import { Effect, Layer, Option } from "effect";
import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";

export const OAUTH_CLIENT_ID_METADATA_DOCUMENT_BASE_PATH = "/oauth/client-id-metadata" as const;
export const OAUTH_CLIENT_ID_METADATA_DOCUMENT_PATH =
  `${OAUTH_CLIENT_ID_METADATA_DOCUMENT_BASE_PATH}.json` as const;
export const OAUTH_CLIENT_ID_METADATA_DOCUMENT_TARGET_PATH_PREFIX =
  `${OAUTH_CLIENT_ID_METADATA_DOCUMENT_BASE_PATH}/` as const;
export const OAUTH_CLIENT_ID_METADATA_DOCUMENT_DEFAULT_TARGET = "default" as const;
export const OAUTH_CLIENT_ID_METADATA_DOCUMENT_LOCAL_TARGET = "local" as const;
const OAUTH_CALLBACK_ORG_QUERY_PARAM = "executor_org" as const;

type MetadataTarget =
  | typeof OAUTH_CLIENT_ID_METADATA_DOCUMENT_DEFAULT_TARGET
  | typeof OAUTH_CLIENT_ID_METADATA_DOCUMENT_LOCAL_TARGET
  | string;

interface OAuthClientIdMetadataDocument {
  readonly client_id: string;
  readonly client_name: string;
  readonly client_uri: string;
  readonly redirect_uris: readonly string[];
  readonly grant_types: readonly ["authorization_code"];
  readonly response_types: readonly ["code"];
  readonly token_endpoint_auth_method: "none";
  readonly application_type: "web" | "native";
}

const pathWithMountPrefix = (mountPrefix?: string): `/${string}` =>
  `${mountPrefix ?? ""}${OAUTH_CLIENT_ID_METADATA_DOCUMENT_PATH}` as `/${string}`;

const targetPathWithMountPrefix = (mountPrefix?: string): `/${string}` =>
  `${mountPrefix ?? ""}${OAUTH_CLIENT_ID_METADATA_DOCUMENT_TARGET_PATH_PREFIX}*` as `/${string}`;

const callbackPathWithMountPrefix = (mountPrefix?: string): `/${string}` =>
  `${mountPrefix ?? ""}/oauth/callback` as `/${string}`;

export const oauthClientIdMetadataDocumentPath = (mountPrefix?: string): `/${string}` =>
  pathWithMountPrefix(mountPrefix);

export const oauthClientIdMetadataDocumentTargetPath = (
  target: MetadataTarget,
  mountPrefix?: string,
): `/${string}` =>
  `${mountPrefix ?? ""}${OAUTH_CLIENT_ID_METADATA_DOCUMENT_TARGET_PATH_PREFIX}${encodeURIComponent(
    target,
  )}.json` as `/${string}`;

const firstForwardedHeaderValue = (headers: Headers, name: string): string | undefined => {
  const value = headers.get(name)?.split(",")[0]?.trim();
  return value ? value : undefined;
};

const parseAbsoluteUrl = (value: string): URL | undefined => {
  if (!/^[a-z][a-z\d+.-]*:\/\//i.test(value)) return undefined;
  return new URL(value);
};
const decodeUriComponentOption = Option.liftThrowable(decodeURIComponent);

const pathSearchAndHash = (value: string, fallbackPath: `/${string}`): string => {
  const parsed = parseAbsoluteUrl(value);
  if (parsed) return `${parsed.pathname}${parsed.search}${parsed.hash}`;
  return value.startsWith("/") ? value : fallbackPath;
};

const metadataTargetFromPath = ({
  pathname,
  mountPrefix,
}: {
  readonly pathname: string;
  readonly mountPrefix?: string;
}): MetadataTarget | undefined => {
  const prefix = `${mountPrefix ?? ""}${OAUTH_CLIENT_ID_METADATA_DOCUMENT_TARGET_PATH_PREFIX}`;
  if (!pathname.startsWith(prefix) || !pathname.endsWith(".json")) return undefined;
  const encoded = pathname.slice(prefix.length, -".json".length);
  if (!encoded || encoded.includes("/")) return undefined;
  const target = Option.getOrUndefined(
    Option.map(decodeUriComponentOption(encoded), (value) => value.trim()),
  );
  return target ? target : undefined;
};

const orgSlugFromMetadataTarget = (target: MetadataTarget | undefined): string | undefined => {
  if (!target) return undefined;
  if (
    target === OAUTH_CLIENT_ID_METADATA_DOCUMENT_DEFAULT_TARGET ||
    target === OAUTH_CLIENT_ID_METADATA_DOCUMENT_LOCAL_TARGET
  ) {
    return undefined;
  }
  return target;
};

export const oauthClientIdMetadataDocumentUrlFromRequest = ({
  requestUrl,
  webRequest,
  mountPrefix,
}: {
  readonly requestUrl: string;
  readonly webRequest: Request;
  readonly mountPrefix?: string;
}): URL => {
  const requestAbsoluteUrl = parseAbsoluteUrl(requestUrl) ?? parseAbsoluteUrl(webRequest.url);
  const proto =
    firstForwardedHeaderValue(webRequest.headers, "x-forwarded-proto") ??
    requestAbsoluteUrl?.protocol.replace(/:$/, "") ??
    "http";
  const host =
    firstForwardedHeaderValue(webRequest.headers, "x-forwarded-host") ??
    firstForwardedHeaderValue(webRequest.headers, "host") ??
    requestAbsoluteUrl?.host ??
    "localhost";
  const origin = `${proto}://${host}`;
  return new URL(pathSearchAndHash(requestUrl, pathWithMountPrefix(mountPrefix)), origin);
};

const localLoopbackRedirectUris = (mountPrefix?: string): readonly string[] => {
  const callbackPath = callbackPathWithMountPrefix(mountPrefix);
  return [
    new URL(callbackPath, "http://127.0.0.1").toString(),
    new URL(callbackPath, "http://localhost").toString(),
    new URL(callbackPath, "http://[::1]").toString(),
  ];
};

export const oauthClientIdMetadataDocumentFromRequest = ({
  requestUrl,
  webRequest,
  mountPrefix,
}: {
  readonly requestUrl: string;
  readonly webRequest: Request;
  readonly mountPrefix?: string;
}): OAuthClientIdMetadataDocument => {
  const url = oauthClientIdMetadataDocumentUrlFromRequest({ requestUrl, webRequest, mountPrefix });
  const target = metadataTargetFromPath({ pathname: url.pathname, mountPrefix });

  if (target === OAUTH_CLIENT_ID_METADATA_DOCUMENT_LOCAL_TARGET) {
    return {
      client_id: url.toString(),
      client_name: "Executor Local",
      client_uri: url.origin,
      redirect_uris: localLoopbackRedirectUris(mountPrefix),
      grant_types: ["authorization_code"],
      response_types: ["code"],
      token_endpoint_auth_method: "none",
      application_type: "native",
    };
  }

  const redirectUri = new URL(callbackPathWithMountPrefix(mountPrefix), url.origin);
  const orgSlug =
    orgSlugFromMetadataTarget(target) ??
    url.searchParams.get(OAUTH_CALLBACK_ORG_QUERY_PARAM)?.trim();
  if (orgSlug) redirectUri.searchParams.set(OAUTH_CALLBACK_ORG_QUERY_PARAM, orgSlug);

  return {
    client_id: url.toString(),
    client_name: "Executor",
    client_uri: url.origin,
    redirect_uris: [redirectUri.toString()],
    grant_types: ["authorization_code"],
    response_types: ["code"],
    token_endpoint_auth_method: "none",
    application_type: "web",
  };
};

export const makeOAuthClientIdMetadataRoute = (
  mountPrefix?: string,
): Layer.Layer<never, never, HttpRouter.HttpRouter> => {
  const handler = Effect.gen(function* () {
    const request = yield* HttpServerRequest.HttpServerRequest;
    // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: HTTP router request conversion failure is an edge defect, not recoverable route input
    const webRequest = yield* HttpServerRequest.toWeb(request).pipe(Effect.orDie);
    const metadata = oauthClientIdMetadataDocumentFromRequest({
      requestUrl: request.url,
      webRequest,
      mountPrefix,
    });

    return HttpServerResponse.jsonUnsafe(metadata, {
      headers: {
        "cache-control": "public, max-age=300",
      },
    });
  });

  return Layer.mergeAll(
    HttpRouter.add("GET", pathWithMountPrefix(mountPrefix), handler),
    HttpRouter.add("GET", targetPathWithMountPrefix(mountPrefix), handler),
  );
};