import { useCallback } from "react";
import { useAtomSet } from "@effect/atom-react";
import * as Effect from "effect/Effect";
import * as Exit from "effect/Exit";
import * as Option from "effect/Option";
import * as Schema from "effect/Schema";
import {
  WorkIdentityStatusSchema,
  type OAuthClientSlug,
  type Owner,
  type WorkIdentityStatus,
} from "@executor-js/sdk/shared";

import { startWorkIdentityLink, workIdentityLinkCompleted } from "../api/atoms";
import { workIdentityWriteKeys } from "../api/reactivity-keys";
import { oauthCallbackUrl, useOAuthPopupFlow, type OAuthPopupReservation } from "./oauth-sign-in";

// ---------------------------------------------------------------------------
// Linking a work identity from the browser.
//
// This is the leg the console could not previously walk. An enterprise-managed
// connect presents an identity assertion, and no browser can obtain one — the
// identity provider's client secret is server-side. So the browser does the one
// thing only it can: it carries the member through a real OIDC sign-in at the
// organization's identity provider. Executor builds the authorization URL,
// redeems the code with the IdP app's own credentials, and takes custody of the
// durable subject.
//
// It reuses `useOAuthPopupFlow` rather than growing a second popup stack. That
// hook already owns the three things that are easy to get wrong and invisible
// when they are: the window reserved on the click (user activation expires
// while `start` is in flight), settle-exactly-once across postMessage /
// BroadcastChannel / localStorage, and teardown on unmount — which is what makes
// closing the modal mid-link genuinely abandon it.
//
// The link's redirect lands on the SHARED `/api/oauth/callback`, which decides
// from the stored session which flow it is completing and posts
// `{ workIdentity }` back. That key is the discriminator, and it is PARSED here:
// a connection payload is spread flat and shares field names with nothing that
// could be mistaken for a status.
// ---------------------------------------------------------------------------

/** The popup payload a completed link posts back to the opener. */
export interface WorkIdentityPopupPayload {
  readonly workIdentity: WorkIdentityStatus;
}

const decodeLinkPayload = Schema.decodeUnknownOption(
  Schema.Struct({ workIdentity: WorkIdentityStatusSchema }),
);

/** The linked identity carried by a popup completion, or null when the message
 *  was some other flow's. Parsed, never cast: this value crosses a postMessage
 *  boundary and decides what the console says the member is signed in as. */
export const workIdentityFromPopupPayload = (payload: unknown): WorkIdentityStatus | null =>
  Option.match(decodeLinkPayload(payload), {
    onNone: () => null,
    onSome: (decoded) => decoded.workIdentity,
  });

/** Which held identity a link is about — the IdP registration, and the owner
 *  the connections backed by it are made under. */
export interface WorkIdentityRefInput {
  readonly owner: Owner;
  readonly idpClient: OAuthClientSlug;
  readonly idpClientOwner: Owner;
}

export interface StartWorkIdentityLinkInput {
  readonly ref: WorkIdentityRefInput;
  /** Window reserved on the click that began this flow. Required in practice:
   *  a link is always reached after at least one round trip (the connect that
   *  reported `workIdentityLinkRequired`, or a health verdict), by which time
   *  the browser has forgotten the click. */
  readonly reservation?: OAuthPopupReservation;
  /** The account that was linked. Runs after the reactivity bump, so anything
   *  it triggers already reads the linked state. */
  readonly onLinked: (identity: WorkIdentityStatus) => void | Promise<void>;
  readonly onError?: (message: string) => void;
}

/** The "who am I signed in as" line, or null when nothing is held.
 *
 *  `needs_relink` deliberately does NOT read as linked: an identity the provider
 *  has rejected still names an account, and showing it plainly would tell the
 *  member everything is fine while every connection behind it is stalled. */
export const workIdentityLinkedLabel = (identity: WorkIdentityStatus): string | null => {
  if (identity.status === "unlinked") return null;
  const who = identity.label ?? identity.subject ?? "your work identity";
  return identity.status === "linked" ? `linked as ${who}` : `${who} · sign in again`;
};

/**
 * Drive a work-identity link through the shared OAuth popup machinery.
 *
 * Every piece of in-flight state lives in the returned handle, which lives in
 * the component that called this hook — so a modal that unmounts takes the
 * dangling session, the popup window, and the busy flag with it.
 */
export function useWorkIdentityLink(options: { readonly popupName: string }) {
  const doStartLink = useAtomSet(startWorkIdentityLink, {
    mode: "promiseExit",
  });
  const doLinkCompleted = useAtomSet(workIdentityLinkCompleted, {
    mode: "promiseExit",
  });
  const popup = useOAuthPopupFlow<WorkIdentityPopupPayload>({
    popupName: options.popupName,
    // A work identity link crosses the identity provider's own consent and MFA
    // screens, where COOP can make a live popup read as closed. Cancelling is
    // the explicit path; a false "you closed it" mid-MFA is not.
    detectPopupClosed: false,
    startErrorMessage: "Couldn't start the work identity sign-in",
    popupBlockedMessage: "Your browser blocked the work identity sign-in window",
  });

  const link = useCallback(
    async (input: StartWorkIdentityLinkInput): Promise<void> => {
      await popup.openAuthorization({
        owner: input.ref.owner,
        ...(input.reservation === undefined ? {} : { reservation: input.reservation }),
        reportMetadata: {
          idp_client: String(input.ref.idpClient),
          owner: input.ref.owner,
        },
        run: () =>
          doStartLink({
            payload: {
              owner: input.ref.owner,
              idpClient: input.ref.idpClient,
              idpClientOwner: input.ref.idpClientOwner,
              // The same callback every interactive connect uses, so an
              // enterprise registers ONE redirect URI and not two.
              redirectUri: oauthCallbackUrl(),
            },
            // Starting a link changes nothing until the callback completes it.
            reactivityKeys: [],
          }).then((exit) => {
            if (Exit.isSuccess(exit)) {
              return {
                state: String(exit.value.state),
                authorizationUrl: exit.value.authorizationUrl,
              };
            }
            // Reject with the server's own typed failure, cause and all, so
            // `WorkIdentityLinkError.message` reaches the user verbatim rather
            // than as a generic "sign-in failed".
            return Effect.runPromise(Effect.failCause(exit.cause));
          }),
        onSuccess: async (payload: WorkIdentityPopupPayload) => {
          const identity = workIdentityFromPopupPayload(payload);
          if (identity === null) {
            // The callback answered, but not with a work identity. Refusing to
            // guess is the point: retrying the connect on a link that did not
            // happen would fail again with the same unhelpful message.
            input.onError?.("The sign-in did not return a work identity. Try linking again.");
            return;
          }
          await doLinkCompleted({ reactivityKeys: workIdentityWriteKeys });
          await input.onLinked(identity);
        },
        ...(input.onError === undefined
          ? {}
          : { onError: (message: string) => input.onError?.(message) }),
      });
    },
    [doLinkCompleted, doStartLink, popup],
  );

  return {
    /** True while the sign-in window is open or the start is in flight. */
    busy: popup.busy,
    error: popup.error,
    link,
    /** Claim the sign-in window on the click, before any await. */
    reserve: popup.reserve,
    /** Close a claimed window this flow turned out not to need. */
    releaseReservation: popup.releaseReservation,
    cancel: popup.cancel,
    setError: popup.setError,
  };
}