// ---------------------------------------------------------------------------
// Cloud's rollout gate for MCP Enterprise-Managed Authorization.
//
// Implements the vendor-free `EnterpriseManagedRollout` port from
// `@executor-js/sdk` against PostHog, which is the only flag/analytics service
// this deployment operates. Two deliberate shapes:
//
// 1. NO SDK. This is a hand-written `fetch` against two documented PostHog
//    endpoints, not `posthog-node`. Cloud already ate an unexplained 3-5s
//    page-load regression from adding one dependency to the worker bundle and
//    the mechanism was never identified (see the notes on the MCP SDK v2
//    revert). Until that is understood, a new runtime dependency in this bundle
//    is a cost we are not willing to pay for a boolean, and the whole client we
//    would be importing is two POSTs wide.
//
// 2. FAIL CLOSED, ALWAYS. Every way of not getting an answer — timeout,
//    transport failure, non-2xx, a body we cannot parse, no PostHog key
//    configured, no acting user to key the rollout on — withholds the
//    enterprise-managed path and falls back to ordinary interactive OAuth. A
//    PostHog outage therefore degrades the rollout and never fails a connect,
//    and (because the SDK freezes the verdict onto the connection) never
//    touches an enterprise-managed connection that already exists.
//
// The rollout UNIT is the user: `distinct_id` is the acting user's id, the same
// id `posthog.identify(user.id, …)` uses in the browser, so a percentage
// rollout here means the same population it means everywhere else in the
// project. The organization rides along as group context so org-level targeting
// stays available in the PostHog UI without changing that unit.
// ---------------------------------------------------------------------------

import { env } from "cloudflare:workers";
import { Effect, Schema } from "effect";

import type {
  EnterpriseManagedRollout,
  EnterpriseManagedRolloutContext,
  EnterpriseManagedRolloutDecision,
  EnterpriseManagedRolloutEvent,
} from "@executor-js/sdk";

import { POSTHOG_INGEST_HOST } from "../edge/passthrough";

/** The flag that gates enterprise-managed authorization. */
export const ENTERPRISE_MANAGED_AUTH_FLAG_KEY = "mcp-enterprise-managed-auth";

/** PostHog group type for organizations — the same one
 *  `posthog.group("organization", …)` establishes in the browser. */
const ORGANIZATION_GROUP_TYPE = "organization";

/**
 * How long a flag evaluation may take before the gate gives up and withholds.
 * Short on purpose: this call sits in front of an interactive connect, and the
 * safe answer is already known, so waiting is strictly worse than answering.
 */
export const DEFAULT_FLAG_EVALUATION_TIMEOUT_MS = 1_000;

/** Wire names of the rollout events, in the product's `object_verb` style. */
const EVENT_NAMES = {
  attempted: "ema_connect_attempted",
  connected: "ema_connect_connected",
  "blocked-by-admin": "ema_connect_blocked_by_admin",
} as const satisfies Record<EnterpriseManagedRolloutEvent["kind"], string>;

// ---------------------------------------------------------------------------
// Boundary parsing
// ---------------------------------------------------------------------------

/** The slice of PostHog's `POST /flags?v=2` response this gate reads. Unknown
 *  keys are ignored, so PostHog adding fields cannot make the gate fail closed;
 *  a body that is not this shape at all can, which is the intent. */
const FlagsResponse = Schema.Struct({
  flags: Schema.Record(Schema.String, Schema.Struct({ enabled: Schema.Boolean })),
});

const decodeFlagsResponse = Schema.decodeUnknownEffect(FlagsResponse);

// ---------------------------------------------------------------------------
// Detached work
// ---------------------------------------------------------------------------

/**
 * Hand a request to the platform and stop caring about it.
 *
 * `waitUntil` is the correct owner when the caller has an `ExecutionContext`;
 * the executor composition seam this gate is installed through does not receive
 * one, so the default owner attaches a terminal rejection handler and lets the
 * in-flight request ride out the rest of the response. Either way the promise
 * is owned by something that cannot report back, which is what makes an event
 * structurally unable to fail or delay a connect.
 */
const detach = (
  work: Promise<unknown>,
  waitUntil: ((work: Promise<unknown>) => void) | undefined,
): void => {
  const settled = work.then(
    () => undefined,
    () => undefined,
  );
  if (waitUntil) waitUntil(settled);
};

// ---------------------------------------------------------------------------
// The gate
// ---------------------------------------------------------------------------

export interface PostHogRolloutConfig {
  /** Public project key (`phc_…`). Public by design — it is already shipped to
   *  every browser — so this is a var, not a secret. */
  readonly projectKey: string;
  /** PostHog API origin (no trailing slash), e.g. `https://us.i.posthog.com`. */
  readonly host: string;
  readonly fetch: typeof globalThis.fetch;
  readonly timeoutMs?: number;
  /** Platform post-response hook, when the caller has one. */
  readonly waitUntil?: (work: Promise<unknown>) => void;
}

const withheld = (
  reason: "disabled" | "evaluation-unavailable",
): EnterpriseManagedRolloutDecision => ({ kind: "withheld", reason });

const ENABLED: EnterpriseManagedRolloutDecision = { kind: "enabled" };

/** Group context for a connect whose organization the host named. */
const groupsFor = (context: EnterpriseManagedRolloutContext): Record<string, string> | undefined =>
  context.organizationId === null
    ? undefined
    : { [ORGANIZATION_GROUP_TYPE]: context.organizationId };

/**
 * Build cloud's enterprise-managed rollout gate over an explicit PostHog
 * configuration. Everything environmental is a parameter so the composition
 * root parses it once and tests drive the real code path with an injected
 * `fetch`.
 */
export const makePostHogEnterpriseManagedRollout = (
  config: PostHogRolloutConfig,
): EnterpriseManagedRollout => {
  const timeoutMs = config.timeoutMs ?? DEFAULT_FLAG_EVALUATION_TIMEOUT_MS;

  const evaluate = Effect.fn("Cloud.EnterpriseManagedRollout.decide")(function* (
    context: EnterpriseManagedRolloutContext,
  ) {
    // The rollout unit is the user. With no acting user there is no
    // `distinct_id` to key it on, so there is no answer to be had — withhold
    // rather than invent a rollout bucket.
    const distinctId = context.userId;
    if (distinctId === null) return withheld("evaluation-unavailable");

    const groups = groupsFor(context);
    const response = yield* Effect.tryPromise(() =>
      config.fetch(`${config.host}/flags?v=2`, {
        method: "POST",
        headers: {
          "content-type": "application/json",
          // Declares this a server-side evaluation, which is what selects
          // server-runtime flags in PostHog's runtime detection.
          "user-agent": "executor-cloud",
        },
        body: JSON.stringify({
          api_key: config.projectKey,
          distinct_id: distinctId,
          ...(groups === undefined ? {} : { groups }),
        }),
        signal: AbortSignal.timeout(timeoutMs),
      }),
    );
    if (!response.ok) return withheld("evaluation-unavailable");

    const body = yield* Effect.tryPromise(() => response.json() as Promise<unknown>);
    const decoded = yield* decodeFlagsResponse(body);
    const flag = decoded.flags[ENTERPRISE_MANAGED_AUTH_FLAG_KEY];
    // A flag PostHog did not return is a flag that is not on for this user
    // (it may not exist yet, or the project may be quota-limited). That is a
    // real "no", not a failure to answer.
    if (flag === undefined || !flag.enabled) return withheld("disabled");
    return ENABLED;
  });

  return {
    decide: (context) =>
      evaluate(context).pipe(
        // Timeout, transport failure and an unparseable body all land here and
        // all mean the same thing: no answer, so no enterprise-managed attempt.
        // `catchCause` rather than `catchAll` because a defect in this adapter
        // must not become a failed connect either.
        Effect.catchCause(() => Effect.succeed(withheld("evaluation-unavailable"))),
      ),
    record: (event) =>
      Effect.sync(() => {
        const distinctId = event.context.userId;
        // Same reason `decide` withholds: an event with no person to attach to
        // would only pollute the project with anonymous rows.
        if (distinctId === null) return;
        const groups = groupsFor(event.context);
        const decision = event.decision;
        detach(
          config.fetch(`${config.host}/i/v0/e/`, {
            method: "POST",
            headers: { "content-type": "application/json" },
            body: JSON.stringify({
              api_key: config.projectKey,
              event: EVENT_NAMES[event.kind],
              distinct_id: distinctId,
              properties: {
                // Product metadata only. There is no field on
                // `EnterpriseManagedRolloutEvent` that can carry a token, an
                // identity assertion, a client secret or a scope, and none is
                // synthesized here.
                integration_slug: String(event.context.integration),
                ema_flag_enabled: decision.kind === "enabled",
                ...(decision.kind === "withheld"
                  ? { ema_flag_withheld_reason: decision.reason }
                  : {}),
                // PostHog's own convention, so these events can be filtered by
                // flag value in the UI alongside every other flag.
                [`$feature/${ENTERPRISE_MANAGED_AUTH_FLAG_KEY}`]: decision.kind === "enabled",
                ...(event.kind === "blocked-by-admin" && event.oauthErrorCode !== undefined
                  ? { oauth_error_code: event.oauthErrorCode }
                  : {}),
                ...(groups === undefined ? {} : { $groups: groups }),
              },
            }),
          }),
          config.waitUntil,
        );
      }),
  };
};

/** A gate that answers "no" to everything, for a deployment that has no PostHog
 *  configuration to evaluate against. Cloud is SUPPOSED to have one, so a
 *  missing key is a misconfiguration, and failing closed is the same choice the
 *  outage paths make. This is NOT the same as injecting no gate at all, which
 *  is how the hosts with no flag service (local, desktop, CLI, self-host) keep
 *  their existing behavior. */
export const unavailableEnterpriseManagedRollout: EnterpriseManagedRollout = {
  decide: () => Effect.succeed(withheld("evaluation-unavailable")),
  record: () => Effect.void,
};

/**
 * The gate as the cloud worker composes it: the public project key already
 * shipped in `wrangler.jsonc`, and the same PostHog ingest origin the
 * adblock-dodging passthrough proxies to.
 */
export const cloudEnterpriseManagedRollout = (): EnterpriseManagedRollout => {
  const projectKey = env.VITE_PUBLIC_POSTHOG_KEY;
  if (!projectKey) return unavailableEnterpriseManagedRollout;
  return makePostHogEnterpriseManagedRollout({
    projectKey,
    host: env.VITE_PUBLIC_POSTHOG_HOST ?? `https://${POSTHOG_INGEST_HOST}`,
    fetch: (input, init) => globalThis.fetch(input, init),
  });
};