import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
import { Schema } from "effect";
import { UserStoreError, WorkOSError } from "./errors";
import { NoOrganization } from "@executor-js/api/server";
import { SessionAuth } from "./middleware";

const AuthUser = Schema.Struct({
  id: Schema.String,
  email: Schema.String,
  name: Schema.NullOr(Schema.String),
  avatarUrl: Schema.NullOr(Schema.String),
});

const AuthOrganization = Schema.Struct({
  id: Schema.String,
  name: Schema.String,
  /** URL slug for org-prefixed console paths (`/<slug>/policies`). */
  slug: Schema.String,
});

const AuthMeResponse = Schema.Struct({
  user: AuthUser,
  organization: Schema.NullOr(AuthOrganization),
});

const AuthOrganizationSummary = Schema.Struct({
  id: Schema.String,
  name: Schema.String,
  slug: Schema.String,
});

const AuthOrganizationsResponse = Schema.Struct({
  organizations: Schema.Array(AuthOrganizationSummary),
  activeOrganizationId: Schema.NullOr(Schema.String),
});

const CreateOrganizationBody = Schema.Struct({
  name: Schema.String,
});

const CreateOrganizationResponse = Schema.Struct({
  id: Schema.String,
  name: Schema.String,
  slug: Schema.String,
});

// Deleting an org requires re-typing its name (the label the UI shows) as a
// deliberate, non-automatable confirmation. Verified server-side too.
const DeleteOrganizationBody = Schema.Struct({
  confirmName: Schema.String,
});

const DeleteOrganizationResponse = Schema.Struct({
  success: Schema.Boolean,
});

// CLI device-login discovery (`executor login`). Tells the CLI where to run
// the OAuth 2.0 Device Authorization Grant (RFC 8628) and which public client
// to use. The CLI hits these provider endpoints directly, gets a WorkOS access
// token (a JWT), and sends it as a Bearer to the `/api/*` plane.
const CliLoginResponse = Schema.Struct({
  provider: Schema.Literal("workos"),
  deviceAuthorizationEndpoint: Schema.String,
  tokenEndpoint: Schema.String,
  clientId: Schema.String,
});

// `state` is optional — some WorkOS-initiated redirects arrive at the
// callback without the state we set on /auth/login. The CSRF check is
// only enforced when state is present (see callback handler).
const AuthCallbackSearch = Schema.Struct({
  code: Schema.String,
  state: Schema.optional(Schema.String),
});

// Where to send the user after the callback completes (the /login page passes
// the path the SSR auth gate captured). Validated server-side to same-origin
// relative paths before use.
const AuthLoginSearch = Schema.Struct({
  returnTo: Schema.optional(Schema.String),
});

const PendingInvitationInviter = Schema.Struct({
  email: Schema.String,
  name: Schema.NullOr(Schema.String),
});

const PendingInvitation = Schema.Struct({
  id: Schema.String,
  organizationId: Schema.String,
  organizationName: Schema.String,
  createdAt: Schema.String,
  inviter: Schema.NullOr(PendingInvitationInviter),
});

const PendingInvitationsResponse = Schema.Struct({
  invitations: Schema.Array(PendingInvitation),
});

const AcceptInvitationBody = Schema.Struct({
  invitationId: Schema.String,
});

const AcceptInvitationResponse = Schema.Struct({
  id: Schema.String,
  name: Schema.String,
  slug: Schema.String,
});

const McpSessionExecutionParams = {
  mcpSessionId: Schema.String,
  executionId: Schema.String,
};

const ResumeMcpExecutionBody = Schema.Struct({
  action: Schema.Literals(["accept", "decline", "cancel"]),
  content: Schema.optional(Schema.Unknown),
  persist: Schema.optional(Schema.String),
});

const McpPausedExecutionResponse = Schema.Struct({
  text: Schema.String,
  structured: Schema.Unknown,
});

const McpResumeCompletedResponse = Schema.Struct({
  status: Schema.Literal("completed"),
  text: Schema.String,
  structured: Schema.Unknown,
  isError: Schema.Boolean,
});

const McpResumePausedResponse = Schema.Struct({
  status: Schema.Literal("paused"),
  text: Schema.String,
  structured: Schema.Unknown,
});

const McpResumeExecutionResponse = Schema.Union([
  McpResumeCompletedResponse,
  McpResumePausedResponse,
]);

export class McpExecutionNotFoundError extends Schema.TaggedErrorClass<McpExecutionNotFoundError>()(
  "McpExecutionNotFoundError",
  {
    executionId: Schema.String,
  },
  { httpApiStatus: 404 },
) {}

export class McpSessionForbiddenError extends Schema.TaggedErrorClass<McpSessionForbiddenError>()(
  "McpSessionForbiddenError",
  {
    mcpSessionId: Schema.String,
  },
  { httpApiStatus: 403 },
) {}

// Refused org deletion: the caller is not an admin of the org, or the typed
// confirmation did not match. Deliberately one error for both so it never
// reveals which check failed.
export class OrganizationDeletionForbidden extends Schema.TaggedErrorClass<OrganizationDeletionForbidden>()(
  "OrganizationDeletionForbidden",
  {},
  { httpApiStatus: 403 },
) {}

export const AUTH_PATHS = {
  login: "/api/auth/login",
  logout: "/api/auth/logout",
  callback: "/api/auth/callback",
} as const;

const AuthErrors = [UserStoreError, WorkOSError] as const;
const McpApprovalErrors = [
  NoOrganization,
  McpExecutionNotFoundError,
  McpSessionForbiddenError,
] as const;

/** Public auth endpoints — no authentication required */
export class CloudAuthPublicApi extends HttpApiGroup.make("cloudAuthPublic")
  .add(HttpApiEndpoint.get("login", "/auth/login", { query: AuthLoginSearch }))
  // Sign-out is PUBLIC on purpose. The console posts it as a top-level form
  // navigation (the WorkOS hop is cross-origin, so it can't be a fetch), which
  // means an error response is rendered as the page — and a browser whose
  // session has already ended is exactly the browser most likely to click it
  // (a second tab, a re-submit from history, an expired or revoked session).
  // Behind SessionAuth all of those got a raw `{"_tag":"Unauthorized"}` screen
  // instead of being signed out. There is nothing to authorize here anyway:
  // the request can only end the session whose cookie it presents.
  .add(HttpApiEndpoint.post("logout", "/auth/logout"))
  .add(
    HttpApiEndpoint.get("callback", "/auth/callback", {
      query: AuthCallbackSearch,
      error: AuthErrors,
    }),
  )
  .add(
    HttpApiEndpoint.get("cliLogin", "/auth/cli-login", {
      success: CliLoginResponse,
    }),
  ) {}

/** Session auth endpoints — require a logged-in user, may not have an org */
export class CloudAuthApi extends HttpApiGroup.make("cloudAuth")
  .add(
    HttpApiEndpoint.get("me", "/auth/me", {
      success: AuthMeResponse,
      error: AuthErrors,
    }),
  )
  .add(
    HttpApiEndpoint.get("organizations", "/auth/organizations", {
      success: AuthOrganizationsResponse,
      error: WorkOSError,
    }),
  )
  .add(
    HttpApiEndpoint.post("createOrganization", "/auth/create-organization", {
      payload: CreateOrganizationBody,
      success: CreateOrganizationResponse,
      error: AuthErrors,
    }),
  )
  .add(
    HttpApiEndpoint.post("deleteOrganization", "/auth/delete-organization", {
      payload: DeleteOrganizationBody,
      success: DeleteOrganizationResponse,
      error: [...AuthErrors, NoOrganization, OrganizationDeletionForbidden],
    }),
  )
  .add(
    HttpApiEndpoint.get("pendingInvitations", "/auth/pending-invitations", {
      success: PendingInvitationsResponse,
      error: WorkOSError,
    }),
  )
  .add(
    HttpApiEndpoint.post("acceptInvitation", "/auth/accept-invitation", {
      payload: AcceptInvitationBody,
      success: AcceptInvitationResponse,
      error: AuthErrors,
    }),
  )
  .add(
    HttpApiEndpoint.get("getMcpPaused", "/mcp-sessions/:mcpSessionId/executions/:executionId", {
      params: McpSessionExecutionParams,
      success: McpPausedExecutionResponse,
      error: McpApprovalErrors,
    }),
  )
  .add(
    HttpApiEndpoint.post(
      "resumeMcpExecution",
      "/mcp-sessions/:mcpSessionId/executions/:executionId/resume",
      {
        params: McpSessionExecutionParams,
        payload: ResumeMcpExecutionBody,
        success: McpResumeExecutionResponse,
        error: McpApprovalErrors,
      },
    ),
  )
  .middleware(SessionAuth) {}