import { Layer } from "effect";

import { IdentityProvider } from "@executor-js/api/server";

import { loadConfig } from "../config";
import type { SelfHostDbHandle } from "../db/self-host-db";
import { BetterAuth, buildBetterAuth, type BetterAuthHandle } from "./better-auth";
import { betterAuthIdentityLayer } from "./identity";
import { consentRedirectClientId, withClientName, withForcedMcpConsent } from "./force-mcp-consent";
import { rewriteInvalidOrigin } from "./invalid-origin-help";

export { BetterAuth, buildBetterAuth, type BetterAuthHandle } from "./better-auth";
export { betterAuthIdentityLayer } from "./identity";

// ---------------------------------------------------------------------------
// Resolve the self-host auth providers.
//
// Build the Better Auth instance over the shared libSQL file, expose its
// `IdentityProvider` (cookie/bearer/api-key) and its web handler (mounted at
// /api/auth/*). Returns the live `BetterAuthHandle` so the composition root can
// build the account API and the Better Auth MCP OAuth seam.
//
// This is the one and only production auth path. Tests that need a fake identity
// (single-admin / header-driven) compose `ExecutorApp.make` directly through
// `makeSelfHostTestApp` (src/testing/test-app.ts) rather than passing through
// here, so this resolution is unconditional.
// ---------------------------------------------------------------------------

export interface ResolvedAuthProviders {
  /** The resolved Better Auth `IdentityProvider` seam (cookie/bearer/api-key). */
  readonly identityLayer: Layer.Layer<IdentityProvider>;
  /** Better Auth's web handler (`/api/auth/*`). */
  readonly authHandler: (request: Request) => Promise<Response>;
  /** The live Better Auth handle (account API + Better Auth MCP OAuth seam). */
  readonly betterAuth: BetterAuthHandle;
}

export const resolveAuthProviders = async (
  dbHandle: SelfHostDbHandle,
): Promise<ResolvedAuthProviders> => {
  const betterAuth = await buildBetterAuth(dbHandle.client);
  const betterAuthLayer = Layer.succeed(BetterAuth)(betterAuth);

  // The consent redirect from Better Auth's authorize only carries the opaque
  // client_id; look the registered client_name up (its adapter sees the
  // just-written DCR row) so the approval screen reads "Connect Codex?" not a
  // random id. Self-declared at open DCR — a label, not a trust signal.
  const lookupClientName = async (clientId: string): Promise<string | null> => {
    const ctx = await betterAuth.auth.$context;
    const app = await ctx.adapter.findOne<{ name?: string | null }>({
      model: "oauthApplication",
      where: [{ field: "clientId", value: clientId }],
    });
    return app?.name ?? null;
  };

  // Force the MCP approval screen: inject `prompt=consent` on every MCP
  // authorize so a connecting client is gated on /mcp-consent rather than
  // silently granted a token (see ./force-mcp-consent), and enrich the
  // resulting consent redirect with the registered client name.
  const config = loadConfig();
  const authHandler = async (request: Request): Promise<Response> => {
    const response = await betterAuth.handler(withForcedMcpConsent(request));
    // Turn Better Auth's bare 403 "Invalid origin" into a setup instruction —
    // on a fresh deploy it almost always means the public URL needs configuring.
    const friendlier = await rewriteInvalidOrigin(request, response, config.webBaseUrl);
    if (friendlier) return friendlier;
    if (response.status !== 302) return response;
    const clientId = consentRedirectClientId(response.headers.get("location"));
    if (!clientId) return response;
    const name = await lookupClientName(clientId);
    if (!name) return response;
    // Preserve the rest of the response — notably the signed consent cookie.
    const headers = new Headers(response.headers);
    headers.set("location", withClientName(response.headers.get("location")!, name));
    return new Response(null, { status: 302, headers });
  };

  return {
    identityLayer: betterAuthIdentityLayer.pipe(Layer.provide(betterAuthLayer)),
    authHandler,
    betterAuth,
  };
};