import { Schema } from "effect";
import type { AuthMethodDescriptor, AuthPlacementDescriptor } from "../integration";

// ---------------------------------------------------------------------------
// The shared HTTP auth-method vocabulary for protocol plugins (openapi,
// graphql, mcp). An integration declares a LIST of auth methods; a connection
// binds one by its `slug` (`connection.template`) and supplies one credential
// value per `variable` the method's placements reference (D11: core resolves
// `values: Record<variable, string|null>`, the plugin renders them onto the
// request).
//
// Core itself never imports this module — core stays carrier-agnostic (a
// connection could be a CLI login or a DB URL). It ships as the
// `@executor-js/sdk/http-auth` subpath purely as a home: composition, not
// location, is what keeps headers/query params an HTTP-plugin concern.
//
// OAuth methods are NOT modeled here — their config genuinely differs per
// plugin (openapi stores endpoints+scopes, graphql an optional header
// override, mcp discovers everything at connect time). Each plugin's method
// union is `NoneAuthMethod | ApiKeyAuthMethod | <its own oauth variant>`.
// OAuth-refreshed connections resolve only the `token` input, so oauth
// values must never be mixed into a placements method.
// ---------------------------------------------------------------------------

/** The canonical input variable of single-credential methods. A placement
 *  with no `variable` renders from it, and core resolves a connection created
 *  with a bare `{ value }` into `{ token: value }`. */
export const TOKEN_VARIABLE = "token";

export const AuthCarrier = Schema.Literals(["header", "query"]);
export type AuthCarrier = typeof AuthCarrier.Type;

/** One spot on the outbound request a method writes to.
 *
 *  Credential placement: renders `prefix + values[variable ?? "token"]`.
 *  Two placements naming the same variable share one credential input; a
 *  placement naming its own variable gets its own input (e.g. Datadog's two
 *  keys).
 *
 *  Literal placement (`literal` set): renders the literal verbatim and
 *  references no credential — static values a method carries alongside its
 *  credential (e.g. a fixed version header). */
export const AuthPlacement = Schema.Struct({
  carrier: AuthCarrier,
  /** Header name (e.g. `Authorization`) or query-param name (e.g. `token`). */
  name: Schema.String,
  /** Literal prepended to the credential value, e.g. `Bearer `. */
  prefix: Schema.optional(Schema.String),
  /** The credential input this placement renders from. Absent ⇒ `token`. */
  variable: Schema.optional(Schema.String),
  /** Render this exact value instead of a credential. */
  literal: Schema.optional(Schema.String),
});
export type AuthPlacement = typeof AuthPlacement.Type;

export const ApiKeyAuthMethod = Schema.Struct({
  slug: Schema.String,
  kind: Schema.Literal("apikey"),
  /** Display label; derived from the first placement when absent. */
  label: Schema.optional(Schema.String),
  placements: Schema.Array(AuthPlacement),
});
export type ApiKeyAuthMethod = typeof ApiKeyAuthMethod.Type;

/** An open integration — connections carry no credential. */
export const NoneAuthMethod = Schema.Struct({
  slug: Schema.String,
  kind: Schema.Literal("none"),
});
export type NoneAuthMethod = typeof NoneAuthMethod.Type;

// ---------------------------------------------------------------------------
// Rendering
// ---------------------------------------------------------------------------

export interface RenderedAuthPlacements {
  readonly headers: Record<string, string>;
  readonly queryParams: Record<string, string>;
}

const renderPlacementValue = (
  placement: AuthPlacement,
  values: Record<string, string | null>,
): string | null => {
  if (placement.literal !== undefined) return placement.literal;
  const value = values[placement.variable ?? TOKEN_VARIABLE];
  if (value == null) return null;
  return placement.prefix ? `${placement.prefix}${value}` : value;
};

/** Render a method's placements with a connection's resolved values. Total:
 *  a credential placement whose variable resolved to nothing is skipped —
 *  callers own their missing-value policy (fail the invocation, dial
 *  unauthenticated, …) and should gate on `requiredPlacementVariables`. */
export const renderAuthPlacements = (
  placements: readonly AuthPlacement[],
  values: Record<string, string | null>,
): RenderedAuthPlacements => {
  const headers: Record<string, string> = {};
  const queryParams: Record<string, string> = {};
  for (const placement of placements) {
    const rendered = renderPlacementValue(placement, values);
    if (rendered === null) continue;
    if (placement.carrier === "header") headers[placement.name] = rendered;
    else queryParams[placement.name] = rendered;
  }
  return { headers, queryParams };
};

/** The distinct credential inputs a method's placements reference — what a
 *  connection must supply. Literal placements reference none. */
export const requiredPlacementVariables = (
  placements: readonly AuthPlacement[],
): readonly string[] => {
  const names = new Set<string>();
  for (const placement of placements) {
    if (placement.literal !== undefined) continue;
    names.add(placement.variable ?? TOKEN_VARIABLE);
  }
  return [...names];
};

/** The conventional rendering of an OAuth access token, as a placement — for
 *  plugins whose oauth method applies the token as a plain (possibly
 *  customized) header. The token is always the `token` input. */
export const oauthBearerPlacement = (header?: string, prefix?: string): AuthPlacement => ({
  carrier: "header",
  name: header ?? "Authorization",
  prefix: prefix ?? "Bearer ",
});

// ---------------------------------------------------------------------------
// Slug normalization — methods are input without slugs from UIs/agents; every
// stored method needs a stable one (`connection.template` binds by it).
// ---------------------------------------------------------------------------

/** Assign each method a stable slug: a caller-provided one wins, otherwise
 *  `defaultSlugFor(method)`, suffixed `_2`, `_3`, … on collision. */
export const normalizeAuthMethodSlugs = <T extends { readonly slug?: string | undefined }>(
  methods: readonly T[],
  defaultSlugFor: (method: T) => string,
): readonly (T & { readonly slug: string })[] => {
  const taken = new Set<string>();
  return methods.map((method: T): T & { readonly slug: string } => {
    const requested = method.slug?.trim() || defaultSlugFor(method);
    let slug = requested;
    for (let n = 2; taken.has(slug); n += 1) slug = `${requested}_${n}`;
    taken.add(slug);
    return { ...method, slug };
  });
};

// ---------------------------------------------------------------------------
// Catalog projection — the plugin-agnostic `AuthMethodDescriptor` every
// plugin's `describeAuthMethods` emits (the descriptor TYPE stays in
// @executor-js/sdk: core carries it as opaque catalog metadata).
// ---------------------------------------------------------------------------

export const apiKeyMethodLabel = (method: ApiKeyAuthMethod): string => {
  if (method.label !== undefined && method.label.trim().length > 0) return method.label;
  const first = method.placements.find(
    (placement: AuthPlacement) => placement.name.trim().length > 0,
  );
  return first ? `API key (${first.name})` : `API key (${method.slug})`;
};

const describePlacement = (placement: AuthPlacement): AuthPlacementDescriptor => ({
  carrier: placement.carrier,
  name: placement.name,
  prefix: placement.prefix ?? "",
  ...(placement.variable !== undefined ? { variable: placement.variable } : {}),
  ...(placement.literal !== undefined ? { literal: placement.literal } : {}),
});

export const describeApiKeyAuthMethod = (method: ApiKeyAuthMethod): AuthMethodDescriptor => ({
  id: method.slug,
  label: apiKeyMethodLabel(method),
  kind: "apikey",
  template: method.slug,
  placements: method.placements.map(describePlacement),
});

export const describeNoneAuthMethod = (slug: string): AuthMethodDescriptor => ({
  id: slug,
  label: "No authentication",
  kind: "none",
  template: slug,
});