// Self-host serves MCP at the bare `/mcp` path (and bare OAuth discovery docs).
// The console "Connect an agent" card, however, prints
// `<origin>/<organizationId>/mcp` — a convention the multi-tenant cloud worker
// routes (it strips the org segment at the edge, carrying the org in a header).
// Self-host is single-tenant: the session already pins the one org, so the org
// segment in the URL carries no routing meaning. Rather than special-case the
// card per host, both self-host front-ends (the prod Bun server and the vite
// dev middleware) strip a single leading segment so the card's URL reaches the
// real route — mirroring cloud's edge rewrite, but accepting ANY segment (a
// Better Auth org id is not the `org_…` shape cloud keys on). Unlike cloud,
// which carries the org in a header for routing, self-host's rewrite carries
// the ORIGINAL org-scoped pathname in `MCP_ORIGINAL_PATH_HEADER` below, purely
// so the protected-resource metadata (./auth.ts) can echo the org-scoped form
// back to a client that dialed org-scoped (RFC 9728 same-origin check).
//
// Pure + Effect-free on purpose: the vite config imports it too.

const PRM_PREFIX = "/.well-known/oauth-protected-resource";

/**
 * Given a request pathname, return the bare MCP pathname it should route to
 * when it carries a single leading org segment, or `null` when no rewrite
 * applies (already bare, not an MCP path, or an OAuth endpoint like
 * `/api/auth/mcp/authorize`).
 *
 *   /<seg>/mcp                                                -> /mcp
 *   /<seg>/mcp/toolkits/<toolkit>                             -> /mcp/toolkits/<toolkit>
 *   /.well-known/oauth-protected-resource/<seg>/mcp           -> /.well-known/oauth-protected-resource
 *   /.well-known/oauth-protected-resource/<seg>/mcp/toolkits/<toolkit>
 *                                                            -> /.well-known/oauth-protected-resource/mcp/toolkits/<toolkit>
 */
export const stripMcpOrgSegment = (pathname: string): string | null => {
  if (pathname.startsWith(`${PRM_PREFIX}/`)) {
    const rest = pathname
      .slice(PRM_PREFIX.length + 1)
      .split("/")
      .filter((segment) => segment.length > 0);
    if (rest.length === 2 && rest[1] === "mcp") return PRM_PREFIX;
    if (rest.length === 4 && rest[1] === "mcp" && rest[2] === "toolkits") {
      return `${PRM_PREFIX}/mcp/toolkits/${rest[3]}`;
    }
    return null;
  }
  const segments = pathname.split("/").filter((segment) => segment.length > 0);
  if (segments.length === 2 && segments[1] === "mcp") return "/mcp";
  if (segments.length === 4 && segments[1] === "mcp" && segments[2] === "toolkits") {
    return `/mcp/toolkits/${segments[3]}`;
  }
  return null;
};

/**
 * Header the strip middleware (serve.ts's Effect middleware and the vite dev
 * middleware) attaches to a rewritten request, carrying the ORIGINAL org-scoped
 * pathname the client actually dialed. `stripMcpOrgSegment` discards that
 * pathname when it rewrites `request.url` to the bare route, but the
 * protected-resource metadata handlers (./auth.ts) need it back to advertise a
 * `resource` that path-prefix-matches what the client dialed (RFC 9728 /
 * `checkResourceAllowed`) — otherwise an org-scoped client never completes
 * discovery. Only ever set to a value that `stripMcpOrgSegment` itself
 * recognizes (see `isRecognizedMcpOrgPath`); any client-supplied value of this
 * header is stripped at the same middleware boundary so it can't be spoofed.
 */
export const MCP_ORIGINAL_PATH_HEADER = "x-executor-mcp-original-path";

/**
 * Whether `pathname` is one `stripMcpOrgSegment` would recognize and rewrite,
 * i.e. a safe value for `MCP_ORIGINAL_PATH_HEADER`. Used to validate the
 * header on the way IN (auth.ts must not trust an arbitrary string), not just
 * on the way out.
 */
export const isRecognizedMcpOrgPath = (pathname: string): boolean =>
  stripMcpOrgSegment(pathname) !== null;

/**
 * Whether `pathname` targets one of self-host's MCP serving endpoints, in
 * either bare or org-scoped form. Used by the production HTTP boundary to
 * reject HEAD explicitly before the SPA's GET/HEAD fallback can claim it.
 */
export const isMcpServingPath = (pathname: string): boolean => {
  const routed = stripMcpOrgSegment(pathname) ?? pathname;
  if (routed === "/mcp" || routed === "/mcp/") return true;
  const segments = routed.split("/").filter((segment) => segment.length > 0);
  return segments.length === 3 && segments[0] === "mcp" && segments[1] === "toolkits";
};

/**
 * Given a recognized original pathname (a `MCP_ORIGINAL_PATH_HEADER` value —
 * either the org-scoped MCP path itself, or its PRM-prefixed discovery-doc
 * form), return the org-scoped MCP resource path alone:
 *
 *   /<org>/mcp                                                -> /<org>/mcp
 *   /<org>/mcp/toolkits/<toolkit>                             -> /<org>/mcp/toolkits/<toolkit>
 *   /.well-known/oauth-protected-resource/<org>/mcp           -> /<org>/mcp
 *   /.well-known/oauth-protected-resource/<org>/mcp/toolkits/<toolkit>
 *                                                            -> /<org>/mcp/toolkits/<toolkit>
 *
 * `null` when `pathname` isn't one `stripMcpOrgSegment` recognizes.
 */
export const mcpResourcePathFromOriginalPath = (pathname: string): string | null => {
  if (!isRecognizedMcpOrgPath(pathname)) return null;
  return pathname.startsWith(`${PRM_PREFIX}/`) ? pathname.slice(PRM_PREFIX.length) : pathname;
};