
    expect(shouldFilterMetadataPermission('metadata', metadataWithAdmin)).toBe(true)

    // Case 2: metadata only (should NOT be filtered)
    const metadataOnly = [{ metadata: 'read' }]
    expect(shouldFilterMetadataPermission('metadata', metadataOnly)).toBe(false)

    // Case 3: non-metadata permission (should NOT be filtered)
    const nonMetadata = [{ contents: 'read' }]
    expect(shouldFilterMetadataPermission('contents', nonMetadata)).toBe(false)
  })

  test('filters metadata operations with additional permissions', () => {
    const filteredOperations: FilteredOperation[] = []
    const metadataPermissions: MetadataPermission[] = []

    for (const operation of mockOperationsWithMetadata) {
      const progData = mockProgAccessData[operation.operationId]

      for (const permissionSet of progData.permissions) {
        for (const [permissionName] of Object.entries(permissionSet)) {
          if (mockProgActorResources[permissionName]?.visibility === 'private') continue

          const additionalPermissions = calculateAdditionalPermissions(progData.permissions)

          // Apply metadata filtering logic
          if (shouldFilterMetadataPermission(permissionName, progData.permissions)) {
            // Skip this metadata permission as it has additional permissions
            continue
          }

          if (permissionName === 'metadata') {
            metadataPermissions.push({
              operationId: operation.operationId,
              additionalPermissions,
            })
          } else {
            filteredOperations.push({
              operationId: operation.operationId,
              permission: permissionName,
              additionalPermissions,
            })
          }
        }
      }
    }

    // Should only have metadata permission from the metadata-only operation
    expect(metadataPermissions).toHaveLength(1)
    expect(metadataPermissions[0].operationId).toBe('repos/get-readme')
    expect(metadataPermissions[0].additionalPermissions).toBe(false)

    // Should have other permissions from operations with additional permissions
    const adminPermission = filteredOperations.find((op) => op.permission === 'administration')
    expect(adminPermission).toBeDefined()
    expect(adminPermission!.operationId).toBe('repos/enable-automated-security-fixes')
    expect(adminPermission!.additionalPermissions).toBe(true)

    const orgAdminPermission = filteredOperations.find(
      (op) => op.permission === 'organization_administration',
    )
    expect(orgAdminPermission).toBeDefined()
    expect(orgAdminPermission!.operationId).toBe('orgs/update-webhook')
    expect(orgAdminPermission!.additionalPermissions).toBe(true)
  })

  test('preserves non-metadata permissions regardless of additional permissions', () => {
    const nonMetadataOperations = mockOperationsWithMetadata.filter(
      (op) =>
        !mockProgAccessData[op.operationId].permissions.some((permSet) => 'metadata' in permSet),
    )

    expect(nonMetadataOperations).toHaveLength(1)
    expect(nonMetadataOperations[0].operationId).toBe('repos/get-content')

    // Verify contents permission would be preserved
    const contentsPermissionSet = mockProgAccessData['repos/get-content'].permissions[0]
    expect('contents' in contentsPermissionSet).toBe(true)
    expect('metadata' in contentsPermissionSet).toBe(false)
  })

  test('handles edge cases in permission sets', () => {
    // Empty permission set
    expect(shouldFilterMetadataPermission('metadata', [])).toBe(false)

    // Permission set with empty object (edge case)
    const edgeCase1: Record<string, string>[] = [{ metadata: 'read' }, {}]
    expect(shouldFilterMetadataPermission('metadata', edgeCase1)).toBe(true)

    // Multiple permission sets with metadata in different sets
    const edgeCase2: Record<string, string>[] = [{ metadata: 'read' }, { admin: 'write' }]
    expect(shouldFilterMetadataPermission('metadata', edgeCase2)).toBe(true)
  })

  test('filters metadata permissions that match the GitHub issue examples', () => {
    // These are examples from the GitHub issue that should be filtered out
    // PUT /orgs/{org}/actions/permissions/repositories/{repository_id}
    const putActionsPermissions = [{ metadata: 'read', organization_administration: 'write' }]

    // DELETE /orgs/{org}/actions/permissions/repositories/{repository_id}
    const deleteActionsPermissions = [{ metadata: 'read', organization_administration: 'write' }]

    // These should be filtered out because they have metadata + additional permissions
    expect(shouldFilterMetadataPermission('metadata', putActionsPermissions)).toBe(true)
    expect(shouldFilterMetadataPermission('metadata', deleteActionsPermissions)).toBe(true)

    // But the organization_administration permissions should NOT be filtered
    expect(
      shouldFilterMetadataPermission('organization_administration', putActionsPermissions),
    ).toBe(false)
    expect(
      shouldFilterMetadataPermission('organization_administration', deleteActionsPermissions),
    ).toBe(false)
  })

  test('preserves metadata permissions that are standalone', () => {
    // Example of a metadata-only permission that should be preserved
    const metadataOnlyPermissions = [{ metadata: 'read' }]

    // This should NOT be filtered out
    expect(shouldFilterMetadataPermission('metadata', metadataOnlyPermissions)).toBe(false)
  })

  test('handles complex permission structures from real data', () => {
    // Multiple permission sets (should filter metadata)
    const multiplePermissionSets: Record<string, string>[] = [
      { metadata: 'read' },
      { administration: 'write' },
    ]
    expect(shouldFilterMetadataPermission('metadata', multiplePermissionSets)).toBe(true)

    // Single permission set with multiple permissions (should filter metadata)
    const multiplePermissionsInSet: Record<string, string>[] = [
      { metadata: 'read', contents: 'write', pull_requests: 'write' },
    ]
    expect(shouldFilterMetadataPermission('metadata', multiplePermissionsInSet)).toBe(true)

    // Multiple permission sets where metadata is not in the first set
    const metadataInSecondSet: Record<string, string>[] = [
      { administration: 'write' },
      { metadata: 'read' },
    ]
    expect(shouldFilterMetadataPermission('metadata', metadataInSecondSet)).toBe(true)
  })

  test('validates filtering logic against known problematic endpoints', () => {
    // Based on the issue description, these types of operations should have
    // their metadata permissions filtered out:

    // Runner group operations
    const runnerGroupPermissions = [{ metadata: 'read', organization_administration: 'write' }]

    // Organization secrets operations
    const orgSecretsPermissions = [{ metadata: 'read', organization_secrets: 'write' }]

    // Repository operations with admin permissions
    const repoAdminPermissions = [{ metadata: 'read', administration: 'write' }]

    // All of these should filter out metadata
    expect(shouldFilterMetadataPermission('metadata', runnerGroupPermissions)).toBe(true)
    expect(shouldFilterMetadataPermission('metadata', orgSecretsPermissions)).toBe(true)
    expect(shouldFilterMetadataPermission('metadata', repoAdminPermissions)).toBe(true)

    // But should preserve the actual required permissions
    expect(
      shouldFilterMetadataPermission('organization_administration', runnerGroupPermissions),
    ).toBe(false)
    expect(shouldFilterMetadataPermission('organization_secrets', orgSecretsPermissions)).toBe(
      false,
    )
    expect(shouldFilterMetadataPermission('administration', repoAdminPermissions)).toBe(false)
  })

  test('verifies consistency with additional-permissions flag calculation', () => {
    const testCases: Array<{ permissionSets: Record<string, string>[]; expected: boolean }> = [
      // Single permission, single set - no additional permissions
      { permissionSets: [{ metadata: 'read' }], expected: false },

      // Multiple permissions, single set - has additional permissions
      { permissionSets: [{ metadata: 'read', admin: 'write' }], expected: true },

      // Single permission, multiple sets - has additional permissions
      { permissionSets: [{ metadata: 'read' }, { admin: 'write' }], expected: true },

      // Multiple permissions, multiple sets - has additional permissions
      {
        permissionSets: [{ metadata: 'read', contents: 'read' }, { admin: 'write' }],
        expected: true,
      },
    ]

    for (const testCase of testCases) {
      const additionalPermissions = calculateAdditionalPermissions(testCase.permissionSets)
      const shouldFilter = shouldFilterMetadataPermission('metadata', testCase.permissionSets)

      // The filtering logic should match the additional permissions calculation
      expect(shouldFilter).toBe(additionalPermissions)
      expect(additionalPermissions).toBe(testCase.expected)
    }
  })

  test('validates filtering logic matches expected behavior from issue', () => {
    // Based on the GitHub issue, these operations should be filtered out from metadata:
    // - PUT /orgs/{org}/actions/permissions/repositories/{repository_id}
    // - DELETE /orgs/{org}/actions/permissions/repositories/{repository_id}
    // Because they have metadata + organization_administration permissions

    const progData: ProgAccessData = {
      userToServerRest: true,
      serverToServer: true,
      permissions: [{ metadata: 'read', organization_administration: 'write' }],
    }

    // This should be filtered out from metadata permissions
    expect(shouldFilterMetadataPermission('metadata', progData.permissions)).toBe(true)

    // But organization_administration permission should still be included
    expect(
      shouldFilterMetadataPermission('organization_administration', progData.permissions),
    ).toBe(false)

    // Verify additional permissions flag is set correctly
    expect(calculateAdditionalPermissions(progData.permissions)).toBe(true)
  })
})