// ---------------------------------------------------------------------------
// OAuth HTTP handlers — thin forwarders over `executor.oauth.*` (v2).
//
// `createClient` / `cancel` / `probe` are implemented in the SDK;
// `start` / `complete` are STUBBED there (milestone 2) and fail at runtime —
// the handlers are wired to call them so the surface is complete.
// ---------------------------------------------------------------------------

import { HttpApiBuilder } from "effect/unstable/httpapi";
import { HttpServerResponse } from "effect/unstable/http";
import { Effect, Option, Schema } from "effect";

import { runOAuthCallback, type PopupErrorMessage } from "../oauth-popup";
import {
  OAUTH_POPUP_MESSAGE_TYPE,
  OAuthCompleteError,
  OAuthProbeError,
  OAuthSessionNotFoundError,
  OAuthStartError,
  OAuthState,
  type Connection,
  type ConnectResult,
} from "@executor-js/sdk";

import { ExecutorApi } from "../api";
import { capture } from "../observability";
import { ExecutorService } from "../services";

const OAUTH_POPUP_CHANNEL = OAUTH_POPUP_MESSAGE_TYPE;

const decodeOAuthStartError = Schema.decodeUnknownOption(OAuthStartError);
const decodeOAuthCompleteError = Schema.decodeUnknownOption(OAuthCompleteError);
const decodeOAuthProbeError = Schema.decodeUnknownOption(OAuthProbeError);
const decodeOAuthSessionNotFoundError = Schema.decodeUnknownOption(OAuthSessionNotFoundError);

const connectionToResponse = (c: Connection) => ({
  owner: c.owner,
  name: c.name,
  integration: c.integration,
  template: c.template,
  provider: c.provider,
  address: c.address,
  identityLabel: c.identityLabel ?? null,
  expiresAt: c.expiresAt ?? null,
  oauthClient: c.oauthClient ?? null,
  oauthClientOwner: c.oauthClientOwner ?? null,
  oauthScope: c.oauthScope ?? null,
  missingOAuthScopes: c.missingOAuthScopes ?? [],
});

const startResultToResponse = (result: ConnectResult) =>
  result.status === "connected"
    ? { status: "connected" as const, connection: connectionToResponse(result.connection) }
    : {
        status: "redirect" as const,
        authorizationUrl: result.authorizationUrl,
        state: result.state,
      };

const toPopupErrorMessage = (error: unknown): PopupErrorMessage => {
  const completeError = decodeOAuthCompleteError(error);
  if (Option.isSome(completeError))
    return {
      short: "Could not complete authentication",
      details: completeError.value.message,
    };

  const startError = decodeOAuthStartError(error);
  if (Option.isSome(startError))
    return {
      short: "Could not start authentication",
      details: startError.value.message,
    };

  const probeError = decodeOAuthProbeError(error);
  if (Option.isSome(probeError))
    return {
      short: "Could not discover authentication endpoint",
      details: probeError.value.message,
    };

  const sessionNotFound = decodeOAuthSessionNotFoundError(error);
  if (Option.isSome(sessionNotFound))
    return {
      short: "OAuth session expired or not found",
      details: `State: ${sessionNotFound.value.state}`,
    };

  return { short: "Authentication failed" };
};

export const OAuthHandlers = HttpApiBuilder.group(ExecutorApi, "oauth", (handlers) =>
  handlers
    .handle("createClient", ({ payload }) =>
      capture(
        Effect.gen(function* () {
          const executor = yield* ExecutorService;
          const client = yield* executor.oauth.createClient({
            owner: payload.owner,
            slug: payload.slug,
            authorizationUrl: payload.authorizationUrl,
            tokenUrl: payload.tokenUrl,
            grant: payload.grant,
            clientId: payload.clientId,
            clientSecret: payload.clientSecret,
            resource: payload.resource ?? null,
            origin: { kind: "manual", integration: payload.originIntegration ?? null },
          });
          return { client };
        }),
      ),
    )
    .handle("registerDynamic", ({ payload }) =>
      capture(
        Effect.gen(function* () {
          const executor = yield* ExecutorService;
          const client = yield* executor.oauth.registerDynamicClient({
            owner: payload.owner,
            slug: payload.slug,
            issuer: payload.issuer ?? null,
            registrationEndpoint: payload.registrationEndpoint,
            authorizationUrl: payload.authorizationUrl,
            tokenUrl: payload.tokenUrl,
            resource: payload.resource ?? null,
            scopes: payload.scopes,
            tokenEndpointAuthMethodsSupported: payload.tokenEndpointAuthMethodsSupported,
            clientName: payload.clientName,
            redirectUri: payload.redirectUri,
            originIntegration: payload.originIntegration ?? null,
          });
          return { client };
        }),
      ),
    )
    .handle("listClients", () =>
      capture(
        Effect.gen(function* () {
          const executor = yield* ExecutorService;
          return yield* executor.oauth.listClients();
        }),
      ),
    )
    .handle("removeClient", ({ params: path, payload }) =>
      capture(
        Effect.gen(function* () {
          const executor = yield* ExecutorService;
          yield* executor.oauth.removeClient(payload.owner, path.slug);
          return { removed: true };
        }),
      ),
    )
    .handle("start", ({ payload }) =>
      capture(
        Effect.gen(function* () {
          const executor = yield* ExecutorService;
          const result = yield* executor.oauth.start({
            client: payload.client,
            clientOwner: payload.clientOwner,
            owner: payload.owner,
            name: payload.name,
            integration: payload.integration,
            template: payload.template,
            identityLabel: payload.identityLabel,
            newConnection: payload.newConnection,
            redirectUri: payload.redirectUri,
          });
          return startResultToResponse(result);
        }),
      ),
    )
    .handle("complete", ({ payload }) =>
      capture(
        Effect.gen(function* () {
          const executor = yield* ExecutorService;
          const connection = yield* executor.oauth.complete({
            state: payload.state,
            code: payload.code,
            callbackDomain: payload.callbackDomain ?? null,
          });
          return connectionToResponse(connection);
        }),
      ),
    )
    .handle("cancel", ({ payload }) =>
      capture(
        Effect.gen(function* () {
          const executor = yield* ExecutorService;
          yield* executor.oauth.cancel(payload.state);
          return { cancelled: true };
        }),
      ),
    )
    .handle("probe", ({ payload }) =>
      capture(
        Effect.gen(function* () {
          const executor = yield* ExecutorService;
          return yield* executor.oauth.probe({ url: payload.url });
        }),
      ),
    )
    .handle("callback", ({ query: urlParams }) =>
      // The callback always renders HTML, even on failure — the popup shows the
      // error + messages it back to the opener.
      capture(
        Effect.gen(function* () {
          const executor = yield* ExecutorService;
          const html = yield* runOAuthCallback({
            complete: ({ state, code, callbackDomain }) =>
              executor.oauth
                .complete({
                  // `runOAuthCallback`'s `state` is a raw string from the URL;
                  // the SDK speaks the branded `OAuthState` (nominal brand).
                  state: OAuthState.make(state),
                  code: code ?? "",
                  callbackDomain,
                })
                .pipe(
                  Effect.tapError((cause: unknown) =>
                    Effect.logError("OAuth callback completion failed", cause),
                  ),
                ),
            urlParams,
            toErrorMessage: toPopupErrorMessage,
            channelName: OAUTH_POPUP_CHANNEL,
          });
          return HttpServerResponse.html(html);
        }),
      ),
    ),
);