import { FIGMA_SUPPORTED_OAUTH_SCOPES } from "@executor-js/plugin-openapi/presets";
import { googleCatalogOAuthScopesForPreset } from "@executor-js/plugin-openapi/providers/google";
import {
  MICROSOFT_AUTHORIZATION_URL,
  MICROSOFT_TOKEN_URL,
} from "@executor-js/plugin-openapi/providers/microsoft";
import { slackMcpUserScopes } from "@executor-js/react/lib/slack-mcp-oauth";
import { IntegrationSlug, type FirstPartyOAuthClientConfig } from "@executor-js/sdk";

/** Cloud secret bindings that enable host-operated OAuth clients. A provider
 *  is absent unless both values in its pair are present. */
export interface FirstPartyOAuthClientEnv {
  readonly FIRST_PARTY_AIRTABLE_CLIENT_ID?: string;
  readonly FIRST_PARTY_AIRTABLE_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_ATLASSIAN_CLIENT_ID?: string;
  readonly FIRST_PARTY_ATLASSIAN_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_BOX_CLIENT_ID?: string;
  readonly FIRST_PARTY_BOX_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_CLICKUP_CLIENT_ID?: string;
  readonly FIRST_PARTY_CLICKUP_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_FIGMA_CLIENT_ID?: string;
  readonly FIRST_PARTY_FIGMA_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_GITHUB_CLIENT_ID?: string;
  readonly FIRST_PARTY_GITHUB_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_GITHUB_AUTHORIZE_URL?: string;
  readonly FIRST_PARTY_GITHUB_TOKEN_URL?: string;
  readonly FIRST_PARTY_GITLAB_CLIENT_ID?: string;
  readonly FIRST_PARTY_GITLAB_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_GOOGLE_CLIENT_ID?: string;
  readonly FIRST_PARTY_GOOGLE_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_HUBSPOT_CLIENT_ID?: string;
  readonly FIRST_PARTY_HUBSPOT_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_LINEAR_CLIENT_ID?: string;
  readonly FIRST_PARTY_LINEAR_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_MICROSOFT_CLIENT_ID?: string;
  readonly FIRST_PARTY_MICROSOFT_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_NOTION_CLIENT_ID?: string;
  readonly FIRST_PARTY_NOTION_CLIENT_SECRET?: string;
  readonly FIRST_PARTY_SLACK_CLIENT_ID?: string;
  readonly FIRST_PARTY_SLACK_CLIENT_SECRET?: string;
}

const AIRTABLE_SCOPES = [
  "data.recordComments:read",
  "data.recordComments:write",
  "data.records:read",
  "data.records:write",
  "data.records:manage",
  "schema.bases:read",
  "schema.bases:write",
  "user.email:read",
  "workspacesAndBases:read",
  "workspacesAndBases:write",
  "workspacesAndBases.shares:manage",
  "webhook:manage",
] as const;

const ATLASSIAN_SCOPES = [
  "read:me",
  "read:account",
  "read:jira-work",
  "manage:jira-project",
  "manage:jira-configuration",
  "read:jira-user",
  "write:jira-work",
  "manage:jira-webhook",
  "read:servicedesk-request",
  "manage:servicedesk-customer",
  "write:servicedesk-request",
  "write:confluence-content",
  "read:confluence-space.summary",
  "write:confluence-space",
  "write:confluence-file",
  "read:confluence-props",
  "write:confluence-props",
  "manage:confluence-configuration",
  "read:confluence-content.all",
  "read:confluence-content.summary",
  "search:confluence",
  "read:confluence-content.permission",
  "read:confluence-user",
  "read:confluence-groups",
  "write:confluence-groups",
  "offline_access",
] as const;

const BOX_SCOPES = [
  "root_readonly",
  "root_readwrite",
  "sign_requests.readwrite",
  "ai.readwrite",
  "manage_webhook",
  "manage_triggers",
] as const;

const GITLAB_SCOPES = [
  "api",
  "read_api",
  "read_user",
  "create_runner",
  "manage_runner",
  "k8s_proxy",
  "mcp",
  "mcp_orbit",
  "read_repository",
  "write_repository",
  "read_registry",
  "write_registry",
  "read_virtual_registry",
  "write_virtual_registry",
  "read_observability",
  "write_observability",
  "ai_features",
  "openid",
  "profile",
  "email",
] as const;

const HUBSPOT_REQUIRED_SCOPES = [
  "oauth",
  "account-info.security.read",
  "cms.domains.read",
  "cms.domains.write",
  "crm.export",
  "crm.import",
  "crm.lists.read",
  "crm.lists.write",
  "crm.objects.companies.read",
  "crm.objects.companies.write",
  "crm.objects.contacts.read",
  "crm.objects.contacts.write",
  "crm.objects.deals.read",
  "crm.objects.deals.write",
  "crm.objects.marketing_events.read",
  "crm.objects.marketing_events.write",
  "crm.objects.owners.read",
  "crm.objects.quotes.read",
  "crm.objects.quotes.write",
  "crm.schemas.companies.read",
  "crm.schemas.companies.write",
  "crm.schemas.contacts.read",
  "crm.schemas.contacts.write",
  "sales-email-read",
  "settings.users.read",
  "settings.users.write",
  "tickets",
  "timeline",
] as const;

const HUBSPOT_OPTIONAL_SCOPES = [
  "content",
  "crm.objects.custom.read",
  "crm.schemas.custom.read",
] as const;

const MICROSOFT_SCOPES = [
  "User.Read",
  "Calendars.ReadWrite",
  "Channel.ReadBasic.All",
  "ChannelMessage.Read.All",
  "ChannelMessage.Send",
  "Chat.ReadWrite",
  "Files.ReadWrite.All",
  "Mail.ReadWrite",
  "Mail.Send",
  "MailboxSettings.ReadWrite",
  "OnlineMeetings.ReadWrite",
  "Sites.ReadWrite.All",
  "Team.ReadBasic.All",
  "offline_access",
] as const;

// Consumer Google launch boundary. Keep this list aligned with the scopes
// submitted for the Executor-owned production app: ordinary Workspace services
// plus Photos, Meet, and Search Console. Admin, Classroom, YouTube, Apps Script,
// BigQuery, and Cloud Resource Manager have materially different audiences or
// provider requirements and remain BYO OAuth. The same scope source builds each
// catalog auth template, preventing picker/start drift.
const GOOGLE_FIRST_PARTY_PRESET_IDS = [
  "google-calendar",
  "google-meet",
  "google-gmail",
  "google-sheets",
  "google-drive",
  "google-docs",
  "google-slides",
  "google-forms",
  "google-tasks",
  "google-people",
  "google-photos-library",
  "google-photos-picker",
  "google-search-console",
] as const;

const GOOGLE_ALLOWED_SCOPES: readonly string[] = [
  ...new Set([
    ...GOOGLE_FIRST_PARTY_PRESET_IDS.flatMap(googleCatalogOAuthScopesForPreset),
    // Connections created before the full-Gmail review retain this declared
    // scope on reconnect. New Gmail presets request `mail.google.com`.
    "https://www.googleapis.com/auth/gmail.modify",
  ]),
];

const client = (
  clientId: string | undefined,
  clientSecret: string | undefined,
  config: Omit<FirstPartyOAuthClientConfig, "clientId" | "clientSecret">,
): readonly FirstPartyOAuthClientConfig[] =>
  clientId && clientSecret ? [{ ...config, clientId, clientSecret }] : [];

/** Build the enabled first-party registry from secret bindings. Provider
 *  protocol details and scope ceilings live here so the cloud composition root
 *  cannot drift from the registered production clients.
 *
 *  Each provider-side registration must list
 *  `${VITE_PUBLIC_SITE_URL}/api/oauth/callback` as its callback; the org slug
 *  travels inside OAuth `state`, so the single static callback serves every
 *  org.
 *
 *  The endpoint URLs default to the real provider; the `_AUTHORIZE_URL` /
 *  `_TOKEN_URL` overrides exist so tests and dev instances can point the app at
 *  an emulated provider (`@executor-js/emulate`) and run the complete flow.
 *  Production leaves them unset. */
export const firstPartyOAuthClientsFor = (
  env: FirstPartyOAuthClientEnv,
): readonly FirstPartyOAuthClientConfig[] => [
  ...client(env.FIRST_PARTY_AIRTABLE_CLIENT_ID, env.FIRST_PARTY_AIRTABLE_CLIENT_SECRET, {
    name: "airtable",
    authorizationUrl: "https://airtable.com/oauth2/v1/authorize",
    tokenUrl: "https://airtable.com/oauth2/v1/token",
    tokenEndpointAuthMethod: "basic",
    authorizationScopes: AIRTABLE_SCOPES,
    allowedScopes: AIRTABLE_SCOPES,
  }),
  ...client(env.FIRST_PARTY_ATLASSIAN_CLIENT_ID, env.FIRST_PARTY_ATLASSIAN_CLIENT_SECRET, {
    name: "atlassian",
    authorizationUrl: "https://auth.atlassian.com/authorize",
    tokenUrl: "https://auth.atlassian.com/oauth/token",
    tokenRequestFormat: "json",
    authorizationScopes: ATLASSIAN_SCOPES,
    allowedScopes: ATLASSIAN_SCOPES,
    authorizationExtraParams: { audience: "api.atlassian.com", prompt: "consent" },
  }),
  ...client(env.FIRST_PARTY_BOX_CLIENT_ID, env.FIRST_PARTY_BOX_CLIENT_SECRET, {
    name: "box",
    authorizationUrl: "https://account.box.com/api/oauth2/authorize",
    tokenUrl: "https://api.box.com/oauth2/token",
    authorizationScopes: BOX_SCOPES,
    allowedScopes: BOX_SCOPES,
  }),
  ...client(env.FIRST_PARTY_CLICKUP_CLIENT_ID, env.FIRST_PARTY_CLICKUP_CLIENT_SECRET, {
    name: "clickup",
    authorizationUrl: "https://app.clickup.com/api",
    tokenUrl: "https://api.clickup.com/api/v2/oauth/token",
    tokenRequestFormat: "json",
    authorizationScopes: [],
  }),
  ...client(env.FIRST_PARTY_FIGMA_CLIENT_ID, env.FIRST_PARTY_FIGMA_CLIENT_SECRET, {
    name: "figma",
    authorizationUrl: "https://www.figma.com/oauth",
    tokenUrl: "https://api.figma.com/v1/oauth/token",
    tokenEndpointAuthMethod: "basic",
    integrations: [IntegrationSlug.make("figma_api")],
    authorizationScopes: FIGMA_SUPPORTED_OAUTH_SCOPES,
    allowedScopes: FIGMA_SUPPORTED_OAUTH_SCOPES,
  }),
  ...client(env.FIRST_PARTY_GITHUB_CLIENT_ID, env.FIRST_PARTY_GITHUB_CLIENT_SECRET, {
    name: "github",
    authorizationUrl:
      env.FIRST_PARTY_GITHUB_AUTHORIZE_URL ?? "https://github.com/login/oauth/authorize",
    tokenUrl: env.FIRST_PARTY_GITHUB_TOKEN_URL ?? "https://github.com/login/oauth/access_token",
    integrations: [IntegrationSlug.make("github_rest")],
    // GitHub App user access tokens do not use classic OAuth scopes; their
    // capabilities come from the app's registered permissions.
    authorizationScopes: [],
  }),
  ...client(env.FIRST_PARTY_GITLAB_CLIENT_ID, env.FIRST_PARTY_GITLAB_CLIENT_SECRET, {
    name: "gitlab",
    authorizationUrl: "https://gitlab.com/oauth/authorize",
    tokenUrl: "https://gitlab.com/oauth/token",
    authorizationScopes: GITLAB_SCOPES,
    allowedScopes: GITLAB_SCOPES,
  }),
  ...client(env.FIRST_PARTY_GOOGLE_CLIENT_ID, env.FIRST_PARTY_GOOGLE_CLIENT_SECRET, {
    name: "google",
    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
    tokenUrl: "https://oauth2.googleapis.com/token",
    allowedScopes: GOOGLE_ALLOWED_SCOPES,
    // Withdrawn from the connect picker: no new connection is offered the
    // Executor-owned Google app. The entry stays declared on purpose — every
    // connection already minted against it keeps refreshing and reconnecting
    // through it. Deleting this block, or unsetting the env vars, would strand
    // those connections instead.
    unlisted: true,
  }),
  ...client(env.FIRST_PARTY_HUBSPOT_CLIENT_ID, env.FIRST_PARTY_HUBSPOT_CLIENT_SECRET, {
    name: "hubspot",
    authorizationUrl: "https://app.hubspot.com/oauth/authorize",
    tokenUrl: "https://api.hubapi.com/oauth/v3/token",
    authorizationScopes: HUBSPOT_REQUIRED_SCOPES,
    allowedScopes: [...HUBSPOT_REQUIRED_SCOPES, ...HUBSPOT_OPTIONAL_SCOPES],
    authorizationExtraParams: { optional_scope: HUBSPOT_OPTIONAL_SCOPES.join(" ") },
  }),
  ...client(env.FIRST_PARTY_LINEAR_CLIENT_ID, env.FIRST_PARTY_LINEAR_CLIENT_SECRET, {
    name: "linear",
    authorizationUrl: "https://linear.app/oauth/authorize",
    tokenUrl: "https://api.linear.app/oauth/token",
    authorizationScopes: ["read", "write"],
    authorizationScopeSeparator: ",",
    allowedScopes: ["read", "write"],
  }),
  ...client(env.FIRST_PARTY_MICROSOFT_CLIENT_ID, env.FIRST_PARTY_MICROSOFT_CLIENT_SECRET, {
    name: "microsoft",
    authorizationUrl: MICROSOFT_AUTHORIZATION_URL,
    tokenUrl: MICROSOFT_TOKEN_URL,
    allowedScopes: MICROSOFT_SCOPES,
    additionalAuthorizationScopes: ["offline_access"],
  }),
  ...client(env.FIRST_PARTY_NOTION_CLIENT_ID, env.FIRST_PARTY_NOTION_CLIENT_SECRET, {
    name: "notion",
    authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
    tokenUrl: "https://api.notion.com/v1/oauth/token",
    authorizationExtraParams: { owner: "user" },
    tokenEndpointAuthMethod: "basic",
    tokenRequestFormat: "json",
    authorizationScopes: [],
  }),
  ...client(env.FIRST_PARTY_SLACK_CLIENT_ID, env.FIRST_PARTY_SLACK_CLIENT_SECRET, {
    name: "slack",
    authorizationUrl: "https://slack.com/oauth/v2_user/authorize",
    tokenUrl: "https://slack.com/api/oauth.v2.user.access",
    resource: "https://mcp.slack.com",
    integrations: [IntegrationSlug.make("slack")],
    allowedScopes: slackMcpUserScopes,
  }),
];