// ---------------------------------------------------------------------------
// `POST /api/webhooks/workos` — the WorkOS webhook endpoint, which only
// POKES the reconciler. It verifies the delivery's signature and, when it
// is genuine, starts one `syncWorkOsEvents` pass past the response. It
// never applies the webhook's own payload: webhooks are unordered and
// at-least-once, while the Events API the reconciler reads is ordered and
// replayable from the persisted cursor. The webhook's only job is to turn
// "within a minute" (the cron) into "within seconds" for dashboard-side
// changes such as a revoked membership.
//
// Unauthenticated by design (WorkOS holds no session); the signature IS the
// authentication. Nothing about the payload is reflected in the response.
// ---------------------------------------------------------------------------

import { Effect, Option, Schema } from "effect";
import { Headers, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";

import { WorkOSClient } from "./workos";

export const WORKOS_WEBHOOK_PATH = "/api/webhooks/workos";

const SIGNATURE_HEADER = "workos-signature";

// The SDK verifies the signature over `JSON.stringify(payload)`, so the body
// must be a JSON object; an array or scalar can never be a WorkOS delivery.
const WebhookPayload = Schema.Record(Schema.String, Schema.Unknown);
const decodeWebhookPayload = Schema.decodeUnknownOption(WebhookPayload);

export interface WorkOsWebhookDeps {
  /**
   * The endpoint's signing secret (`WORKOS_WEBHOOK_SECRET`). `undefined`
   * when the deployment has not configured one: every delivery is then
   * refused with 503, never accepted unverified.
   */
  readonly secret: string | undefined;
  /**
   * Hand the reconciler pass to the platform so it outlives the response
   * (`waitUntil` from `cloudflare:workers`). The promise never rejects: the
   * runner reports its own failures.
   */
  readonly detach: (work: Promise<void>) => void;
  /** One reconciler pass over fresh services (`runWorkOsEventsSync`). */
  readonly sync: () => Promise<void>;
}

/**
 * The webhook route. 200 for a verified delivery (a sync pass has been
 * detached), 400 for a missing or invalid signature or a body that is not a
 * JSON object, 503 when no signing secret is configured.
 */
export const makeWorkOsWebhookRoute = (deps: WorkOsWebhookDeps) =>
  HttpRouter.add(
    "POST",
    WORKOS_WEBHOOK_PATH,
    Effect.gen(function* () {
      if (deps.secret === undefined) {
        yield* Effect.logError(
          "workos_webhook: WORKOS_WEBHOOK_SECRET is not set; refusing the delivery",
        );
        return HttpServerResponse.empty({ status: 503 });
      }
      const secret = deps.secret;
      const request = yield* HttpServerRequest.HttpServerRequest;
      const sigHeader = Headers.get(request.headers, SIGNATURE_HEADER);
      if (Option.isNone(sigHeader)) {
        return HttpServerResponse.empty({ status: 400 });
      }
      const body = yield* request.json.pipe(Effect.option);
      const payload = Option.flatMap(body, decodeWebhookPayload);
      if (Option.isNone(payload)) {
        return HttpServerResponse.empty({ status: 400 });
      }

      const workos = yield* WorkOSClient;
      const verified = yield* workos
        .constructWebhookEvent({
          payload: payload.value,
          sigHeader: sigHeader.value,
          secret,
        })
        .pipe(Effect.option);
      if (Option.isNone(verified)) {
        yield* Effect.logWarning("workos_webhook: signature rejected");
        return HttpServerResponse.empty({ status: 400 });
      }

      yield* Effect.logInfo("workos_webhook: verified delivery; poking the reconciler", {
        event: verified.value.event,
        eventId: verified.value.id,
      });
      deps.detach(deps.sync());
      return HttpServerResponse.empty({ status: 200 });
    }),
  );