import { betterAuth, type BetterAuthOptions } from "better-auth";
import { APIError } from "better-auth/api";
import { admin, bearer, mcp, organization } from "better-auth/plugins";
import { apiKey } from "@better-auth/api-key";
import { type Client } from "@libsql/client";
import { LibsqlDialect } from "@libsql/kysely-libsql";
import { Context } from "effect";

import { loadConfig } from "../config";
import { seedOrgAndAdmin } from "./seed";
import { consumeInviteCode, ensureInviteCodeTable, findRedeemableCode } from "./invites";

// The self-service signup gate: present only on the live (phase-2) auth
// instance, so the bootstrap seed's `createUser` — which
// runs on the gate-free phase-1 instance — is never blocked. `getAuth` is
// late-bound because the hooks call `auth.api.addMember` AFTER the instance they
// belong to is constructed (the closure resolves it at request time).
interface SignupGate {
  readonly client: Client;
  readonly organizationId: string;
  readonly getAuth: () => Auth | null;
}

// Only self-service email signups are code-gated. Server/admin-initiated user
// creation (the seed, or a future admin "add user") flows through other paths.
const SIGNUP_PATH = "/sign-up/email";

// ---------------------------------------------------------------------------
// Better Auth instance over the SAME libSQL `file:` URL as the FumaDB executor
// tables ("one file, two schema regions").
//
// Schema-at-boot: passing `{ dialect: new LibsqlDialect({ url }), type: "sqlite" }`
// makes Better Auth's createKyselyAdapter take its `"dialect" in db` branch (no
// native dep, no bun:sqlite); `runMigrations()` creates the auth tables
// idempotently in that file. `makeAuthOptions` is the single source of truth so
// the migrator and runtime instance never drift.
//
// CRITICAL: LibsqlDialect opens its OWN libSQL connection to the file — it does
// NOT share SelfHostDb's drizzle connection. Both target one file, and a row
// Better Auth writes via this dialect is immediately readable through the
// drizzle/FumaDB client (proven by seed.ts's reads + better-auth.test.ts). The
// per-connection foreign_keys/WAL PRAGMAs SelfHostDb set on its own connection
// do NOT carry to this one; for the auth tables that is fine (Kysely issues no
// FK-dependent reads at boot and WAL is already a file-level mode), and the
// shared file stays consistent because writes go through SQLite's file lock.
//
// NEVER call .destroy() on the resulting Kysely instance during normal
// operation — SelfHostDb owns the file lifecycle and closes its client at
// shutdown; the dialect's connection is GC'd with the auth instance.
//
// `satisfies BetterAuthOptions` (not a return annotation) keeps the literal
// plugin tuple so `betterAuth` infers the plugin-augmented `auth.api` and
// session/user shapes (activeOrganizationId, role, createUser, ...).
// ---------------------------------------------------------------------------

const makeAuthOptions = (url: string, organizationId: string, gate?: SignupGate) => {
  const config = loadConfig();
  // Always resolved (generated + persisted when no env is set); this guards only
  // an explicitly-set env secret that is too weak.
  const secret = config.authSecret;
  if (secret.length < 32) {
    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: a multi-user auth server must not boot with a weak session secret
    throw new Error("BETTER_AUTH_SECRET (or AUTH_SECRET), if set, must be at least 32 characters");
  }
  return {
    database: { dialect: new LibsqlDialect({ url }), type: "sqlite" as const },
    secret,
    baseURL: config.webBaseUrl,
    // The browser Origin must match this exactly; CLI/MCP bearer requests carry
    // no Origin and are unaffected.
    trustedOrigins: [config.webBaseUrl],
    emailAndPassword: { enabled: true },
    // `apiKey` issues long-lived personal keys (the API-keys page). With
    // `enableSessionForAPIKeys`, presenting a key resolves to its owner's
    // session — so a key works as a Bearer token for the API + MCP endpoint.
    //
    // `mcp()` adds the MCP OAuth Authorization Server: dynamic client
    // registration + authorize + token under /api/auth/mcp/*, the discovery
    // docs, and `getMcpSession` (opaque-bearer validation). It WRAPS
    // oidcProvider — do NOT also add oidcProvider. The two root well-known docs
    // are re-emitted by the shared envelope (MCP clients probe the origin root,
    // not the /api/auth basePath).
    plugins: [
      organization(),
      admin(),
      apiKey({ enableSessionForAPIKeys: true, rateLimit: { enabled: false } }),
      bearer(),
      mcp({ loginPage: "/login" }),
    ],
    databaseHooks: {
      session: {
        create: {
          // Single-org instance: pin every session to the one organization, so
          // every authenticated user resolves to the org scope.
          before: async (session: Record<string, unknown>) => ({
            data: { ...session, activeOrganizationId: organizationId },
          }),
        },
      },
      // The signup gate. First-run: an org with ZERO members is unclaimed, so
      // the first signup is admitted ungated and becomes the owner. After that,
      // `before` rejects a signup without a valid, unused, unexpired invite code
      // and `after` makes the new user a real `member` + burns the code.
      ...(gate
        ? {
            user: {
              create: {
                before: async (_user, context) => {
                  if (context?.path !== SIGNUP_PATH) return;
                  if (await orgHasNoMembers(gate)) return; // first user claims the org
                  const code = inviteCodeFrom(context);
                  if (!code) {
                    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: a Better Auth create hook rejects a request by throwing APIError
                    throw new APIError("FORBIDDEN", {
                      message: "An invite code is required to sign up.",
                    });
                  }
                  if (!(await findRedeemableCode(gate.client, code))) {
                    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: a Better Auth create hook rejects a request by throwing APIError
                    throw new APIError("FORBIDDEN", {
                      message: "That invite code is invalid, already used, or expired.",
                    });
                  }
                },
                after: async (user, context) => {
                  if (context?.path !== SIGNUP_PATH) return;
                  const auth = gate.getAuth();
                  if (!auth) return;
                  // First user into an empty org becomes its owner (no code).
                  if (await orgHasNoMembers(gate)) {
                    await auth.api.addMember({
                      body: { userId: user.id, role: "owner", organizationId: gate.organizationId },
                    });
                    return;
                  }
                  const code = inviteCodeFrom(context);
                  if (!code) return;
                  const redeemable = await findRedeemableCode(gate.client, code);
                  if (!redeemable) return;
                  await auth.api.addMember({
                    body: {
                      userId: user.id,
                      role: redeemable.role,
                      organizationId: gate.organizationId,
                    },
                  });
                  await consumeInviteCode(gate.client, code, {
                    usedBy: user.id,
                    usedByEmail: user.email,
                  });
                },
              },
            },
          }
        : {}),
    },
  } satisfies BetterAuthOptions;
};

// The invite code rides on the signup request body (`{ name, email, password,
// inviteCode }`); Better Auth reads the body loosely, so a non-schema field
// survives to the create hook's endpoint context.
const inviteCodeFrom = (context: { body?: unknown }): string | undefined => {
  const body = context.body;
  if (body && typeof body === "object" && "inviteCode" in body) {
    const code = (body as { inviteCode?: unknown }).inviteCode;
    if (typeof code === "string" && code.trim().length > 0) return code;
  }
  return undefined;
};

// Count org members via Better Auth's OWN adapter — the SAME connection that
// `addMember` writes through. SelfHostDb opens a SEPARATE libSQL connection
// whose snapshot can lag Better Auth's writes (observed under Bun: a just-added
// member is invisible to that connection for a while), so any membership read
// that gates behaviour MUST go through here to stay consistent with the writes.
export const countOrgMembers = (auth: Auth, organizationId: string): Promise<number> =>
  auth.$context.then(({ adapter }) =>
    adapter.count({ model: "member", where: [{ field: "organizationId", value: organizationId }] }),
  );

// True when the single org has no members yet — the unclaimed first-run state.
const orgHasNoMembers = async (gate: SignupGate): Promise<boolean> => {
  const auth = gate.getAuth();
  if (!auth) return true;
  return (await countOrgMembers(auth, gate.organizationId)) === 0;
};

const createAuthInstance = (url: string, organizationId: string, gate?: SignupGate) =>
  betterAuth(makeAuthOptions(url, organizationId, gate));

export type Auth = ReturnType<typeof createAuthInstance>;

export interface BetterAuthHandle {
  readonly auth: Auth;
  readonly organizationId: string;
  readonly organizationName: string;
  readonly handler: (request: Request) => Promise<Response>;
}

export class BetterAuth extends Context.Service<BetterAuth, BetterAuthHandle>()(
  "@executor-js/host-selfhost/BetterAuth",
) {}

/**
 * Build the Better Auth instance: migrate, seed the org+admin, then rebuild
 * with the resolved org id pinned into the session hook. runMigrations and the
 * seed are idempotent, so this is safe on every boot.
 *
 * `url` is the SAME libSQL `file:` URL SelfHostDb opened; `client` is
 * SelfHostDb's drizzle connection to that file, used by the seed for its two
 * idempotency reads against the auth tables Better Auth just migrated (proving
 * the cross-connection invariant: Better Auth writes via LibsqlDialect are
 * visible through SelfHostDb's client on the same file).
 */
export const buildBetterAuth = async (url: string, client: Client): Promise<BetterAuthHandle> => {
  const config = loadConfig();

  // Phase 1: bootstrap instance (placeholder org, NO signup gate), create
  // tables, seed. `runMigrations()` flows through the LibsqlDialect and is
  // idempotent; the gate-free instance lets the seed's `createUser` through.
  const bootstrap = createAuthInstance(url, "");
  await (await bootstrap.$context).runMigrations();
  await ensureInviteCodeTable(client);
  const { organizationId, organizationName } = await seedOrgAndAdmin(bootstrap, client, config);

  // Phase 2: the live instance — real org id (session pin) + the signup gate.
  // `getAuth` resolves to this very instance, so the gate's `after` hook can
  // call `auth.api.addMember` once a code is redeemed.
  let auth: Auth | null = null;
  const gate: SignupGate = { client, organizationId, getAuth: () => auth };
  auth = createAuthInstance(url, organizationId, gate);
  return { auth, organizationId, organizationName, handler: auth.handler };
};