import React, { createContext, useContext, useEffect, useMemo, useState } from "react";
import { useAtomValue } from "@effect/atom-react";
import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";

import { meAtom } from "../api/account-atoms";
import {
  clearAuthHintCookie,
  readAuthHintCookie,
  writeAuthHintCookie,
  type AuthHint,
} from "./auth-hint";

// ---------------------------------------------------------------------------
// Shared auth seam for the multiplayer apps (cloud + self-host).
//
// `useAuth()` reflects the `/account/me` query: loading → unauthenticated →
// authenticated. Provider-neutral — the only difference between cloud (WorkOS)
// and self-host (Better Auth) is which server answers `me` and how the session
// cookie was minted. Analytics stay OUT of here; a host that wants to identify
// the user (cloud → PostHog) passes an `onIdentify` callback.
//
// While `/account/me` is in flight the state is seeded from the auth-hint
// cookie (see ./auth-hint): a signed-in user's first paint is the app shell
// with their identity (no skeleton-gate), and a visitor with no hint renders
// as loading — which the host should never let happen for signed-out users
// (cloud redirects them to /login during SSR). The hint is display-only;
// the resolved `/account/me` answer always wins.
//
// Hosts whose server can see the hint at render time (cloud: the SSR gate
// passes it through the root loader) provide `initialHint`, and the
// authenticated shell is SSR'd outright — both the server render and the
// first client render derive from the same dehydrated value, so they agree
// by construction. Hosts without that seam (self-host) omit it and keep the
// post-mount cookie read: SSR paints loading, the hint applies a frame later.
// ---------------------------------------------------------------------------

export type AuthUser = {
  id: string;
  email: string;
  name: string | null;
  avatarUrl: string | null;
};

export type AuthOrganization = {
  id: string;
  name: string;
  /** URL slug for org-prefixed console paths (`/<slug>/policies`). */
  slug: string;
};

export type AuthState =
  | { status: "loading" }
  | { status: "unauthenticated" }
  | { status: "authenticated"; user: AuthUser; organization: AuthOrganization | null };

export type IdentifyFn = (
  state: Extract<AuthState, { status: "authenticated" }> | { status: "unauthenticated" },
) => void;

const AuthContext = createContext<AuthState>({ status: "loading" });

export const useAuth = () => useContext(AuthContext);

/** The auth-hint cookie as an optimistic AuthState, or null when absent. */
const hintState = (hint: AuthHint | null): AuthState | null =>
  hint && {
    status: "authenticated",
    user: hint.user,
    organization: hint.organization,
  };

const AuthProviderClient = ({
  children,
  onIdentify,
  initialHint = null,
}: {
  children: React.ReactNode;
  onIdentify?: IdentifyFn;
  initialHint?: AuthHint | null;
}) => {
  const result = useAtomValue(meAtom);

  // With a server-provided hint the first client render matches the SSR'd
  // authenticated HTML outright (both derive from the same dehydrated value).
  // Without one, the cookie read is deferred to an effect: SSR rendered
  // loading, and the first client render must match that HTML — the flip
  // costs a frame, not a network round trip. Initial-value-only state: later
  // loader re-runs (which lose the server context) must not yank the seed.
  const [hint, setHint] = useState<AuthHint | null>(initialHint);
  useEffect(() => {
    setHint((current) => current ?? readAuthHintCookie());
  }, []);

  // What `/account/me` actually said — the authority. The atom value only
  // changes identity when the query emits, so memoizing on it gives the
  // effects below a dependency that tracks real transitions.
  const resolved = useMemo<AuthState>(
    () =>
      AsyncResult.match(result, {
        onInitial: () => ({ status: "loading" as const }),
        onSuccess: ({ value }) => ({
          status: "authenticated" as const,
          user: value.user,
          organization: value.organization,
        }),
        onFailure: () => ({ status: "unauthenticated" as const }),
      }),
    [result],
  );

  // Both effects key off RESOLVED state, never hint-derived optimism:
  // identify must not report a stale hint to analytics, and the hint cookie
  // must not rewrite itself from its own contents.
  useEffect(() => {
    if (resolved.status === "loading") return;
    onIdentify?.(resolved);
  }, [onIdentify, resolved]);

  // Keep the hint cookie in step with reality so the NEXT page load seeds
  // correctly: refresh it on every confirmed identity, drop it the moment the
  // server says signed-out.
  useEffect(() => {
    if (resolved.status === "authenticated") {
      writeAuthHintCookie({ v: 1, user: resolved.user, organization: resolved.organization });
    } else if (resolved.status === "unauthenticated") {
      clearAuthHintCookie();
    }
  }, [resolved]);

  // What consumers see — the hint papers over the in-flight window only.
  // Memoized so context consumers don't re-render on unrelated renders.
  const state = useMemo<AuthState>(
    () => (resolved.status === "loading" ? (hintState(hint) ?? resolved) : resolved),
    [resolved, hint],
  );

  return <AuthContext.Provider value={state}>{children}</AuthContext.Provider>;
};

export const AuthProvider = ({
  children,
  onIdentify,
  initialHint = null,
}: {
  children: React.ReactNode;
  onIdentify?: IdentifyFn;
  /**
   * The auth hint as the HOST's server saw it on this request (cloud: from
   * the SSR gate via the root loader, dehydrated to the client). When set,
   * SSR paints the authenticated shell instead of a loading state.
   */
  initialHint?: AuthHint | null;
}) => {
  if (typeof window === "undefined") {
    return (
      <AuthContext.Provider value={hintState(initialHint) ?? { status: "loading" }}>
        {children}
      </AuthContext.Provider>
    );
  }
  return (
    <AuthProviderClient onIdentify={onIdentify} initialHint={initialHint}>
      {children}
    </AuthProviderClient>
  );
};