// ---------------------------------------------------------------------------
// One-off config migration — rewrite pre-canonical GraphQL integration
// `config` blobs into the canonical placements model. Runs once per database
// (boot for local/selfhost, out-of-band script for cloud); runtime code
// decodes ONLY the canonical shape (`decodeGraphqlIntegrationConfig*`).
//
// Stored legacy families (all observed in real databases):
//   1. the v1→v2 migration's singular `auth: {kind:"none"|"oauth2"}` (the
//      graphql config had no `authenticationTemplate` unless v1 carried
//      credential placements), or a config with no auth fields at all
//   2. `authenticationTemplate` entries of the retired native shape:
//      `{kind:"apiKey", slug, in:"header"|"query", name, prefix?}`
//   3. openapi-shaped entries the v1→v2 migration wrote:
//      `{slug, type:"apiKey", headers/queryParams: <template values>}` and
//      `{slug, type:"oauth", …}`
//
// Invariants: slugs are preserved verbatim (`connection.template` binds by
// them) and so are variable names (they key the connections' stored
// `item_ids`).
// ---------------------------------------------------------------------------

import { Option, Schema } from "effect";
import {
  apiKeyMethodFromLegacyTemplate,
  decodeLegacyApiKeyTemplate,
} from "@executor-js/sdk/http-auth";

import { decodeGraphqlIntegrationConfigOption, type GraphqlAuthMethod } from "./types";

const LegacySingleAuth = Schema.Union([
  Schema.Struct({ kind: Schema.Literal("none") }),
  Schema.Struct({ kind: Schema.Literal("oauth2") }),
]);
const decodeLegacySingleAuth = Schema.decodeUnknownOption(LegacySingleAuth);

const LegacyNativeApiKey = Schema.Struct({
  slug: Schema.String,
  kind: Schema.Literal("apiKey"),
  in: Schema.Literals(["header", "query"]),
  name: Schema.String,
  prefix: Schema.optional(Schema.String),
});
const LegacyOAuthTemplate = Schema.Struct({
  slug: Schema.String,
  type: Schema.Literal("oauth"),
});
const decodeLegacyNativeApiKey = Schema.decodeUnknownOption(LegacyNativeApiKey);
const decodeLegacyOAuthTemplate = Schema.decodeUnknownOption(LegacyOAuthTemplate);

const CanonicalMethod = Schema.decodeUnknownOption(
  Schema.Union([
    Schema.Struct({ slug: Schema.String, kind: Schema.Literals(["none", "oauth2"]) }),
    Schema.Struct({
      slug: Schema.String,
      kind: Schema.Literal("apikey"),
      label: Schema.optional(Schema.String),
      placements: Schema.Array(Schema.Unknown),
    }),
  ]),
);

/** Rewrite one stored method entry to canonical, or null when undecodable. */
const migrateMethodEntry = (entry: unknown): GraphqlAuthMethod | null => {
  const canonical = Option.getOrNull(CanonicalMethod(entry));
  if (canonical !== null) return entry as GraphqlAuthMethod;

  const native = Option.getOrNull(decodeLegacyNativeApiKey(entry));
  if (native !== null) {
    return {
      slug: native.slug,
      kind: "apikey",
      placements: [
        {
          carrier: native.in,
          name: native.name,
          ...(native.prefix !== undefined ? { prefix: native.prefix } : {}),
        },
      ],
    };
  }

  const legacyApiKey = Option.getOrNull(decodeLegacyApiKeyTemplate(entry));
  if (legacyApiKey !== null) return apiKeyMethodFromLegacyTemplate(legacyApiKey);

  const legacyOAuth = Option.getOrNull(decodeLegacyOAuthTemplate(entry));
  if (legacyOAuth !== null) return { slug: legacyOAuth.slug, kind: "oauth2" };

  return null;
};

const parseConfig = (config: unknown): unknown | null =>
  Option.isSome(decodeGraphqlIntegrationConfigOption(config)) ? config : null;

/** Rewrite a stored GraphQL integration config blob into the canonical shape.
 *  Returns the rewritten config, or `null` when no rewrite is needed (already
 *  canonical, or not this plugin's shape at all). Throws nothing: an
 *  unmigratable blob also returns `null` and stays untouched. Idempotent —
 *  feeding the output back returns `null`. */
export const migrateGraphqlAuthConfig = (config: unknown): unknown | null => {
  if (typeof config !== "object" || config === null) return null;
  // A GraphQL config is keyed by its endpoint; `transport` marks MCP blobs.
  if (!("endpoint" in config) || typeof config.endpoint !== "string") return null;
  if ("transport" in config) return null;

  const legacyAuth =
    "auth" in config
      ? Option.getOrNull(decodeLegacySingleAuth((config as { auth: unknown }).auth))
      : null;

  if (!("authenticationTemplate" in config)) {
    // Family 1: singular `auth`, or an open endpoint with no auth field.
    if ("auth" in config && legacyAuth === null) return null;
    const kind = legacyAuth?.kind ?? "none";
    const { auth: _auth, ...rest } = config as { auth?: unknown };
    const migrated = { ...rest, authenticationTemplate: [{ slug: kind, kind }] };
    return parseConfig(migrated);
  }

  const entries = (config as { authenticationTemplate: unknown }).authenticationTemplate;
  if (!Array.isArray(entries)) return null;

  const migrated = entries.map(migrateMethodEntry);
  if (migrated.some((entry) => entry === null)) return null;
  const methods = migrated as GraphqlAuthMethod[];

  // The v1→v2 migration wrote BOTH `auth: {kind:"oauth2"}` and an apiKey
  // `authenticationTemplate` when a source had credential placements and
  // oauth; fold the singular auth into the declared set (slug = kind, the
  // slug the connection migration bound oauth connections to).
  if (
    legacyAuth?.kind === "oauth2" &&
    !methods.some((method: GraphqlAuthMethod) => method.kind === "oauth2")
  ) {
    methods.push({ slug: "oauth2", kind: "oauth2" });
  }

  const entriesChanged =
    methods.length !== entries.length ||
    methods.some((entry: GraphqlAuthMethod, index: number) => entry !== entries[index]);
  if (!entriesChanged && legacyAuth === null) return null;

  const { auth: _auth, ...withoutAuth } = config as { auth?: unknown };
  const next = {
    ...(legacyAuth !== null ? withoutAuth : config),
    authenticationTemplate: methods,
  };
  return parseConfig(next);
};