import Foundation

public enum ProviderConfigEnvironment {
    public static func applyAPIKeyOverride(
        base: [String: String],
        provider: UsageProvider,
        config: ProviderConfig?) -> [String: String]
    {
        if provider == .openai {
            return self.applyOpenAIOverrides(base: base, config: config)
        }
        if provider == .bedrock {
            return self.applyBedrockOverrides(base: base, config: config)
        }
        if provider == .deepgram {
            return self.applyDeepgramOverrides(base: base, config: config)
        }
        if provider == .llmproxy {
            return self.applyLLMProxyOverrides(base: base, config: config)
        }
        if provider == .azureopenai {
            return self.applyAzureOpenAIOverrides(base: base, config: config)
        }
        guard let apiKey = config?.sanitizedAPIKey, !apiKey.isEmpty else { return base }
        var env = base
        if let key = self.directAPIKeyEnvironmentKey(for: provider) {
            env[key] = apiKey
            return env
        }

        switch provider {
        case .copilot:
            env["COPILOT_API_TOKEN"] = apiKey
        case .kimik2:
            if let key = KimiK2SettingsReader.apiKeyEnvironmentKeys.first {
                env[key] = apiKey
            }
        case .warp:
            if let key = WarpSettingsReader.apiKeyEnvironmentKeys.first {
                env[key] = apiKey
            }
        case .codebuff:
            // Preserve a token already present in the process environment so that
            // runtime/CI overrides win over a key saved in Settings (matches the
            // precedence used by `ProviderTokenResolver.codebuffResolution`).
            if CodebuffSettingsReader.apiKey(environment: base) == nil {
                env[CodebuffSettingsReader.apiTokenKey] = apiKey
            }
        case .crof:
            if CrofSettingsReader.apiKey(environment: base) == nil,
               let key = CrofSettingsReader.apiKeyEnvironmentKeys.first
            {
                env[key] = apiKey
            }
        case .doubao:
            if let key = DoubaoSettingsReader.apiKeyEnvironmentKeys.first {
                env[key] = apiKey
            }
        default:
            break
        }
        return env
    }

    public static func supportsAPIKeyOverride(for provider: UsageProvider) -> Bool {
        if self.directAPIKeyEnvironmentKey(for: provider) != nil { return true }
        switch provider {
        case .copilot, .kimik2, .warp, .codebuff, .crof, .doubao:
            return true
        case .azureopenai:
            return true
        default:
            return false
        }
    }

    private static func directAPIKeyEnvironmentKey(for provider: UsageProvider) -> String? {
        switch provider {
        case .openai:
            OpenAIAPISettingsReader.adminAPIKeyEnvironmentKey
        case .azureopenai:
            AzureOpenAISettingsReader.apiKeyEnvironmentKey
        case .claude:
            ClaudeAdminAPISettingsReader.adminAPIKeyEnvironmentKey
        case .zai:
            ZaiSettingsReader.apiTokenKey
        case .minimax:
            MiniMaxAPISettingsReader.apiTokenKey
        case .alibaba:
            AlibabaCodingPlanSettingsReader.apiTokenKey
        case .kilo:
            KiloSettingsReader.apiTokenKey
        case .synthetic:
            SyntheticSettingsReader.apiKeyKey
        case .openrouter:
            OpenRouterSettingsReader.envKey
        case .elevenlabs:
            ElevenLabsSettingsReader.apiKeyEnvironmentKey
        case .moonshot:
            MoonshotSettingsReader.apiKeyEnvironmentKeys.first
        case .ollama:
            OllamaAPISettingsReader.apiKeyEnvironmentKeys.first
        case .venice:
            VeniceSettingsReader.apiKeyEnvironmentKey
        case .deepgram:
            DeepgramSettingsReader.apiKeyEnvironmentKey
        case .groq:
            GroqSettingsReader.apiKeyEnvironmentKey
        case .llmproxy:
            LLMProxySettingsReader.apiKeyEnvironmentKey
        default:
            nil
        }
    }

    private static func applyOpenAIOverrides(
        base: [String: String],
        config: ProviderConfig?) -> [String: String]
    {
        guard let config else { return base }
        var env = base
        if let apiKey = config.sanitizedAPIKey {
            env[OpenAIAPISettingsReader.adminAPIKeyEnvironmentKey] = apiKey
        }
        if let projectID = config.sanitizedWorkspaceID {
            env[OpenAIAPISettingsReader.projectIDEnvironmentKey] = projectID
        }
        return env
    }

    private static func applyBedrockOverrides(
        base: [String: String],
        config: ProviderConfig?) -> [String: String]
    {
        guard let config else { return base }
        var env = base

        // Only project an explicit auth-mode selection. When the config does not
        // specify one, leave the base environment untouched so an env-driven setup
        // (AWS_PROFILE or CODEXBAR_BEDROCK_AUTH_MODE from the launch environment) is
        // still inferred by BedrockSettingsReader instead of being forced to `keys`.
        let configMode = config.sanitizedAWSAuthMode.flatMap(BedrockAuthMode.init(rawValue:))
        if let configMode {
            env[BedrockSettingsReader.authModeKey] = configMode.rawValue
        }
        let baseMode = BedrockSettingsReader
            .cleaned(base[BedrockSettingsReader.authModeKey])
            .flatMap { BedrockAuthMode(rawValue: $0.lowercased()) }

        let mergedAccessKey = config.sanitizedAPIKey ?? BedrockSettingsReader.accessKeyID(environment: base)
        let mergedSecretKey = config.sanitizedSecretKey ?? BedrockSettingsReader.secretAccessKey(environment: base)
        let hasMergedStaticKeys = mergedAccessKey != nil && mergedSecretKey != nil
        let effectiveMode: BedrockAuthMode = if let configMode {
            configMode
        } else if let baseMode {
            baseMode
        } else if hasMergedStaticKeys {
            // Upgrade path: a config saved before auth modes existed keeps using
            // static credentials (including env+config layering) even if AWS_PROFILE
            // is present in the base environment, so existing users are never
            // silently switched to a profile/account.
            .keys
        } else {
            BedrockSettingsReader.authMode(environment: base)
        }

        switch effectiveMode {
        case .profile:
            if let profile = config.sanitizedAWSProfile {
                env[BedrockSettingsReader.profileKey] = profile
            }
        case .keys:
            if let accessKeyID = config.sanitizedAPIKey {
                env[BedrockSettingsReader.accessKeyIDKey] = accessKeyID
            }
            if let secretAccessKey = config.sanitizedSecretKey {
                env[BedrockSettingsReader.secretAccessKeyKey] = secretAccessKey
            }
        }

        if let region = config.sanitizedRegion {
            env[BedrockSettingsReader.regionKeys[0]] = region
        }

        return env
    }

    private static func applyDeepgramOverrides(
        base: [String: String],
        config: ProviderConfig?) -> [String: String]
    {
        guard let config else { return base }

        var env = base

        if let apiKey = config.sanitizedAPIKey {
            env[DeepgramSettingsReader.apiKeyEnvironmentKey] = apiKey
        }

        if let projectID = config.sanitizedWorkspaceID {
            env[DeepgramSettingsReader.projectIDEnvironmentKey] = projectID
        }

        return env
    }

    private static func applyLLMProxyOverrides(
        base: [String: String],
        config: ProviderConfig?) -> [String: String]
    {
        var env = base
        if let apiKey = config?.sanitizedAPIKey {
            env[LLMProxySettingsReader.apiKeyEnvironmentKey] = apiKey
        }
        if let baseURL = config?.sanitizedEnterpriseHost {
            env[LLMProxySettingsReader.baseURLEnvironmentKey] = baseURL
        }
        return env
    }

    private static func applyAzureOpenAIOverrides(
        base: [String: String],
        config: ProviderConfig?) -> [String: String]
    {
        guard let config else { return base }
        var env = base
        if let apiKey = config.sanitizedAPIKey {
            env[AzureOpenAISettingsReader.apiKeyEnvironmentKey] = apiKey
        }
        if let endpoint = config.sanitizedEnterpriseHost {
            env[AzureOpenAISettingsReader.endpointEnvironmentKey] = endpoint
        }
        if let deploymentName = config.sanitizedWorkspaceID {
            env[AzureOpenAISettingsReader.deploymentNameEnvironmentKey] = deploymentName
        }
        return env
    }

    public static func applyProviderConfigOverrides(
        base: [String: String],
        provider: UsageProvider,
        config: ProviderConfig?) -> [String: String]
    {
        self.applyAPIKeyOverride(base: base, provider: provider, config: config)
    }
}