// ---------------------------------------------------------------------------
// One-off config migration — rewrite pre-canonical MCP integration `config`
// blobs into the canonical placements model. Runs once per database (boot for
// local/selfhost, out-of-band script for cloud); runtime code decodes ONLY
// the canonical shape (`parseMcpIntegrationConfig`).
//
// Stored legacy families (all observed in real databases):
//   1. singular `auth: {kind:"none"|"header"|"oauth2"}` (pre-array configs),
//      or a remote config with no auth field at all (open server)
//   2. `authenticationTemplate` entries of the retired single-placement
//      shapes: `{slug, kind:"header", headerName, prefix?}` /
//      `{slug, kind:"query", paramName, prefix?}`
//   3. openapi-shaped entries the v1→v2 migration wrote:
//      `{slug, type:"apiKey", headers/queryParams: <template values>}` and
//      `{slug, type:"oauth", …}`
//
// Invariants: slugs are preserved verbatim (`connection.template` binds by
// them) and so are variable names (they key the connections' stored
// `item_ids`).
// ---------------------------------------------------------------------------

import { Option, Schema } from "effect";
import {
  apiKeyMethodFromLegacyTemplate,
  decodeLegacyApiKeyTemplate,
} from "@executor-js/sdk/http-auth";

import { parseMcpIntegrationConfig, type McpAuthMethod } from "./types";

const LegacySingleAuth = Schema.Union([
  Schema.Struct({ kind: Schema.Literal("none") }),
  Schema.Struct({
    kind: Schema.Literal("header"),
    headerName: Schema.String,
    prefix: Schema.optional(Schema.String),
  }),
  Schema.Struct({
    kind: Schema.Literal("query"),
    paramName: Schema.String,
    prefix: Schema.optional(Schema.String),
  }),
  Schema.Struct({ kind: Schema.Literal("oauth2") }),
]);
const decodeLegacySingleAuth = Schema.decodeUnknownOption(LegacySingleAuth);

const LegacyHeaderMethod = Schema.Struct({
  slug: Schema.String,
  kind: Schema.Literal("header"),
  headerName: Schema.String,
  prefix: Schema.optional(Schema.String),
});
const LegacyQueryMethod = Schema.Struct({
  slug: Schema.String,
  kind: Schema.Literal("query"),
  paramName: Schema.String,
  prefix: Schema.optional(Schema.String),
});
const LegacyOAuthTemplate = Schema.Struct({
  slug: Schema.String,
  type: Schema.Literal("oauth"),
});
const decodeLegacyHeaderMethod = Schema.decodeUnknownOption(LegacyHeaderMethod);
const decodeLegacyQueryMethod = Schema.decodeUnknownOption(LegacyQueryMethod);
const decodeLegacyOAuthTemplate = Schema.decodeUnknownOption(LegacyOAuthTemplate);

const CanonicalMethod = Schema.decodeUnknownOption(
  Schema.Union([
    Schema.Struct({ slug: Schema.String, kind: Schema.Literals(["none", "oauth2"]) }),
    Schema.Struct({
      slug: Schema.String,
      kind: Schema.Literal("apikey"),
      label: Schema.optional(Schema.String),
      placements: Schema.Array(Schema.Unknown),
    }),
  ]),
);

/** Rewrite one stored method entry to canonical, or null when undecodable. */
const migrateMethodEntry = (entry: unknown): McpAuthMethod | null => {
  const canonical = Option.getOrNull(CanonicalMethod(entry));
  if (canonical !== null) return entry as McpAuthMethod;

  const header = Option.getOrNull(decodeLegacyHeaderMethod(entry));
  if (header !== null) {
    return {
      slug: header.slug,
      kind: "apikey",
      placements: [
        {
          carrier: "header",
          name: header.headerName,
          ...(header.prefix !== undefined ? { prefix: header.prefix } : {}),
        },
      ],
    };
  }

  const query = Option.getOrNull(decodeLegacyQueryMethod(entry));
  if (query !== null) {
    return {
      slug: query.slug,
      kind: "apikey",
      placements: [
        {
          carrier: "query",
          name: query.paramName,
          ...(query.prefix !== undefined ? { prefix: query.prefix } : {}),
        },
      ],
    };
  }

  const legacyApiKey = Option.getOrNull(decodeLegacyApiKeyTemplate(entry));
  if (legacyApiKey !== null) return apiKeyMethodFromLegacyTemplate(legacyApiKey);

  const legacyOAuth = Option.getOrNull(decodeLegacyOAuthTemplate(entry));
  if (legacyOAuth !== null) return { slug: legacyOAuth.slug, kind: "oauth2" };

  return null;
};

const slugFromSingleAuth = (auth: typeof LegacySingleAuth.Type): string => auth.kind;

const methodFromSingleAuth = (auth: typeof LegacySingleAuth.Type): McpAuthMethod => {
  if (auth.kind === "header") {
    return {
      slug: slugFromSingleAuth(auth),
      kind: "apikey",
      placements: [
        {
          carrier: "header",
          name: auth.headerName,
          ...(auth.prefix !== undefined ? { prefix: auth.prefix } : {}),
        },
      ],
    };
  }
  if (auth.kind === "query") {
    return {
      slug: slugFromSingleAuth(auth),
      kind: "apikey",
      placements: [
        {
          carrier: "query",
          name: auth.paramName,
          ...(auth.prefix !== undefined ? { prefix: auth.prefix } : {}),
        },
      ],
    };
  }
  return { slug: auth.kind, kind: auth.kind };
};

/** Rewrite a stored MCP integration config blob into the canonical shape.
 *  Returns the rewritten config, or `null` when no rewrite is needed (already
 *  canonical, a stdio config, or not this plugin's shape at all). Throws
 *  nothing: an unmigratable blob also returns `null` and stays untouched.
 *  Idempotent — feeding the output back returns `null`. */
export const migrateMcpAuthConfig = (config: unknown): unknown | null => {
  if (typeof config !== "object" || config === null) return null;
  if (!("transport" in config) || config.transport !== "remote") return null;

  if (!("authenticationTemplate" in config)) {
    // Family 1: singular `auth`, or an open server with no auth field.
    const auth =
      "auth" in config
        ? Option.getOrNull(decodeLegacySingleAuth(config.auth))
        : { kind: "none" as const };
    if (auth === null) return null;
    const { auth: _auth, ...rest } = config as { auth?: unknown };
    const migrated = { ...rest, authenticationTemplate: [methodFromSingleAuth(auth)] };
    return parseMcpIntegrationConfig(migrated) !== null ? migrated : null;
  }

  const entries = (config as { authenticationTemplate: unknown }).authenticationTemplate;
  if (!Array.isArray(entries)) return null;

  const migrated = entries.map(migrateMethodEntry);
  if (migrated.some((entry) => entry === null)) return null;
  const changed = migrated.some((entry, index) => entry !== entries[index]);
  if (!changed) return null;

  const next = { ...config, authenticationTemplate: migrated };
  return parseMcpIntegrationConfig(next) !== null ? next : null;
};