import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
import type { Connection, OAuthClientSummary } from "@executor-js/sdk/shared";

import type { OAuthStartPayload } from "./oauth-sign-in";

// ---------------------------------------------------------------------------
// OAuth scope helpers (pure) — shared by Reconnect (re-consent) and the connect
// modal's informational subset-scope warning. Kept React/atom-free so they are
// unit-testable in isolation.
// ---------------------------------------------------------------------------

/** How a connection should be re-connected:
 *  - `"oauth"` — it came from an OAuth flow (`oauthClient != null`); a token
 *    refresh CANNOT widen scopes and FAILS when there is no refresh token, so
 *    Reconnect must RE-RUN the OAuth flow (prompt=consent + the widened scope
 *    union), re-minting the SAME connection (owner/integration/name).
 *  - `"refresh"` — a static credential / non-OAuth connection; Reconnect is the
 *    existing token-refresh mutation. */
export type ReconnectMode = "oauth" | "refresh";

/** An OAuth connection carries the `oauthClient` slug that minted it; a static
 *  credential does not. That single field decides the Reconnect path. */
export function reconnectMode(connection: Connection): ReconnectMode {
  return connection.oauthClient != null ? "oauth" : "refresh";
}

/** Build the `oauth.start` payload that re-runs the OAuth flow for an existing
 *  OAuth connection. The branded `name`/`template`/`oauthClient` carried by the
 *  connection are exactly the branded types `oauth.start` expects, so the same
 *  connection (owner/integration/name) is re-minted with a fresh refresh token
 *  and the widened scope union. Returns null for a non-OAuth connection. */
export function oauthReconnectPayload(connection: Connection): OAuthStartPayload | null {
  if (connection.oauthClient == null) return null;
  return {
    client: connection.oauthClient,
    // The app's stored owner (a Personal connection may be backed by a shared
    // Workspace app); fall back to the connection owner for same-owner connects.
    clientOwner: connection.oauthClientOwner ?? connection.owner,
    owner: connection.owner,
    name: connection.name,
    integration: connection.integration,
    template: connection.template,
    identityLabel: connection.identityLabel ?? undefined,
  };
}

/** The stored OAuth app backing a connection, resolved from the loaded client
 *  summaries. First-party apps are config-declared and deployment-scoped, so
 *  they match on slug alone; stored rows are owner-scoped, matched against the
 *  app's stored owner (a Personal connection may be backed by a shared
 *  Workspace app). Undefined when the connection is not OAuth or its client
 *  row is gone (e.g. removed by hand). */
export function reconnectStoredClient(
  clients: readonly OAuthClientSummary[],
  connection: Connection,
): OAuthClientSummary | undefined {
  if (connection.oauthClient == null) return undefined;
  const slug = String(connection.oauthClient);
  const owner = connection.oauthClientOwner ?? connection.owner;
  return clients.find(
    (client) =>
      String(client.slug) === slug &&
      (client.origin.kind === "first_party" || client.owner === owner),
  );
}

/** Where an OAuth connection's Reconnect goes. */
export type ReconnectRoute =
  /** The client summaries have not loaded, so the stored binding is unknown.
   *  NO route may be chosen yet: guessing "direct" dead-ends an origin-drifted
   *  DCR client (#1542), and guessing "automatic" would rebind a manual app.
   *  The caller keeps the action unavailable until the summaries resolve. */
  | { readonly kind: "unknown" }
  /** Re-run the automatic probe/CIMD/DCR flow. `stored` is the binding's
   *  summary — undefined when its row is gone — so the handoff can carry its
   *  resource. */
  | { readonly kind: "automatic"; readonly stored: OAuthClientSummary | undefined }
  /** Start the OAuth flow directly against the stored client. */
  | { readonly kind: "direct" };

/** Decide the Reconnect route from the STORED client binding.
 *
 *  The binding's ORIGIN is what routes, not the method's capability flags:
 *  - An auto-minted DCR binding re-registers (its whole lifecycle is
 *    automatic, and the automatic flow can probe the token URL even when the
 *    method declares no discovery/DCR support). Reusing it directly dead-ends
 *    once the callback origin drifts (#1542).
 *  - A manual (static/BYO) or first-party binding keeps the direct
 *    stored-client path — re-registering would silently rebind the connection
 *    to an automatic client.
 *  - A binding whose row is GONE has nothing to start directly against, so it
 *    re-registers when the method supports the automatic flow at all.
 *  Pass `clients: undefined` while the summaries are loading: the decision is
 *  then `"unknown"`, never a guess. */
export function reconnectRoute(
  clients: readonly OAuthClientSummary[] | undefined,
  connection: Connection,
  methodSupportsAutomatic: boolean,
): ReconnectRoute {
  if (clients === undefined) return { kind: "unknown" };
  const stored = reconnectStoredClient(clients, connection);
  if (stored !== undefined) {
    return stored.origin.kind === "dynamic_client_registration"
      ? { kind: "automatic", stored }
      : { kind: "direct" };
  }
  return methodSupportsAutomatic ? { kind: "automatic", stored: undefined } : { kind: "direct" };
}

/** Reconnect's view of the client-summaries query:
 *  - `"ready"` — a current successful load; routing reads these summaries.
 *  - `"loading"` — the query is in flight (first load, or a retry after a
 *    failure); the action waits, exactly as before.
 *  - `"failed"` — the query failed. Stale data from an earlier success NEVER
 *    routes: a binding changed since that snapshot can misroute (repeat the
 *    origin-drift dead end, or treat a client absent from the snapshot as
 *    vanished and rebind it). The menu item surfaces the failure instead of
 *    sitting silently disabled, and opening the menu retries the query (see
 *    `retryReconnectClientsOnMenuOpen`). */
export type ReconnectClientsView =
  | { readonly kind: "ready"; readonly clients: readonly OAuthClientSummary[] }
  | { readonly kind: "loading" }
  | { readonly kind: "failed" };

/** Fold the summaries query into Reconnect's availability. Only a current
 *  Success is ready — a Failure reads as failed even when it retains a
 *  `previousSuccess`. A failure that is `waiting` is a retry in flight, so it
 *  reads as loading, not failed. */
export function reconnectClientsView(
  result: AsyncResult.AsyncResult<readonly OAuthClientSummary[], unknown>,
): ReconnectClientsView {
  if (AsyncResult.isSuccess(result)) return { kind: "ready", clients: result.value };
  if (AsyncResult.isFailure(result) && !result.waiting) return { kind: "failed" };
  return { kind: "loading" };
}

/** Recovery for the failed view: OPENING the row menu retries the query, so a
 *  transient listClients error never leaves Reconnect dead for the mounted
 *  lifetime. Only the failed view refetches — ready and loading views must
 *  not restart a request that already has data or is already running. */
export function retryReconnectClientsOnMenuOpen(
  open: boolean,
  view: ReconnectClientsView,
  retry: () => void,
): void {
  if (open && view.kind === "failed") retry();
}

// ---------------------------------------------------------------------------
// Subset-scope warning (Part 2). At connect, when the chosen OAuth app's
// DECLARED scopes are a STRICT subset of the integration's declared scopes, the
// app grants fewer scopes than the integration needs. Connect already requests
// the UNION, so this is purely INFORMATIONAL: the gap is in the provider-app /
// GCP API enablement the user controls, surfaced so a rejected sign-in is
// explicable. Never blocks connect.
// ---------------------------------------------------------------------------

const OAUTH_SCOPE_ALIASES: Readonly<Record<string, string>> = {
  // Google accepts OIDC shorthand scopes but records the expanded People API
  // scopes in token responses. Treat them as the same grant for reconsent UI.
  "https://www.googleapis.com/auth/userinfo.email": "email",
  "https://www.googleapis.com/auth/userinfo.profile": "profile",
};

const canonicalScope = (scope: string): string => OAUTH_SCOPE_ALIASES[scope] ?? scope;

/** Normalize a scope list: trim, canonicalize known provider aliases, drop
 *  empties, de-dupe (order-preserving). A scope set is compared as a SET —
 *  duplicates and blanks never widen it. */
const normalizeScopes = (scopes: readonly string[]): readonly string[] => {
  const seen = new Set<string>();
  const out: string[] = [];
  for (const raw of scopes) {
    const scope = canonicalScope(raw.trim());
    if (scope.length === 0 || seen.has(scope)) continue;
    seen.add(scope);
    out.push(scope);
  }
  return out;
};

/** Scopes in `needed` that `granted` does NOT cover — generic set difference
 *  (needed − granted), order-preserving. Empty when `granted` is a superset/equal
 *  or `needed` is empty. */
export function missingScopes(
  needed: readonly string[] | undefined,
  granted: readonly string[] | undefined,
): readonly string[] {
  const want = normalizeScopes(needed ?? []);
  if (want.length === 0) return [];
  const have = new Set(normalizeScopes(granted ?? []));
  return want.filter((scope: string) => !have.has(scope));
}

/** The scopes a connection was actually GRANTED, parsed from its space-delimited
 *  `oauthScope` record. Empty for static creds / when the AS omitted scope. */
export function connectionGrantedScopes(connection: Connection): readonly string[] {
  return connection.oauthScope ? connection.oauthScope.split(/\s+/).filter(Boolean) : [];
}

/** Whether an OAuth connection must RECONNECT to grant newly-needed access: the
 *  integration now DECLARES scopes the connection was not granted (e.g. after the
 *  integration added a service). Drives the "reconnect to grant access" prompt.
 *  Compares the integration's declared scopes (needed) against the connection's
 *  recorded grant — `oauth_scope` made load-bearing. False for non-OAuth
 *  connections and when the grant already covers everything declared. */
export function connectionNeedsReconsent(
  connection: Connection,
  declaredScopes: readonly string[] | undefined,
): boolean {
  if (connection.oauthClient == null) return false;
  return missingScopes(declaredScopes, connectionGrantedScopes(connection)).length > 0;
}

/** The scopes that count as REQUIRED for a connection to be considered fully
 *  granted, given the integration's oauth auth method.
 *
 *  Spec-derived oauth scopes are the full per-operation catalog union (an OpenAPI
 *  integration like PostHog declares hundreds): requested broadly to unlock as many
 *  tools as possible, but none individually required. A provider that narrows the
 *  grant to the user's actual access is healthy, so the spec catalog must NOT
 *  drive a reconnect prompt. Custom (user-configured) scopes are intentional and
 *  stay required. Feed the result to `connectionNeedsReconsent`. */
export function reconsentRequiredScopes(
  method:
    | {
        readonly source: "spec" | "custom";
        readonly oauth?: { readonly scopes?: readonly string[] };
      }
    | undefined,
): readonly string[] | undefined {
  if (method == null || method.source === "spec") return undefined;
  return method.oauth?.scopes;
}