// ---------------------------------------------------------------------------
// MCP ↔ generic auth-method converters — a thin oauth adapter over the shared
// codec (`@executor-js/react/lib/shared-auth-method-codec`). The apikey/none
// paths (multi-placement, multi-variable) live in the shared codec; MCP only
// contributes its oauth flavor: endpoint-less methods whose metadata is
// discovered at connect time (`discoveryUrl` = the MCP endpoint).
// ---------------------------------------------------------------------------

import { AuthTemplateSlug } from "@executor-js/sdk/shared";
import type { AuthTemplateEditorValue } from "@executor-js/react/components/auth-template-editor";
import type { AuthMethod, Placement } from "@executor-js/react/lib/auth-placements";
import {
  authMethodFromSharedTemplate,
  editorValueFromSharedMethod,
  sharedMethodInputFromEditorValue,
  wirePlacementsFromEditor,
} from "@executor-js/react/lib/shared-auth-method-codec";

import { wireAuthInputFromShared } from "@executor-js/react/lib/shared-auth-method-codec";
import type {
  McpAuthMethod,
  McpAuthMethodInput,
  McpCanonicalAuthMethodInput,
  McpEnterpriseIdentityProvider,
  McpOAuthMethod,
  McpStdioEnvMethod,
} from "../sdk/types";

/** Stdio env method → generic hub `AuthMethod`: one `env`-carrier placement per
 *  declared var, so the account form collects one secret per env var. Mirrors
 *  the server's `describeMcpAuthMethods`. */
const stdioEnvAuthMethod = (method: McpStdioEnvMethod): AuthMethod => ({
  id: method.slug,
  label: "Environment variables",
  kind: "apikey",
  source: "spec",
  template: AuthTemplateSlug.make(method.slug),
  placements: method.vars.map((name) => ({ carrier: "env", name, prefix: "", variable: name })),
});

/** Stdio env method → editor value (apikey over env placements). */
const stdioEnvEditorValue = (method: McpStdioEnvMethod): AuthTemplateEditorValue => ({
  kind: "apikey",
  placements: method.vars.map((name) => ({ carrier: "env", name, prefix: "", variable: name })),
});

/** Serialize a canonical method into the wire input union (apikey → the
 *  request-shaped dialect; none/oauth2 pass through). */
export const mcpWireAuthInput = (
  method: McpAuthMethod | McpCanonicalAuthMethodInput,
): McpAuthMethodInput => wireAuthInputFromShared(method) as McpAuthMethodInput;

const oauthAuthMethod = (method: McpOAuthMethod, endpoint: string): AuthMethod => ({
  id: method.slug,
  label: "OAuth",
  kind: "oauth",
  source: method.slug.startsWith("custom_") ? "custom" : "spec",
  template: AuthTemplateSlug.make(method.slug),
  placements: [],
  oauth: {
    discoveryUrl: endpoint,
    supportsDynamicRegistration: true,
    // The server's own enterprise-managed declaration, carried onto the
    // presentational method. `supportsDynamicRegistration` stays true beside
    // it on purpose: declaring an identity provider is an ADDITIONAL route, not
    // a replacement, and a server that turns out not to advertise the ID-JAG
    // profile must still be connectable the ordinary way.
    ...(method.enterpriseIdentityProvider === undefined
      ? {}
      : { enterpriseIdentityProvider: method.enterpriseIdentityProvider }),
  },
});

/** Convert a generic editor value into one MCP auth-method input (no slug —
 *  the backend assigns carrier-derived slugs). An apikey value keeps every
 *  named placement (headers and query params mix freely); one with no usable
 *  placement falls back to `none`.
 *
 *  Deliberately carries NO enterprise-managed declaration: that is server
 *  policy, not a credential, so it has no editor field to come from. The
 *  surface that saves a managed server (`EditMcpIntegration`) re-attaches it
 *  explicitly from its own toggle, which is what keeps `configureMcpAuth`'s
 *  `replace` mode from erasing it on an unrelated edit. */
export function mcpAuthMethodInputFromEditorValue(
  value: AuthTemplateEditorValue,
): McpCanonicalAuthMethodInput {
  if (value.kind === "oauth") return { kind: "oauth2" };
  return (sharedMethodInputFromEditorValue(value) ?? {
    kind: "none",
  }) as McpCanonicalAuthMethodInput;
}

/** One oauth2 method input carrying the organization's declaration, or none.
 *
 *  The single place an enterprise-managed pointer is attached to a method on
 *  the way out. Written as a constructor rather than a spread at each call site
 *  so the absent case stays genuinely ABSENT: an explicit
 *  `enterpriseIdentityProvider: undefined` is a different value on the wire,
 *  and the union that decodes it rejects it. */
export const mcpOAuthMethodInput = (
  provider: McpEnterpriseIdentityProvider | undefined,
): McpCanonicalAuthMethodInput =>
  provider === undefined
    ? { kind: "oauth2" }
    : { kind: "oauth2", enterpriseIdentityProvider: provider };

/** Whether two enterprise-managed declarations name the same registration.
 *  Compared field-by-field because the pointer travels through JSON and a
 *  decoded copy is never reference-equal to the stored one. */
export const sameEnterpriseIdentityProvider = (
  a: McpEnterpriseIdentityProvider | undefined,
  b: McpEnterpriseIdentityProvider | undefined,
): boolean =>
  a === undefined || b === undefined
    ? a === b
    : String(a.client) === String(b.client) && a.clientOwner === b.clientOwner;

/** Convert one stored MCP method into the generic editor value. */
export function editorValueFromMcpAuthMethod(method: McpAuthMethod): AuthTemplateEditorValue {
  if (method.kind === "oauth2") {
    return { kind: "oauth", authorizationUrl: "", tokenUrl: "", scopes: [] };
  }
  if (method.kind === "stdio_env") return stdioEnvEditorValue(method);
  return editorValueFromSharedMethod(method);
}

/** Project the stored methods into the generic `AuthMethod[]` the hub renders.
 *  Mirrors the server's `describeMcpAuthMethods`; `custom_` slugs mark
 *  user-created methods (removable from the hub). `endpoint` feeds the oauth
 *  method's probe-at-connect `discoveryUrl`. */
export function authMethodsFromConfig(
  methods: readonly McpAuthMethod[],
  endpoint: string,
): AuthMethod[] {
  return methods.map((method: McpAuthMethod): AuthMethod => {
    if (method.kind === "oauth2") return oauthAuthMethod(method, endpoint);
    if (method.kind === "stdio_env") return stdioEnvAuthMethod(method);
    return authMethodFromSharedTemplate(method);
  });
}

/** Build the MCP method input for a custom method from generic placements —
 *  ONE method carrying every named placement (header + query mix in a single
 *  method; each placement renders from its own input variable, or shares one).
 *  Empty when no placement is usable. */
export function mcpAuthMethodInputsFromPlacements(
  placements: readonly Placement[],
): McpCanonicalAuthMethodInput[] {
  const wire = wirePlacementsFromEditor(placements);
  if (wire.length === 0) return [];
  return [{ kind: "apikey", placements: wire }];
}