import * as Exit from "effect/Exit";
import * as Option from "effect/Option";
import * as Schema from "effect/Schema";
import { OAuthStartError } from "@executor-js/sdk/shared";

// ---------------------------------------------------------------------------
// Blocked by administrator — reading an enterprise policy denial as STRUCTURE.
//
// When an enterprise identity provider refuses to mint an ID-JAG, the failure
// is an administrator's decision, not a credential problem. `OAuthStartError`
// says so in a typed field (`blockedByAdmin`) precisely so a console never has
// to read the sentence: matching on message text would silently start passing
// or failing whenever the wording changed, and the consequence of getting it
// wrong is offering the interactive per-server flow — which would route the
// user straight around the control the enterprise just exercised.
//
// So: this module decodes the field, and NOTHING here inspects `message`
// except to display it.
// ---------------------------------------------------------------------------

/** An enterprise identity provider declined this connect under administrator
 *  policy. Terminal by construction: there is no retry and no alternative
 *  route to offer, only the decision and a code support can trace. */
export interface OAuthAdminBlock {
  /** The failure's own message, shown verbatim. */
  readonly message: string;
  /** The identity provider's RFC 6749 §5.2 code (`unauthorized_client`,
   *  `invalid_target`, …), when it returned one. Null otherwise. */
  readonly oauthErrorCode: string | null;
}

const decodeStartError = Schema.decodeUnknownOption(OAuthStartError);

/** One level of wrapping: the popup flow wraps a start failure in its own
 *  tagged error before it reaches a renderer, and the verdict must survive
 *  that hop. Exactly one level — a `cause` chain is not a search space. */
const decodeWrapped = Schema.decodeUnknownOption(Schema.Struct({ cause: Schema.Unknown }));

const directAdminBlock = (error: unknown): OAuthAdminBlock | null =>
  Option.match(decodeStartError(error), {
    onNone: () => null,
    onSome: (start) =>
      start.blockedByAdmin === true
        ? { message: start.message, oauthErrorCode: start.oauthErrorCode ?? null }
        : null,
  });

/** The administrator verdict carried by a failed `oauth.start`, or null when
 *  the failure is anything else — including every other OAuth start failure,
 *  which leaves the interactive route open. */
export const adminBlockFrom = (error: unknown): OAuthAdminBlock | null =>
  directAdminBlock(error) ??
  Option.match(decodeWrapped(error), {
    onNone: () => null,
    onSome: (wrapper) => directAdminBlock(wrapper.cause),
  });

/** `adminBlockFrom` over an `Exit`, for the mutation call sites that hold one. */
export const adminBlockFromExit = (exit: Exit.Exit<unknown, unknown>): OAuthAdminBlock | null =>
  Option.match(Exit.findErrorOption(exit), {
    onNone: () => null,
    onSome: adminBlockFrom,
  });

/** What the user is told. Sentence case per the design system's voice rules:
 *  what happened, then what to do next — and the next step is a person, not a
 *  button, because no action in this console can change the verdict. */
export const ADMIN_BLOCK_TITLE = "Blocked by your organization";
export const ADMIN_BLOCK_NEXT_STEP =
  "Ask an administrator to allow this server at your identity provider.";

/** The support-traceable reference line, or null when the provider returned no
 *  code. Mono metadata, per the design system. */
export const adminBlockReference = (block: OAuthAdminBlock): string | null =>
  block.oauthErrorCode === null ? null : `Reference: ${block.oauthErrorCode}`;