import { HttpServerResponse } from "effect/unstable/http";

import { jsonRpcErrorBody } from "@executor-js/host-mcp";

export const CORS_ALLOW_ORIGIN = { "access-control-allow-origin": "*" } as const;

type UnauthorizedAuth = {
  readonly reason: "missing_bearer" | "invalid_token";
  readonly description?: string;
};

const quoteAuthParam = (value: string) =>
  `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;

export const bearerChallenge = (auth: UnauthorizedAuth, protectedResourceMetadataUrl: string) => {
  const params =
    auth.reason === "missing_bearer"
      ? [`resource_metadata=${quoteAuthParam(protectedResourceMetadataUrl)}`]
      : [
          'error="invalid_token"',
          `error_description=${quoteAuthParam(
            auth.description ?? "The access token is invalid or expired",
          )}`,
          `resource_metadata=${quoteAuthParam(protectedResourceMetadataUrl)}`,
        ];

  return `Bearer ${params.join(", ")}`;
};

/**
 * The cloud edge's JSON-RPC error `Response` (CORS-on — it crosses the browser
 * boundary). Delegates to the canonical `jsonRpcErrorBody` renderer; the body
 * is `{jsonrpc:"2.0",error:{code,message},id:null}` with `content-type` +
 * `access-control-allow-origin: *`, byte-identical to the prior local copy.
 */
export const jsonRpcWebResponse = (status: number, code: number, message: string) =>
  jsonRpcErrorBody(status, code, message);

export const unauthorized = (auth: UnauthorizedAuth, protectedResourceMetadataUrl: string) =>
  HttpServerResponse.jsonUnsafe(
    { error: "unauthorized" },
    {
      status: 401,
      headers: {
        ...CORS_ALLOW_ORIGIN,
        "www-authenticate": bearerChallenge(auth, protectedResourceMetadataUrl),
      },
    },
  );