// ---------------------------------------------------------------------------
// MCP ↔ generic auth-method converters — a thin oauth adapter over the shared
// codec (`@executor-js/react/lib/shared-auth-method-codec`). The apikey/none
// paths (multi-placement, multi-variable) live in the shared codec; MCP only
// contributes its oauth flavor: endpoint-less methods whose provider metadata
// is discovered at connect time (`discoveryUrl` = the MCP endpoint), with an
// optional declared scope override for servers whose metadata omits scopes.
// ---------------------------------------------------------------------------

import { AuthTemplateSlug } from "@executor-js/sdk/shared";
import type { AuthTemplateEditorValue } from "@executor-js/react/components/auth-template-editor";
import type { AuthMethodSeed } from "@executor-js/react/components/auth-method-list-editor";
import type { AuthMethod, Placement } from "@executor-js/react/lib/auth-placements";
import {
  authMethodFromSharedTemplate,
  editorValueFromSharedMethod,
  sharedMethodInputFromEditorValue,
  wirePlacementsFromEditor,
} from "@executor-js/react/lib/shared-auth-method-codec";

import { wireAuthInputFromShared } from "@executor-js/react/lib/shared-auth-method-codec";
import type {
  McpAuthMethod,
  McpAuthMethodInput,
  McpCanonicalAuthMethodInput,
  McpStdioEnvMethod,
} from "../sdk/types";

/** Stdio env method → generic hub `AuthMethod`: one `env`-carrier placement per
 *  declared var, so the account form collects one secret per env var. Mirrors
 *  the server's `describeMcpAuthMethods`. */
const stdioEnvAuthMethod = (method: McpStdioEnvMethod): AuthMethod => ({
  id: method.slug,
  label: "Environment variables",
  kind: "apikey",
  source: "spec",
  template: AuthTemplateSlug.make(method.slug),
  placements: method.vars.map((name) => ({ carrier: "env", name, prefix: "", variable: name })),
});

/** Stdio env method → editor value (apikey over env placements). */
const stdioEnvEditorValue = (method: McpStdioEnvMethod): AuthTemplateEditorValue => ({
  kind: "apikey",
  placements: method.vars.map((name) => ({ carrier: "env", name, prefix: "", variable: name })),
});

/** Serialize a canonical method into the wire input union (apikey → the
 *  request-shaped dialect; none/oauth2 pass through). */
export const mcpWireAuthInput = (
  method: McpAuthMethod | McpCanonicalAuthMethodInput,
): McpAuthMethodInput => wireAuthInputFromShared(method) as McpAuthMethodInput;

const oauthAuthMethod = (
  slug: string,
  endpoint: string,
  scopes: readonly string[] | undefined,
): AuthMethod => ({
  id: slug,
  label: "OAuth",
  kind: "oauth",
  source: slug.startsWith("custom_") ? "custom" : "spec",
  template: AuthTemplateSlug.make(slug),
  placements: [],
  oauth: {
    discoveryUrl: endpoint,
    ...(scopes !== undefined ? { scopes } : {}),
    supportsDynamicRegistration: true,
  },
});

/** Convert a generic editor value into one MCP auth-method input (no slug —
 *  the backend assigns carrier-derived slugs). An apikey value keeps every
 *  named placement (headers and query params mix freely); one with no usable
 *  placement falls back to `none`. */
export function mcpAuthMethodInputFromEditorValue(
  value: AuthTemplateEditorValue,
): McpCanonicalAuthMethodInput {
  if (value.kind === "oauth") {
    const [firstScope, ...remainingScopes] = value.scopes;
    return {
      kind: "oauth2",
      ...(firstScope !== undefined ? { scopes: [firstScope, ...remainingScopes] } : {}),
    };
  }
  return (sharedMethodInputFromEditorValue(value) ?? {
    kind: "none",
  }) as McpCanonicalAuthMethodInput;
}

/** Convert one stored MCP method into the generic editor value. */
export function editorValueFromMcpAuthMethod(method: McpAuthMethod): AuthTemplateEditorValue {
  if (method.kind === "oauth2") {
    return {
      kind: "oauth",
      authorizationUrl: "",
      tokenUrl: "",
      scopes: method.scopes ?? [],
    };
  }
  if (method.kind === "stdio_env") return stdioEnvEditorValue(method);
  return editorValueFromSharedMethod(method);
}

/** Project the stored methods into the generic `AuthMethod[]` the hub renders.
 *  Mirrors the server's `describeMcpAuthMethods`; `custom_` slugs mark
 *  user-created methods (removable from the hub). `endpoint` feeds the oauth
 *  method's probe-at-connect `discoveryUrl`. */
export function authMethodsFromConfig(
  methods: readonly McpAuthMethod[],
  endpoint: string,
): AuthMethod[] {
  return methods.map((method: McpAuthMethod): AuthMethod => {
    if (method.kind === "oauth2") return oauthAuthMethod(method.slug, endpoint, method.scopes);
    if (method.kind === "stdio_env") return stdioEnvAuthMethod(method);
    return authMethodFromSharedTemplate(method);
  });
}

/** Build the MCP method input for a custom method from generic placements —
 *  ONE method carrying every named placement (header + query mix in a single
 *  method; each placement renders from its own input variable, or shares one).
 *  Empty when no placement is usable. */
export function mcpAuthMethodInputsFromPlacements(
  placements: readonly Placement[],
): McpCanonicalAuthMethodInput[] {
  const wire = wirePlacementsFromEditor(placements);
  if (wire.length === 0) return [];
  return [{ kind: "apikey", placements: wire }];
}

/** The auth methods a registry-driven MCP add declares before any editing:
 *  the probe's detection plus the registry's declared facts. ONE policy for
 *  both the add page (as editor seeds) and the one-click quick add (mapped
 *  straight to wire inputs) — two copies drifted is how the picker and the
 *  add page end up declaring different methods for the same server. */
export function mcpDetectedAuthSeeds(
  probe: {
    readonly requiresOAuth: boolean;
    readonly requiresAuthentication: boolean;
  } | null,
  registry: {
    readonly placement?: Placement | null;
    readonly kind?: string | undefined;
  },
): readonly AuthMethodSeed[] {
  const registryPlacement = registry.placement ?? null;
  if (!probe) {
    // No probe result (pending, or the server was unreachable from here).
    // The registry's declared facts still stand: an authless server or a
    // known header pattern seeds the list the probe would have produced.
    if (registryPlacement) return [{ value: { kind: "apikey", placements: [registryPlacement] } }];
    if (registry.kind === "none") return [{ value: { kind: "none" } }];
    return [];
  }
  if (probe.requiresOAuth) {
    const oauth: AuthMethodSeed = {
      value: { kind: "oauth", authorizationUrl: "", tokenUrl: "", scopes: [] },
      label: "Detected",
    };
    // GitHub's MCP server takes a PAT bearer header in clients without
    // OAuth; when the registry declared that placement, offer it alongside.
    return registryPlacement
      ? [oauth, { value: { kind: "apikey", placements: [registryPlacement] } }]
      : [oauth];
  }
  if (probe.requiresAuthentication) {
    // The registry's exact placement beats the generic Bearer guess.
    return [
      {
        value: {
          kind: "apikey",
          placements: [
            registryPlacement ?? { carrier: "header", name: "Authorization", prefix: "Bearer " },
          ],
        },
        label: "Detected",
      },
    ];
  }
  return [{ value: { kind: "none" }, label: "Detected" }];
}