/* oxlint-disable executor/no-try-catch-or-throw, executor/no-json-parse -- boundary: out-of-band migration script over a raw postgres connection */
// ---------------------------------------------------------------------------
// One-off data migration: rewrite pre-canonical integration auth configs
// into the shared placements model. Run OUT-OF-BAND against the database
// BEFORE deploying code that only decodes the canonical shape (the same
// rule as schema migrations — Workers never migrate at request time):
//
//   bun run db:migrate-auth:prod      # op run --env-file=.env.production
//   bun run db:migrate-auth:dev       # against the local PGlite dev db
//
// Idempotent — canonical rows plan zero updates, so re-running is safe.
// Pass --dry-run to print the plan without writing.
// ---------------------------------------------------------------------------

import postgres from "postgres";
import { Option } from "effect";
import { planAuthConfigMigration, type AuthConfigMigrationRow } from "@executor-js/sdk/http-auth";
import {
  decodeGraphqlIntegrationConfigOption,
  migrateGraphqlAuthConfig,
} from "@executor-js/plugin-graphql";
import { migrateMcpAuthConfig, parseMcpIntegrationConfig } from "@executor-js/plugin-mcp";
import {
  decodeOpenApiIntegrationConfig,
  migrateOpenApiAuthConfig,
} from "@executor-js/plugin-openapi";

const transforms = {
  mcp: migrateMcpAuthConfig,
  graphql: migrateGraphqlAuthConfig,
  openapi: migrateOpenApiAuthConfig,
};

// Whether a config decodes under the NEW runtime (the canonical shapes).
// Used by the post-migration audit: every row the new code will read must
// decode, whether the migration rewrote it or left it untouched.
const decodesCanonically: Record<string, (config: unknown) => boolean> = {
  mcp: (config) => parseMcpIntegrationConfig(config) !== null,
  graphql: (config) => Option.isSome(decodeGraphqlIntegrationConfigOption(config)),
  openapi: (config) => decodeOpenApiIntegrationConfig(config) !== null,
};

const connectionString = process.env.DATABASE_URL;
if (!connectionString) {
  console.error("DATABASE_URL is not set");
  process.exit(1);
}
const dryRun = process.argv.includes("--dry-run");

// Direct (non-Hyperdrive) connection — PlanetScale requires TLS.
const sql = postgres(connectionString, { max: 1, prepare: false, ssl: "require" });

try {
  const rows = await sql<{ row_id: string; plugin_id: string; config: unknown }[]>`
    SELECT row_id, plugin_id, config FROM integration
  `;

  const inputs: AuthConfigMigrationRow[] = rows.map((row) => ({
    rowId: row.row_id,
    pluginId: row.plugin_id,
    // postgres-js parses json columns; tolerate text just in case.
    config: typeof row.config === "string" ? JSON.parse(row.config) : row.config,
  }));

  const updates = planAuthConfigMigration(inputs, transforms);
  console.log(`${rows.length} integration row(s), ${updates.length} to rewrite`);

  // Post-migration audit: simulate the final state of every row this plugin
  // set owns and check it decodes under the new runtime. A row that neither
  // rewrites nor decodes would read as "no usable config" after deploy —
  // surface those BEFORE writing anything.
  const planned = new Map(updates.map((update) => [update.rowId, update.config]));
  const undecodable = inputs.filter((row) => {
    const decodes = decodesCanonically[row.pluginId];
    if (!decodes) return false; // not a protocol-plugin row (no auth config)
    return !decodes(planned.get(row.rowId) ?? row.config);
  });
  if (undecodable.length > 0) {
    console.error(`${undecodable.length} row(s) would NOT decode after migration:`);
    for (const row of undecodable) console.error(`  ${row.pluginId} ${row.rowId}`);
    process.exit(1);
  }
  console.log("audit: every row decodes canonically after migration");

  if (dryRun) {
    for (const update of updates) console.log(`  would rewrite ${update.rowId}`);
  } else if (updates.length > 0) {
    await sql.begin(async (tx) => {
      for (const update of updates) {
        await tx`
          UPDATE integration
          SET config = ${tx.json(update.config as never)}
          WHERE row_id = ${update.rowId}
        `;
      }
    });
    console.log(`rewrote ${updates.length} row(s)`);
  }
} finally {
  await sql.end();
}