// ---------------------------------------------------------------------------
// PendingApprovalStore — durable "this call is waiting on a human" records.
//
// A paused execution normally lives as a suspended fiber inside one engine
// instance. That works whenever the pause and the resume are served by the same
// engine (local and desktop, which share one boot-built executor, and any
// same-instance resume elsewhere). It does NOT work on a host whose HTTP API
// builds a fresh executor per request: the fiber is discarded with the request
// that created it, so the resume arrives at an engine that has never heard of
// the execution. That is the whole of the artifact-approval bug — the failure is
// immediate, not a lease expiring.
//
// An artifact action is reconstructible where general code is not. The shell's
// grammar is exactly ONE tool call (`parseToolCallCode`), and the approval gate
// runs strictly BEFORE the tool is invoked, so a paused artifact action holds no
// partial work — only a resolved call that has not happened yet. Recording that
// call durably and running it when the approval arrives is therefore equivalent
// to resuming the fiber, without requiring the fiber to still exist.
//
// Records live in the existing owner-scoped `blob` table (no new table, no
// migration). They are single-use: consumed on resume, so one approval authorizes
// exactly one invocation and a replayed resume cannot re-run the call.
// ---------------------------------------------------------------------------

import { Effect, Option, Schema } from "effect";

import type { BlobStore } from "./blob";
import type { StorageError } from "./fuma-runtime";

/** How long a recorded approval stays valid. Human-scale: someone reading an
 *  argument preview and deciding takes minutes, not seconds. Past this the
 *  record is treated as absent and the shell asks the user to trigger the
 *  action again, which is safe because nothing has run yet. */
export const PENDING_APPROVAL_TTL_MS = 15 * 60 * 1000;

/**
 * The resolved call an approval authorizes.
 *
 * `code` is the SERVER-BUILT emission (`resolveArtifactAction` rewrote the
 * artifact's role into a real connection address) — never the string the iframe
 * sent. Re-running it after approval therefore runs exactly what the pause
 * described, and an iframe cannot widen its own grant between pause and resume.
 */
export const PendingApproval = Schema.Struct({
  executionId: Schema.String,
  /** The artifact the call came from, for the ownership re-check on resume. */
  artifactId: Schema.String,
  /** The resolved, server-built tool-call code. */
  code: Schema.String,
  /** The tool address the human was shown, so the record can be audited and so
   *  a resume cannot be pointed at a different call than the one approved. */
  address: Schema.String,
  /** Epoch ms after which this record is ignored. */
  expiresAt: Schema.Number,
});
export type PendingApproval = typeof PendingApproval.Type;

const encodePendingApproval = Schema.encodeUnknownSync(Schema.fromJsonString(PendingApproval));
const decodePendingApproval = Schema.decodeUnknownOption(Schema.fromJsonString(PendingApproval));

/**
 * Durable store for pending approvals, scoped to one owner partition.
 *
 * `get` is a strict read: an expired or unparseable record reads as absent, and
 * either way the entry is not returned. Callers treat absent as "the approval
 * window closed — ask the user to trigger the action again".
 */
export interface PendingApprovalStore {
  readonly put: (approval: PendingApproval) => Effect.Effect<void, StorageError>;
  /** Read and DELETE in one step — an approval authorizes exactly one run. */
  readonly consume: (executionId: string) => Effect.Effect<PendingApproval | null, StorageError>;
  /** Drop a record without running it (decline/cancel). */
  readonly discard: (executionId: string) => Effect.Effect<void, StorageError>;
}

/**
 * Bind a `BlobStore` to one owner partition as a pending-approval store.
 *
 * The namespace is the owner partition plus a fixed suffix, matching how plugin
 * blobs namespace themselves — so a record is only ever visible to the scope
 * that wrote it, and the ownership check on resume is the same read that fetches
 * the record rather than a separate test that could drift from it.
 */
export const makePendingApprovalStore = (
  blobs: BlobStore,
  partition: string,
  now: () => number = Date.now,
): PendingApprovalStore => {
  const namespace = `${partition}/@pending-approval`;

  return {
    put: (approval) => blobs.put(namespace, approval.executionId, encodePendingApproval(approval)),

    consume: (executionId) =>
      Effect.gen(function* () {
        const raw = yield* blobs.get(namespace, executionId);
        if (raw === null) return null;
        // Consume before validating: a record we are about to reject is a record
        // nobody should be able to retry against.
        yield* blobs.delete(namespace, executionId);
        const decoded = decodePendingApproval(raw);
        if (Option.isNone(decoded)) return null;
        const approval = decoded.value;
        if (approval.expiresAt <= now()) return null;
        return approval;
      }),

    discard: (executionId) => blobs.delete(namespace, executionId),
  };
};