import { classifyMcpPath } from "./mcp/mount";

// ---------------------------------------------------------------------------
// Single source of truth for "does the unified app handler own this path?" —
// the decision `start.ts` makes per request (app handler vs TanStack Start).
//
// The app handler (`ExecutorApp.make`'s `toWebHandler`) serves everything under
// `/api/*` — the typed API plus the cloud `extensions.routes` (the Autumn billing
// proxy at `/api/billing/*` and Swagger at `/api/docs` both live under `/api`) —
// plus the `/mcp` serving envelope and its `/.well-known/*` OAuth discovery docs.
// The dispatcher forwards those UNMODIFIED; anything else falls through to the
// Start router. Keeping every served route under `/api` (no separate top-level
// namespace) is what keeps this gate a simple two-prefix check.
// ---------------------------------------------------------------------------

export const isApiPath = (pathname: string) => pathname === "/api" || pathname.startsWith("/api/");

export const isAppOwnedPath = (pathname: string) =>
  isApiPath(pathname) || classifyMcpPath(pathname) !== null;

// ---------------------------------------------------------------------------
// Which plane serves an app-owned path: the Effect app directly, or TanStack
// Start's middleware chain.
//
// Everything under `/api` is pure Effect and touches no part of the router,
// React, or SSR — so `server.ts` dispatches it at the Worker entry and skips
// Start's lazy `loadEntries` import entirely. Two paths must NOT take that
// shortcut, because Start's request middleware claims them BEFORE the app
// handler would ever see them:
//
//   POST /api/sentry-tunnel  - `sentryTunnelMiddleware` forwards the envelope
//                              to Sentry; the app has no such route.
//   /api/oauth/callback      - `oauthCallbackSignInMiddleware` redirects a
//                              signed-out visitor to /login, and start.ts
//                              rewrites the org-scoped `state` before handing
//                              off. Routing it early would drop both.
//
// Getting this wrong is silent: the request still gets a response, just the
// wrong one, which is why it is classified here and tested rather than being
// an inline condition at the dispatch site.
// ---------------------------------------------------------------------------

export const isStartOwnedApiPath = (pathname: string, method: string): boolean =>
  (pathname === "/api/sentry-tunnel" && method === "POST") || pathname === "/api/oauth/callback";

export const servedByAppPlane = (pathname: string, method: string): boolean =>
  isApiPath(pathname) && !isStartOwnedApiPath(pathname, method);

// ---------------------------------------------------------------------------
// Which paths the AUTH plane serves (`app-auth.ts`), ahead of the app plane.
//
// The app plane is `ExecutorApp.make`'s single handler: one `HttpApiBuilder`
// router built in one pass, so the first `/api/*` request in an isolate
// evaluates the plugin + OpenAPI + MCP + GraphQL catalogs, the execution
// substrate and Swagger — cold p50 ~2.2s against ~120ms warm, on ~31% of
// requests. The session routes need none of that, so they get their own small
// handler and `server.ts` tries this classifier first.
//
// It is an EXACT allowlist rather than an `/api/auth/` prefix test, because the
// two planes 404 differently: a path this claims but `app-auth.ts` does not
// mount would answer from the wrong router. Every entry below is a route
// `makeSessionRoutes` / `makeOrgRoutes` register — keep them in step.
// ---------------------------------------------------------------------------

// A Map, not an object literal: the method comes off the wire, and an object
// would resolve `constructor` (a legal HTTP token) to `Object` and then throw.
const AUTH_PLANE_EXACT_PATHS: ReadonlyMap<string, ReadonlySet<string>> = new Map([
  // CloudAuthPublicApi (no session required) + the read side of CloudAuthApi.
  [
    "GET",
    new Set([
      "/api/auth/login",
      "/api/auth/callback",
      "/api/auth/cli-login",
      "/api/auth/me",
      "/api/auth/organizations",
      "/api/auth/pending-invitations",
      "/api/org/domains",
    ]),
  ],
  [
    "POST",
    new Set([
      "/api/auth/logout",
      "/api/auth/create-organization",
      "/api/auth/delete-organization",
      "/api/auth/accept-invitation",
      "/api/org/domains/verify-link",
    ]),
  ],
]);

// The parameterised routes. `:mcpSessionId` / `:executionId` / `:domainId` are
// single path segments, so an anchored one-segment match is the same grammar
// the Effect router applies.
const MCP_APPROVAL_GET = /^\/api\/mcp-sessions\/[^/]+\/executions\/[^/]+$/;
const MCP_APPROVAL_RESUME = /^\/api\/mcp-sessions\/[^/]+\/executions\/[^/]+\/resume$/;
const ORG_DOMAIN_DELETE = /^\/api\/org\/domains\/[^/]+$/;

/**
 * Does the small auth-plane handler serve this request?
 *
 * Gated on `servedByAppPlane` first so the Start-owned `/api` paths keep their
 * route no matter what this list says — the auth plane must never be a second
 * way to lose `sentryTunnelMiddleware` or the signed-out OAuth redirect.
 */
export const servedByAuthPlane = (pathname: string, method: string): boolean => {
  if (!servedByAppPlane(pathname, method)) return false;
  if (AUTH_PLANE_EXACT_PATHS.get(method)?.has(pathname) === true) return true;
  if (method === "GET") return MCP_APPROVAL_GET.test(pathname);
  if (method === "POST") return MCP_APPROVAL_RESUME.test(pathname);
  if (method === "DELETE") return ORG_DOMAIN_DELETE.test(pathname);
  return false;
};