import { Context, Data, Effect, Layer, Option, Schema } from "effect";

import { ApiKeyManagementError } from "./errors";
import { WorkOSClient } from "./workos";

/**
 * Which view a validated key resolves to.
 *   - `"user"` — the product view. The key belongs to a member; the request
 *     binds to that member as the acting subject. Every key today is this.
 *   - `"org"` — the PLATFORM view. The key belongs to the organization itself,
 *     so there is no acting member: the request gets tenant-wide READ-ONLY
 *     reach and no bound subject. Privileged; minted separately (PR 1.5).
 */
export type ApiKeyScope = "user" | "org";

/** The owner an api key resolves to — NOT a full {@link Principal} (no email /
 * name / roles), so it carries an honest, distinct name. */
export type ApiKeyOwner = {
  readonly scope: ApiKeyScope;
  /** The acting member for a `"user"` key; `null` for an `"org"` key, which
   *  has no member behind it. Nullable rather than a sentinel so nothing can
   *  accidentally bind an org key to a subject. */
  readonly accountId: string | null;
  readonly organizationId: string;
  readonly keyId: string;
};

export type ApiKeySummary = {
  readonly id: string;
  readonly name: string;
  readonly obfuscatedValue: string;
  readonly createdAt: string;
  readonly updatedAt: string;
  readonly lastUsedAt: string | null;
};

export type CreatedApiKey = ApiKeySummary & {
  readonly value: string;
};

export class ApiKeyValidationError extends Data.TaggedError("ApiKeyValidationError")<{
  readonly cause: unknown;
}> {}

/**
 * The requested key id is not an org-owned key of this organization — it does
 * not exist, belongs to a member rather than the org, or belongs to a different
 * org in the same WorkOS workspace. Distinct from `ApiKeyManagementError` (an
 * upstream failure) so callers can answer "not found" without a 500.
 */
export class OrgApiKeyNotFound extends Data.TaggedError("OrgApiKeyNotFound")<{
  readonly keyId: string;
}> {}

// WorkOS keys are owned by either a user or an organization. The user shape
// carries the member id in `id` and the org in `organization_id`; the org shape
// carries the ORG in `id` and no member at all. Both decode here — the
// distinction is a branch (`ownerFromApiKey`), not a decode failure, so an
// org-owned key is no longer indistinguishable from an invalid one.
const UserApiKeyOwner = Schema.Struct({
  type: Schema.Literal("user"),
  id: Schema.String,
  organizationId: Schema.optional(Schema.String),
  organization_id: Schema.optional(Schema.String),
});

const OrgApiKeyOwner = Schema.Struct({
  type: Schema.Literal("organization"),
  id: Schema.String,
});

const WorkOSApiKeyOwner = Schema.Union([UserApiKeyOwner, OrgApiKeyOwner]);

const ApiKey = Schema.Struct({
  id: Schema.String,
  owner: UserApiKeyOwner,
  name: Schema.optional(Schema.String),
  obfuscatedValue: Schema.optional(Schema.String),
  obfuscated_value: Schema.optional(Schema.String),
  createdAt: Schema.optional(Schema.String),
  created_at: Schema.optional(Schema.String),
  updatedAt: Schema.optional(Schema.String),
  updated_at: Schema.optional(Schema.String),
  lastUsedAt: Schema.optional(Schema.NullOr(Schema.String)),
  last_used_at: Schema.optional(Schema.NullOr(Schema.String)),
});

// Validation accepts BOTH owner shapes. The user list/create paths below stay
// user-only on purpose (they are the console's personal-key CRUD); the ORG
// list/create paths are the separate, privileged surface beside them, gated to
// admins at the account-provider boundary.
const ValidatedApiKey = Schema.Struct({
  id: Schema.String,
  owner: WorkOSApiKeyOwner,
});

const ValidateApiKeyResponse = Schema.Struct({
  apiKey: Schema.NullOr(ValidatedApiKey),
});

const RawCreatedApiKey = Schema.Struct({
  id: Schema.String,
  owner: UserApiKeyOwner,
  name: Schema.optional(Schema.String),
  obfuscatedValue: Schema.optional(Schema.String),
  obfuscated_value: Schema.optional(Schema.String),
  createdAt: Schema.optional(Schema.String),
  created_at: Schema.optional(Schema.String),
  updatedAt: Schema.optional(Schema.String),
  updated_at: Schema.optional(Schema.String),
  lastUsedAt: Schema.optional(Schema.NullOr(Schema.String)),
  last_used_at: Schema.optional(Schema.NullOr(Schema.String)),
  value: Schema.String,
});

const ListApiKeysResponse = Schema.Struct({
  data: Schema.Array(ApiKey),
});

// The ORG-owned mirror of `ApiKey` / `RawCreatedApiKey`. A separate shape
// rather than a widened one: `summaryFromApiKey` reads the user shape's
// `organization_id` to prove the key belongs to the caller's org, and an
// org-owned row carries the org in `owner.id` instead. Merging them would mean
// one nullable field standing for two different things.
const OrgApiKey = Schema.Struct({
  id: Schema.String,
  owner: OrgApiKeyOwner,
  name: Schema.optional(Schema.String),
  obfuscatedValue: Schema.optional(Schema.String),
  obfuscated_value: Schema.optional(Schema.String),
  createdAt: Schema.optional(Schema.String),
  created_at: Schema.optional(Schema.String),
  updatedAt: Schema.optional(Schema.String),
  updated_at: Schema.optional(Schema.String),
  lastUsedAt: Schema.optional(Schema.NullOr(Schema.String)),
  last_used_at: Schema.optional(Schema.NullOr(Schema.String)),
});

const RawCreatedOrgApiKey = Schema.Struct({
  ...OrgApiKey.fields,
  value: Schema.String,
});

// `data` is decoded element-by-element, NOT as `Schema.Array(OrgApiKey)`: WorkOS
// may return user-owned keys alongside org-owned ones, and a whole-array decode
// fails on the first non-org element — blanking the entire list rather than
// dropping the one row that doesn't belong. Same per-row tolerance the user-key
// path gets from `summaryFromApiKey` returning null.
const ListOrgApiKeysResponse = Schema.Struct({
  data: Schema.Array(Schema.Unknown),
});

const CreateOrgApiKeyResponse = Schema.Union([
  RawCreatedOrgApiKey,
  Schema.Struct({ apiKey: RawCreatedOrgApiKey }),
  Schema.Struct({ api_key: RawCreatedOrgApiKey }),
]);

const CreateApiKeyResponse = Schema.Union([
  RawCreatedApiKey,
  Schema.Struct({ apiKey: RawCreatedApiKey }),
  Schema.Struct({ api_key: RawCreatedApiKey }),
]);

const decodeValidateApiKeyResponse = Schema.decodeUnknownOption(ValidateApiKeyResponse);
const decodeListApiKeysResponse = Schema.decodeUnknownOption(ListApiKeysResponse);
const decodeCreateApiKeyResponse = Schema.decodeUnknownOption(CreateApiKeyResponse);
const decodeListOrgApiKeysResponse = Schema.decodeUnknownOption(ListOrgApiKeysResponse);
const decodeOrgApiKey = Schema.decodeUnknownOption(OrgApiKey);
const decodeCreateOrgApiKeyResponse = Schema.decodeUnknownOption(CreateOrgApiKeyResponse);

const ownerFromApiKey = (apiKey: typeof ValidatedApiKey.Type): ApiKeyOwner | null => {
  if (apiKey.owner.type === "organization") {
    // An org-owned key IS the org: `owner.id` is the organization, and there
    // is no member to act as. This resolves to the platform view.
    return {
      scope: "org",
      accountId: null,
      organizationId: apiKey.owner.id,
      keyId: apiKey.id,
    };
  }
  const organizationId = apiKey.owner.organizationId ?? apiKey.owner.organization_id;
  if (!organizationId) return null;
  return {
    scope: "user",
    accountId: apiKey.owner.id,
    organizationId,
    keyId: apiKey.id,
  };
};

const ownerFromResponse = (value: unknown): ApiKeyOwner | null =>
  Option.match(decodeValidateApiKeyResponse(value), {
    onNone: () => null,
    onSome: ({ apiKey }) => (apiKey ? ownerFromApiKey(apiKey) : null),
  });

const summaryFromApiKey = (apiKey: typeof ApiKey.Type): ApiKeySummary | null => {
  const organizationId = apiKey.owner.organizationId ?? apiKey.owner.organization_id;
  if (!organizationId) return null;
  return {
    id: apiKey.id,
    name: apiKey.name ?? "API key",
    obfuscatedValue: apiKey.obfuscatedValue ?? apiKey.obfuscated_value ?? "",
    createdAt: apiKey.createdAt ?? apiKey.created_at ?? "",
    updatedAt: apiKey.updatedAt ?? apiKey.updated_at ?? "",
    lastUsedAt: apiKey.lastUsedAt ?? apiKey.last_used_at ?? null,
  };
};

const listFromResponse = (value: unknown): readonly ApiKeySummary[] =>
  Option.match(decodeListApiKeysResponse(value), {
    onNone: () => [],
    onSome: ({ data }) =>
      data.flatMap((apiKey) => {
        const summary = summaryFromApiKey(apiKey);
        return summary ? [summary] : [];
      }),
  });

// The org-owned mirror of `summaryFromApiKey`. `organizationId` is checked by
// the CALLER against the org it asked for: WorkOS's workspace api key is
// workspace-wide, so a response naming a different org than the one requested
// must not be surfaced as that org's key.
const summaryFromOrgApiKey = (
  apiKey: typeof OrgApiKey.Type,
  organizationId: string,
): ApiKeySummary | null => {
  if (apiKey.owner.id !== organizationId) return null;
  return {
    id: apiKey.id,
    name: apiKey.name ?? "API key",
    obfuscatedValue: apiKey.obfuscatedValue ?? apiKey.obfuscated_value ?? "",
    createdAt: apiKey.createdAt ?? apiKey.created_at ?? "",
    updatedAt: apiKey.updatedAt ?? apiKey.updated_at ?? "",
    lastUsedAt: apiKey.lastUsedAt ?? apiKey.last_used_at ?? null,
  };
};

const orgListFromResponse = (value: unknown, organizationId: string): readonly ApiKeySummary[] =>
  Option.match(decodeListOrgApiKeysResponse(value), {
    onNone: () => [],
    onSome: ({ data }) =>
      data.flatMap((entry) =>
        Option.match(decodeOrgApiKey(entry), {
          // Not an org-owned key (a user key sharing the listing, or a shape we
          // don't recognize) — skip the row, keep the rest.
          onNone: () => [],
          onSome: (apiKey) => {
            const summary = summaryFromOrgApiKey(apiKey, organizationId);
            return summary ? [summary] : [];
          },
        }),
      ),
  });

const orgCreatedFromResponse = (value: unknown, organizationId: string): CreatedApiKey | null =>
  Option.match(decodeCreateOrgApiKeyResponse(value), {
    onNone: () => null,
    onSome: (response) => {
      const apiKey =
        "value" in response ? response : "apiKey" in response ? response.apiKey : response.api_key;
      const summary = summaryFromOrgApiKey(apiKey, organizationId);
      return summary ? { ...summary, value: apiKey.value } : null;
    },
  });

const createdFromResponse = (value: unknown): CreatedApiKey | null =>
  Option.match(decodeCreateApiKeyResponse(value), {
    onNone: () => null,
    onSome: (response) => {
      const apiKey =
        "value" in response ? response : "apiKey" in response ? response.apiKey : response.api_key;
      const summary = summaryFromApiKey(apiKey);
      return summary ? { ...summary, value: apiKey.value } : null;
    },
  });

export class ApiKeyService extends Context.Service<
  ApiKeyService,
  {
    readonly validate: (value: string) => Effect.Effect<ApiKeyOwner | null, ApiKeyValidationError>;
    readonly listUserKeys: (input: {
      readonly accountId: string;
      readonly organizationId: string;
    }) => Effect.Effect<readonly ApiKeySummary[], ApiKeyManagementError>;
    readonly createUserKey: (input: {
      readonly accountId: string;
      readonly organizationId: string;
      readonly name: string;
    }) => Effect.Effect<CreatedApiKey, ApiKeyManagementError>;
    readonly revokeUserKey: (input: {
      readonly keyId: string;
    }) => Effect.Effect<void, ApiKeyManagementError>;
    /**
     * The org-owned keys of an organization — the credentials that resolve to
     * the read-only platform view. Privileged: callers gate on admin membership
     * before reaching this.
     */
    readonly listOrgKeys: (input: {
      readonly organizationId: string;
    }) => Effect.Effect<readonly ApiKeySummary[], ApiKeyManagementError>;
    readonly createOrgKey: (input: {
      readonly organizationId: string;
      readonly name: string;
    }) => Effect.Effect<CreatedApiKey, ApiKeyManagementError>;
    /**
     * Revoke an org-owned key. Ownership is resolved against the ORG's own key
     * listing — never the caller's personal keys — so a member's user key id
     * (or another org's key id, since the WorkOS workspace key is
     * workspace-wide) cannot be destroyed through this path.
     */
    readonly revokeOrgKey: (input: {
      readonly organizationId: string;
      readonly keyId: string;
    }) => Effect.Effect<void, ApiKeyManagementError | OrgApiKeyNotFound>;
  }
>()("@executor-js/cloud/ApiKeyService") {
  static WorkOS = Layer.effect(this)(
    Effect.gen(function* () {
      const workos = yield* WorkOSClient;
      return {
        validate: (value: string) =>
          workos.validateApiKey(value).pipe(
            Effect.map(ownerFromResponse),
            Effect.mapError((cause) => new ApiKeyValidationError({ cause })),
          ),
        listUserKeys: ({ accountId, organizationId }) =>
          workos.listUserApiKeys(accountId, organizationId).pipe(
            Effect.map(listFromResponse),
            Effect.mapError((cause) => new ApiKeyManagementError({ cause })),
          ),
        createUserKey: ({ accountId, organizationId, name }) =>
          workos.createUserApiKey({ userId: accountId, organizationId, name }).pipe(
            Effect.mapError((cause) => new ApiKeyManagementError({ cause })),
            Effect.flatMap((response) => {
              const created = createdFromResponse(response);
              return created
                ? Effect.succeed(created)
                : Effect.fail(new ApiKeyManagementError({ cause: "invalid_create_response" }));
            }),
          ),
        revokeUserKey: ({ keyId }) =>
          workos
            .deleteApiKey(keyId)
            .pipe(Effect.mapError((cause) => new ApiKeyManagementError({ cause }))),
        listOrgKeys: ({ organizationId }) =>
          workos.listOrgApiKeys(organizationId).pipe(
            Effect.map((response) => orgListFromResponse(response, organizationId)),
            Effect.mapError((cause) => new ApiKeyManagementError({ cause })),
          ),
        createOrgKey: ({ organizationId, name }) =>
          workos.createOrgApiKey({ organizationId, name }).pipe(
            Effect.mapError((cause) => new ApiKeyManagementError({ cause })),
            Effect.flatMap((response) => {
              const created = orgCreatedFromResponse(response, organizationId);
              return created
                ? Effect.succeed(created)
                : Effect.fail(new ApiKeyManagementError({ cause: "invalid_create_response" }));
            }),
          ),
        // Ownership is checked against the ORG's decoded key listing before the
        // delete goes out. `deleteApiKey` is scope-blind — handed any key id it
        // would happily destroy a member's personal credential, or a key
        // belonging to a sibling org in the same workspace. The listing already
        // drops both of those (`orgListFromResponse` filters on owner type AND
        // organization), so filtering through it is the whole authorization.
        revokeOrgKey: ({ organizationId, keyId }) =>
          Effect.gen(function* () {
            const response = yield* workos
              .listOrgApiKeys(organizationId)
              .pipe(Effect.mapError((cause) => new ApiKeyManagementError({ cause })));
            const owned = orgListFromResponse(response, organizationId);
            if (!owned.some((key) => key.id === keyId)) {
              return yield* new OrgApiKeyNotFound({ keyId });
            }
            yield* workos
              .deleteApiKey(keyId)
              .pipe(Effect.mapError((cause) => new ApiKeyManagementError({ cause })));
          }),
      };
    }),
  );
}