import { Effect } from "effect";

import type { AppsRuntime } from "../plugin/runtime";
import type { Bindings } from "../plugin/bindings";

// ---------------------------------------------------------------------------
// Apps HTTP surface — a plain web handler (Request -> Response) the self-host
// app mounts as an extension route under `/api/apps/*`. Covers:
//   POST /api/apps/:scope/publish         { files }        -> descriptor
//   GET  /api/apps/:scope/descriptor                       -> descriptor
//   POST /api/apps/:scope/tools/:tool     { args, bindings } -> result
//   POST /api/apps/:scope/workflows/:wf/start { input, bindings } -> run
//   POST /api/apps/:scope/workflows/runs/:runId/signal { event, payload } -> run
//   GET  /api/apps/:scope/workflows/runs/:runId            -> run + steps
//   GET  /api/apps/:scope/workflows/runs                   -> runs
//   GET  /api/apps/:scope/ui/:name                         -> compiled bundle (JS)
//   GET  /api/apps/:scope/live (SSE)                       -> invalidations
//
// It's deliberately transport-thin: all logic is in AppsRuntime.
// ---------------------------------------------------------------------------

export interface AppsHttpDeps {
  readonly runtime: AppsRuntime;
  /** Mount prefix (default "/api/apps"). */
  readonly prefix?: string;
  /**
   * Authenticate an inbound request. Returns `true` when the caller is
   * authorized and `false` otherwise; the handler answers `false` with a 401.
   *
   * The apps surface (publish / invoke / workflow lifecycle / SSE) mutates
   * per-scope state and reaches real integrations, so it MUST be behind the same
   * credential the rest of `/api` requires. This seam lets the host thread its
   * own identity check (self-host's Better Auth session/bearer/api-key) in
   * without this package importing the host's auth stack. When omitted (tests
   * that drive the runtime directly) every request is allowed.
   */
  readonly authenticate?: (request: Request) => Promise<boolean>;
}

const json = (body: unknown, status = 200): Response =>
  new Response(JSON.stringify(body), {
    status,
    headers: { "content-type": "application/json" },
  });

const run = <A, E>(effect: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(effect as never);

const unknownMessage = (cause: unknown): string => {
  // oxlint-disable-next-line executor/no-instanceof-error, executor/no-unknown-error-message -- boundary: HTTP adapter preserves existing error response text
  return cause instanceof Error ? cause.message : String(cause);
};

export const makeAppsHttpRoutes = (
  deps: AppsHttpDeps,
): { readonly path: string; readonly handler: (request: Request) => Promise<Response> } => {
  const prefix = deps.prefix ?? "/api/apps";
  const runtime = deps.runtime;

  const handler = async (request: Request): Promise<Response> => {
    const url = new URL(request.url);
    if (!url.pathname.startsWith(prefix)) return new Response("not found", { status: 404 });

    // Auth gate: the whole apps surface (publish/invoke/workflows/ui/SSE) is
    // behind the host's identity check. An unauthenticated caller gets a 401
    // BEFORE any route logic runs — including the SSE stream.
    if (deps.authenticate) {
      const ok = await deps.authenticate(request).then(
        (value) => value,
        () => false,
      );
      if (!ok) {
        return new Response(JSON.stringify({ error: "Unauthorized" }), {
          status: 401,
          headers: { "content-type": "application/json" },
        });
      }
    }

    const rest = url.pathname.slice(prefix.length).replace(/^\//, "");
    const parts = rest.split("/").filter(Boolean);
    // parts[0] = scope
    const scope = parts[0];
    if (!scope) return json({ error: "scope required" }, 400);

    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: HTTP handler converts route/runtime failures into JSON 400 responses
    try {
      // POST :scope/publish
      if (parts[1] === "publish" && request.method === "POST") {
        const body = (await request.json()) as { files: Record<string, string>; message?: string };
        const files = new Map(Object.entries(body.files ?? {}));
        const out = await run(runtime.publish({ scope, files, message: body.message }));
        return json({ snapshotId: out.snapshotId, descriptor: out.descriptor });
      }

      // GET :scope/descriptor
      if (parts[1] === "descriptor" && request.method === "GET") {
        const descriptor = await run(runtime.getDescriptor(scope));
        return json({ descriptor });
      }

      // POST :scope/tools/:tool
      if (parts[1] === "tools" && parts[2] && request.method === "POST") {
        const body = (await request.json()) as { args?: unknown; bindings?: Bindings };
        const result = await run(
          runtime.invokeTool({
            scope,
            tool: parts[2],
            args: body.args ?? {},
            bindings: body.bindings ?? {},
          }),
        );
        return json({ result });
      }

      // POST :scope/workflows/:wf/start
      if (parts[1] === "workflows" && parts[3] === "start" && request.method === "POST") {
        const body = (await request.json()) as {
          input?: unknown;
          bindings?: Bindings;
          runId?: string;
        };
        const runView = await run(
          runtime.startWorkflow({
            scope,
            workflow: parts[2],
            input: body.input,
            bindings: body.bindings,
            runId: body.runId,
          }),
        );
        return json({ run: runView });
      }

      // POST :scope/workflows/runs/:runId/signal
      if (
        parts[1] === "workflows" &&
        parts[2] === "runs" &&
        parts[3] &&
        parts[4] === "signal" &&
        request.method === "POST"
      ) {
        const body = (await request.json()) as { event: string; payload?: unknown };
        const runView = await run(
          runtime.signalWorkflow({
            scope,
            runId: parts[3],
            event: body.event,
            payload: body.payload,
          }),
        );
        return json({ run: runView });
      }

      // GET :scope/workflows/runs/:runId
      if (parts[1] === "workflows" && parts[2] === "runs" && parts[3] && request.method === "GET") {
        const runView = await run(runtime.getRun(parts[3]));
        const steps = await run(runtime.listSteps(parts[3]));
        return json({ run: runView, steps });
      }

      // GET :scope/workflows/runs
      if (
        parts[1] === "workflows" &&
        parts[2] === "runs" &&
        !parts[3] &&
        request.method === "GET"
      ) {
        const runs = await run(runtime.listRuns(scope));
        return json({ runs });
      }

      // GET :scope/ui/:name -> compiled JS bundle, OR the self-booting HTML
      // document when `?document=html` (Fix 10: the fallback a non-UI MCP client
      // opens in a browser). Both are behind the same auth gate as the rest of
      // the surface.
      if (parts[1] === "ui" && parts[2] && request.method === "GET") {
        if (url.searchParams.get("document") === "html") {
          const doc = await run(runtime.getUiDocument(scope, parts[2]));
          if (!doc) return new Response("ui not found", { status: 404 });
          return new Response(doc.html, {
            status: 200,
            headers: {
              "content-type": "text/html; charset=utf-8",
              "x-ui-title": doc.title ?? "",
              "x-ui-max-height": String(doc.maxHeight ?? ""),
            },
          });
        }
        const bundle = await run(runtime.getUiBundle(scope, parts[2]));
        if (!bundle) return new Response("ui not found", { status: 404 });
        return new Response(bundle.code, {
          status: 200,
          headers: {
            "content-type": "application/javascript",
            "x-ui-title": bundle.title ?? "",
            "x-ui-max-height": String(bundle.maxHeight ?? ""),
          },
        });
      }

      // GET :scope/live -> SSE invalidations
      if (parts[1] === "live" && request.method === "GET") {
        return sseResponse(scope, runtime);
      }

      return new Response("not found", { status: 404 });
    } catch (cause) {
      return json({ error: unknownMessage(cause) }, 400);
    }
  };

  return { path: `${prefix}/*`, handler };
};

// An SSE stream of `{table, version}` invalidations for a scope. Each scope-db
// write bumps a counter and publishes here; a `: keepalive` comment holds the
// connection open.
const sseResponse = (scope: string, runtime: AppsRuntime): Response => {
  let unsubscribe: (() => void) | undefined;
  let keepalive: ReturnType<typeof setInterval> | undefined;
  const stream = new ReadableStream<Uint8Array>({
    start(controller) {
      const enc = new TextEncoder();
      controller.enqueue(enc.encode(`event: ready\ndata: {"scope":"${scope}"}\n\n`));
      unsubscribe = runtime.subscribeLive(scope, (event) => {
        // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: ReadableStream enqueue throws after the client closes
        try {
          controller.enqueue(
            enc.encode(
              `event: invalidate\ndata: ${JSON.stringify({ scope, table: event.table, version: event.version })}\n\n`,
            ),
          );
        } catch {
          /* controller closed */
        }
      });
      keepalive = setInterval(() => {
        // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: keepalive enqueue is best-effort after disconnect
        try {
          controller.enqueue(enc.encode(`: keepalive\n\n`));
        } catch {
          /* closed */
        }
      }, 15_000);
    },
    cancel() {
      unsubscribe?.();
      if (keepalive) clearInterval(keepalive);
    },
  });
  return new Response(stream, {
    status: 200,
    headers: {
      "content-type": "text/event-stream",
      "cache-control": "no-cache",
      connection: "keep-alive",
    },
  });
};