import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";

import { Effect } from "effect";

import {
  definePlugin,
  ownerForItemId,
  ProviderItemId,
  ProviderKey,
  StorageError,
  type CredentialProvider,
  type OwnerBinding,
  type PluginCtx,
} from "@executor-js/sdk";

// ---------------------------------------------------------------------------
// Encrypted DB-backed credential provider for self-host.
//
// Credential values are stored AES-256-GCM-encrypted in the executor's
// plugin-storage table — never in plaintext, unlike the file-secrets provider.
// The master key comes from the host (EXECUTOR_SECRET_KEY or a persisted key
// file); a random per-value IV + auth tag are stored alongside the ciphertext.
// Only node:crypto is used.
//
// This is the multi-tenant-safe default writable provider for the self-hosted
// server, replacing the OS-keychain/plaintext-file providers that assume a
// single desktop user.
//
// v2: the provider sees only an opaque `ProviderItemId` — there is NO scope
// arg. The connection row that references the id owns the (tenant, owner,
// subject) partition; the encrypted value is keyed solely by the opaque id.
// Plugin storage writes carry an `owner`: the one embedded in the item id
// (`oauth:org:…` → org-shared) when present, else the executor's binding.
// ---------------------------------------------------------------------------

type PluginStorage = PluginCtx<unknown>["pluginStorage"];

const COLLECTION = "secrets";
const KEY_SALT = "executor-encrypted-secrets/v1";
const PAYLOAD_VERSION = "v1";

/** Derive a 32-byte AES key from an arbitrary-length master key string. */
const deriveKey = (master: string): Buffer => scryptSync(master, KEY_SALT, 32);

const encryptSecret = (key: Buffer, plaintext: string): Effect.Effect<string, StorageError> =>
  Effect.try({
    try: () => {
      const iv = randomBytes(12);
      const cipher = createCipheriv("aes-256-gcm", key, iv);
      const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
      const tag = cipher.getAuthTag();
      return [
        PAYLOAD_VERSION,
        iv.toString("base64"),
        tag.toString("base64"),
        ciphertext.toString("base64"),
      ].join(".");
    },
    catch: (cause) => new StorageError({ message: "Failed to encrypt secret", cause }),
  });

const decryptSecret = (key: Buffer, payload: string): Effect.Effect<string, StorageError> =>
  Effect.try({
    // A malformed payload, a wrong key, or tampered bytes all surface here:
    // GCM verification fails in `decipher.final()`, and bad base64/arity throws
    // before that — both land in the StorageError channel.
    try: () => {
      const parts = payload.split(".");
      const iv = Buffer.from(parts[1] ?? "", "base64");
      const tag = Buffer.from(parts[2] ?? "", "base64");
      const ciphertext = Buffer.from(parts[3] ?? "", "base64");
      const decipher = createDecipheriv("aes-256-gcm", key, iv);
      decipher.setAuthTag(tag);
      return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
    },
    catch: (cause) => new StorageError({ message: "Failed to decrypt secret", cause }),
  });

const ENCRYPTED_PROVIDER_KEY = ProviderKey.make("encrypted");

const makeEncryptedProvider = (
  key: Buffer,
  storage: PluginStorage,
  binding: OwnerBinding,
): CredentialProvider => ({
  key: ENCRYPTED_PROVIDER_KEY,
  writable: true,

  get: (id: ProviderItemId) =>
    storage
      .get<string>({ collection: COLLECTION, key: id })
      .pipe(
        Effect.flatMap((entry) => (entry ? decryptSecret(key, entry.data) : Effect.succeed(null))),
      ),

  has: (id: ProviderItemId) =>
    storage.get({ collection: COLLECTION, key: id }).pipe(Effect.map((entry) => entry !== null)),

  set: (id: ProviderItemId, value: string) =>
    encryptSecret(key, value).pipe(
      Effect.flatMap((payload) =>
        storage.put({
          collection: COLLECTION,
          key: id,
          owner: ownerForItemId(id, binding),
          data: payload,
        }),
      ),
      Effect.asVoid,
    ),

  delete: (id: ProviderItemId) =>
    storage.remove({ collection: COLLECTION, key: id, owner: ownerForItemId(id, binding) }),

  list: () =>
    storage
      .list<string>({ collection: COLLECTION })
      .pipe(
        Effect.map((entries) =>
          entries.map((entry) => ({ id: ProviderItemId.make(entry.key), name: entry.key })),
        ),
      ),
});

export interface EncryptedSecretsPluginConfig {
  /**
   * Master key (any non-empty string) — derived to 32 bytes via scrypt. The
   * host is responsible for supplying a strong, persistent key
   * (EXECUTOR_SECRET_KEY or a generated key file); a secret store with no key
   * is unsafe, so this is required.
   */
  readonly key: string;
}

export const encryptedSecretsPlugin = definePlugin((options?: EncryptedSecretsPluginConfig) => {
  const master = options?.key;
  if (!master) {
    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: a secret store with no master key is unsafe; fail loud at construction
    throw new Error("encryptedSecretsPlugin requires a non-empty `key`");
  }
  const derivedKey = deriveKey(master);
  return {
    id: "encryptedSecrets" as const,
    storage: () => ({}),
    credentialProviders: (ctx: PluginCtx<unknown>): readonly CredentialProvider[] => [
      makeEncryptedProvider(derivedKey, ctx.pluginStorage, ctx.owner),
    ],
  };
});

// Exported for host-side tests / reuse.
export { deriveKey, encryptSecret, decryptSecret };

// Boot-time repair for rows the pre-fix provider filed under the acting
// caller's partition (issue #1453).
export {
  encryptedSecretsRepartitionDataMigration,
  runSqliteEncryptedSecretsRepartition,
} from "./repartition-migration";