// ---------------------------------------------------------------------------
// URL redaction at the cloud span-processor seam.
//
// The redaction rules themselves live in `@executor-js/sdk`
// (`telemetry-url-redaction`) and are shared by every exporter path — this
// module only adapts them to the OpenTelemetry SDK's span-processor
// interface, which is the one chokepoint every span in a cloud isolate must
// pass through on its way to the exporter: worker spans, Effect spans,
// Durable Object spans, and any route added later. A per-route middleware or
// a `TracerDisabledWhen` override would only cover the routes someone
// remembered to wire it into.
//
// Four channels are scrubbed: attributes (`url.full` / `url.query` stamped
// unconditionally by Effect's HttpMiddleware.tracer and HttpClient), event
// attributes (`exception.message` / `exception.stacktrace` carry the raw URL
// of a failed request), link attributes (a link to a peer span carries the
// peer's own attribute bag), and the status message. `url.path` is
// deliberately preserved — route-level visibility is what makes these traces
// worth exporting at all.
// ---------------------------------------------------------------------------

import type { Context } from "@opentelemetry/api";
import type { ReadableSpan, Span, SpanProcessor } from "@opentelemetry/sdk-trace-base";

import {
  redactSpanUrlAttributes,
  redactStringElements,
  redactUrlsInText,
  STRIPPED_QUERY_ATTRIBUTE,
} from "@executor-js/sdk";

/** The mutable surface of a span the redactor needs: the attribute bag, the
 *  recorded events (exception events carry `exception.message` and
 *  `exception.stacktrace`), the links (each carries its own attribute bag),
 *  and the status (whose `message` carries the failing error's message). Both
 *  `Span` and `ReadableSpan` expose all four as plain mutable objects. */
interface RedactableSpan {
  readonly attributes: Record<string, unknown>;
  readonly events: ReadonlyArray<{
    name: string;
    attributes?: Record<string, unknown> | undefined;
  }>;
  readonly links: ReadonlyArray<{
    attributes?: Record<string, unknown> | undefined;
  }>;
  readonly status: { message?: string | undefined };
}

/** Wraps a span processor so every span is scrubbed of credential-bearing URL
 *  components — in attributes, in event attributes, in link attributes, and
 *  in the status message — before the inner processor (and therefore the
 *  exporter) sees it.
 *
 *  The attribute rewrite happens in `onEnding`, the last hook the OTel SDK
 *  calls while the span is still mutable (`Span.end()` runs `onEnding` before
 *  setting `_ended`, so `setAttribute` still applies); `onEnd` receives a
 *  frozen `ReadableSpan`. `onEnding` is optional in the SpanProcessor
 *  interface, so `onEnd` re-checks the attribute bag and mutates it directly
 *  as a backstop for any SDK path that skips the earlier hook. Events and
 *  status have no setter on an ended span in either hook, so they are always
 *  scrubbed by direct mutation. */
export class UrlRedactingSpanProcessor implements SpanProcessor {
  constructor(private readonly inner: SpanProcessor) {}

  forceFlush(): Promise<void> {
    return this.inner.forceFlush();
  }

  onStart(span: Span, parentContext: Context): void {
    this.inner.onStart(span, parentContext);
  }

  onEnding(span: Span): void {
    this.redact(span, (key, value) => span.setAttribute(key, value));
    this.inner.onEnding?.(span);
  }

  onEnd(span: ReadableSpan): void {
    this.redact(span, (key, value) => {
      span.attributes[key] = value;
    });
    this.inner.onEnd(span);
  }

  shutdown(): Promise<void> {
    return this.inner.shutdown();
  }

  private redact(span: RedactableSpan, write: (key: string, value: string) => void): void {
    // Work on a copy so the redaction decision is made from the current values
    // and applied through the caller's writer (span API vs direct mutation).
    const draft: Record<string, unknown> = { ...span.attributes };
    const stripped = new Set(redactSpanUrlAttributes(draft));
    for (const [name, value] of Object.entries(draft)) {
      if (typeof value === "string" && value !== span.attributes[name]) write(name, value);
    }

    // Links have no setter on an ended span, so their attribute bags are
    // scrubbed by direct mutation — the same full URL-aware pass the span's
    // own attributes get, since a link carries an arbitrary attribute bag.
    for (const link of span.links) {
      if (link.attributes === undefined) continue;
      for (const key of redactSpanUrlAttributes(link.attributes)) stripped.add(key);
    }

    if (stripped.size > 0) write(STRIPPED_QUERY_ATTRIBUTE, Array.from(stripped).sort().join(","));

    for (const event of span.events) {
      const name = redactUrlsInText(event.name);
      if (name !== event.name) event.name = name;
      if (event.attributes === undefined) continue;
      for (const [key, value] of Object.entries(event.attributes)) {
        // Event attributes permit string[] exactly as span attributes do, so
        // array elements get the same free-text scrub, in place.
        if (Array.isArray(value)) {
          redactStringElements(value, redactUrlsInText);
          continue;
        }
        if (typeof value !== "string") continue;
        const redacted = redactUrlsInText(value);
        if (redacted !== value) event.attributes[key] = redacted;
      }
    }

    const message = span.status.message;
    if (typeof message === "string") {
      const redacted = redactUrlsInText(message);
      if (redacted !== message) span.status.message = redacted;
    }
  }
}