import type {
  CreateSourcePayload,
  UpdateSourcePayload,
} from "#api";
import type {
  Credential,
  Source,
  SourceAuth,
  SourceCredentialBinding,
  SourceId,
  StoredSourceRecord,
  StringMap,
  WorkspaceId,
} from "#schema";
import { CredentialIdSchema } from "#schema";
import * as Effect from "effect/Effect";
import * as Schema from "effect/Schema";

const decodeStringMap = Schema.decodeUnknown(
  Schema.NullOr(
    Schema.Record({
      key: Schema.String,
      value: Schema.String,
    }),
  ),
);

const trimOrNull = (value: string | null | undefined): string | null => {
  if (value === null || value === undefined) {
    return null;
  }

  const trimmed = value.trim();
  return trimmed.length > 0 ? trimmed : null;
};

const serializeStringMap = (value: StringMap | null): string | null =>
  value === null ? null : JSON.stringify(value);

const parseStringMapJson = (
  fieldName: string,
  value: string | null,
): Effect.Effect<StringMap | null, Error, never> =>
  value === null
    ? Effect.succeed(null)
    : Effect.try({
        try: () => JSON.parse(value),
        catch: (cause) =>
          cause instanceof Error
            ? new Error(`Invalid ${fieldName}: ${cause.message}`)
            : new Error(`Invalid ${fieldName}: ${String(cause)}`),
      }).pipe(
        Effect.flatMap((parsed) => decodeStringMap(parsed)),
        Effect.mapError((cause) =>
          cause instanceof Error
            ? new Error(`Invalid ${fieldName}: ${cause.message}`)
            : new Error(`Invalid ${fieldName}: ${String(cause)}`),
        ),
      );

const normalizeAuth = (
  auth: SourceAuth | undefined,
): Effect.Effect<SourceAuth, Error, never> =>
  Effect.gen(function* () {
    if (auth === undefined || auth.kind === "none") {
      return { kind: "none" } satisfies SourceAuth;
    }

    const headerName = trimOrNull(auth.headerName) ?? "Authorization";
    const prefix = auth.prefix ?? "Bearer ";

    if (auth.kind === "bearer") {
      const providerId = trimOrNull(auth.token.providerId);
      const handle = trimOrNull(auth.token.handle);
      if (providerId === null || handle === null) {
        return yield* Effect.fail(new Error("Bearer auth requires a token secret ref"));
      }

      return {
        kind: "bearer",
        headerName,
        prefix,
        token: {
          providerId,
          handle,
        },
      } satisfies SourceAuth;
    }

    const accessProviderId = trimOrNull(auth.accessToken.providerId);
    const accessHandle = trimOrNull(auth.accessToken.handle);
    if (accessProviderId === null || accessHandle === null) {
      return yield* Effect.fail(new Error("OAuth2 auth requires an access token secret ref"));
    }

    let refreshToken: { providerId: string; handle: string } | null = null;
    if (auth.refreshToken !== null) {
      const refreshProviderId = trimOrNull(auth.refreshToken.providerId);
      const refreshHandle = trimOrNull(auth.refreshToken.handle);
      if (refreshProviderId === null || refreshHandle === null) {
        return yield* Effect.fail(
          new Error("OAuth2 refresh token ref must include providerId and handle"),
        );
      }

      refreshToken = {
        providerId: refreshProviderId,
        handle: refreshHandle,
      };
    }

    return {
      kind: "oauth2",
      headerName,
      prefix,
      accessToken: {
        providerId: accessProviderId,
        handle: accessHandle,
      },
      refreshToken,
    } satisfies SourceAuth;
  });

const validateSourceByKind = (source: Source): Effect.Effect<Source, Error, never> =>
  Effect.gen(function* () {
    if (source.kind === "mcp") {
      if (source.specUrl !== null) {
        return yield* Effect.fail(new Error("MCP sources cannot define specUrl"));
      }
      return source;
    }

    if (source.kind === "openapi") {
      if (trimOrNull(source.specUrl) === null) {
        return yield* Effect.fail(new Error("OpenAPI sources require specUrl"));
      }

      if (source.transport !== null || source.queryParams !== null || source.headers !== null) {
        return yield* Effect.fail(
          new Error("OpenAPI sources cannot define MCP transport settings"),
        );
      }

      return source;
    }

    if (source.kind === "graphql") {
      if (source.transport !== null || source.queryParams !== null || source.headers !== null) {
        return yield* Effect.fail(
          new Error("GraphQL sources cannot define MCP transport settings"),
        );
      }

      if (source.specUrl !== null) {
        return yield* Effect.fail(new Error("GraphQL sources cannot define specUrl"));
      }

      return source;
    }

    if (source.transport !== null || source.queryParams !== null || source.headers !== null) {
      return yield* Effect.fail(
        new Error(`${source.kind} sources cannot define MCP transport settings`),
      );
    }

    if (source.specUrl !== null || source.defaultHeaders !== null) {
      return yield* Effect.fail(
        new Error(`${source.kind} sources cannot define OpenAPI settings`),
      );
    }

    return source;
  });

export const createSourceFromPayload = (input: {
  workspaceId: WorkspaceId;
  sourceId: SourceId;
  payload: CreateSourcePayload;
  now: number;
}): Effect.Effect<Source, Error, never> =>
  Effect.gen(function* () {
    const auth = yield* normalizeAuth(input.payload.auth);

    return yield* validateSourceByKind({
      id: input.sourceId,
      workspaceId: input.workspaceId,
      name: input.payload.name.trim(),
      kind: input.payload.kind,
      endpoint: input.payload.endpoint.trim(),
      status: input.payload.status ?? "draft",
      enabled: input.payload.enabled ?? true,
      namespace: trimOrNull(input.payload.namespace),
      transport: input.payload.transport ?? null,
      queryParams: input.payload.queryParams ?? null,
      headers: input.payload.headers ?? null,
      specUrl: trimOrNull(input.payload.specUrl),
      defaultHeaders: input.payload.defaultHeaders ?? null,
      auth,
      sourceHash: trimOrNull(input.payload.sourceHash),
      lastError: trimOrNull(input.payload.lastError),
      createdAt: input.now,
      updatedAt: input.now,
    });
  });

export const updateSourceFromPayload = (input: {
  source: Source;
  payload: UpdateSourcePayload;
  now: number;
}): Effect.Effect<Source, Error, never> =>
  Effect.gen(function* () {
    const nextAuth = input.payload.auth === undefined
      ? input.source.auth
      : yield* normalizeAuth(input.payload.auth);

    return yield* validateSourceByKind({
      ...input.source,
      name: input.payload.name !== undefined ? input.payload.name.trim() : input.source.name,
      kind: input.payload.kind ?? input.source.kind,
      endpoint:
        input.payload.endpoint !== undefined
          ? input.payload.endpoint.trim()
          : input.source.endpoint,
      status: input.payload.status ?? input.source.status,
      enabled: input.payload.enabled ?? input.source.enabled,
      namespace: input.payload.namespace !== undefined
        ? trimOrNull(input.payload.namespace)
        : input.source.namespace,
      transport: input.payload.transport !== undefined
        ? input.payload.transport
        : input.source.transport,
      queryParams: input.payload.queryParams !== undefined
        ? input.payload.queryParams
        : input.source.queryParams,
      headers: input.payload.headers !== undefined
        ? input.payload.headers
        : input.source.headers,
      specUrl: input.payload.specUrl !== undefined
        ? trimOrNull(input.payload.specUrl)
        : input.source.specUrl,
      defaultHeaders: input.payload.defaultHeaders !== undefined
        ? input.payload.defaultHeaders
        : input.source.defaultHeaders,
      auth: nextAuth,
      sourceHash: input.payload.sourceHash !== undefined
        ? trimOrNull(input.payload.sourceHash)
        : input.source.sourceHash,
      lastError: input.payload.lastError !== undefined
        ? trimOrNull(input.payload.lastError)
        : input.source.lastError,
      updatedAt: input.now,
    });
  });

export const splitSourceForStorage = (input: {
  source: Source;
  existingCredentialId?: Credential["id"] | null;
  existingBindingId?: SourceCredentialBinding["id"] | null;
}): {
  sourceRecord: StoredSourceRecord;
  credential: Credential | null;
  credentialBinding: SourceCredentialBinding | null;
} => {
  const sourceRecord: StoredSourceRecord = {
    id: input.source.id,
    workspaceId: input.source.workspaceId,
    name: input.source.name,
    kind: input.source.kind,
    endpoint: input.source.endpoint,
    status: input.source.status,
    enabled: input.source.enabled,
    namespace: input.source.namespace,
    transport: input.source.transport,
    queryParamsJson: serializeStringMap(input.source.queryParams),
    headersJson: serializeStringMap(input.source.headers),
    specUrl: input.source.specUrl,
    defaultHeadersJson: serializeStringMap(input.source.defaultHeaders),
    sourceHash: input.source.sourceHash,
    sourceDocumentText: null,
    lastError: input.source.lastError,
    createdAt: input.source.createdAt,
    updatedAt: input.source.updatedAt,
  };

  if (input.source.auth.kind === "none") {
    return {
      sourceRecord,
      credential: null,
      credentialBinding: null,
    };
  }

  const credentialId = input.existingCredentialId
    ?? CredentialIdSchema.make(`cred_${crypto.randomUUID()}`);
  const bindingId = input.existingBindingId ?? `src_cred_bind_${crypto.randomUUID()}`;

  const credential: Credential = {
    id: credentialId,
    workspaceId: input.source.workspaceId,
    authKind: input.source.auth.kind,
    authHeaderName: input.source.auth.headerName,
    authPrefix: input.source.auth.prefix,
    tokenProviderId:
      input.source.auth.kind === "bearer"
        ? input.source.auth.token.providerId
        : input.source.auth.accessToken.providerId,
    tokenHandle:
      input.source.auth.kind === "bearer"
        ? input.source.auth.token.handle
        : input.source.auth.accessToken.handle,
    refreshTokenProviderId:
      input.source.auth.kind === "oauth2" && input.source.auth.refreshToken !== null
        ? input.source.auth.refreshToken.providerId
        : null,
    refreshTokenHandle:
      input.source.auth.kind === "oauth2" && input.source.auth.refreshToken !== null
        ? input.source.auth.refreshToken.handle
        : null,
    createdAt: input.source.createdAt,
    updatedAt: input.source.updatedAt,
  };

  return {
    sourceRecord,
    credential,
    credentialBinding: {
      id: bindingId,
      workspaceId: input.source.workspaceId,
      sourceId: input.source.id,
      credentialId,
      createdAt: input.source.createdAt,
      updatedAt: input.source.updatedAt,
    },
  };
};

export const projectSourceFromStorage = (input: {
  sourceRecord: StoredSourceRecord;
  credentialBinding: SourceCredentialBinding | null;
  credential: Credential | null;
}): Effect.Effect<Source, Error, never> =>
  Effect.gen(function* () {
    const queryParams = yield* parseStringMapJson(
      `queryParamsJson for ${input.sourceRecord.id}`,
      input.sourceRecord.queryParamsJson,
    );
    const headers = yield* parseStringMapJson(
      `headersJson for ${input.sourceRecord.id}`,
      input.sourceRecord.headersJson,
    );
    const defaultHeaders = yield* parseStringMapJson(
      `defaultHeadersJson for ${input.sourceRecord.id}`,
      input.sourceRecord.defaultHeadersJson,
    );

    let auth: SourceAuth = { kind: "none" };
    if (input.credentialBinding !== null) {
      const credential = input.credential;
      if (credential === null) {
        return yield* Effect.fail(
          new Error(`Missing credential ${input.credentialBinding.credentialId} for source ${input.sourceRecord.id}`),
        );
      }

      if (credential.authKind === "bearer") {
        auth = {
          kind: "bearer",
          headerName: credential.authHeaderName,
          prefix: credential.authPrefix,
          token: {
            providerId: credential.tokenProviderId,
            handle: credential.tokenHandle,
          },
        };
      } else {
        auth = {
          kind: "oauth2",
          headerName: credential.authHeaderName,
          prefix: credential.authPrefix,
          accessToken: {
            providerId: credential.tokenProviderId,
            handle: credential.tokenHandle,
          },
          refreshToken:
            credential.refreshTokenProviderId !== null && credential.refreshTokenHandle !== null
              ? {
                  providerId: credential.refreshTokenProviderId,
                  handle: credential.refreshTokenHandle,
                }
              : null,
        };
      }
    }

    return {
      id: input.sourceRecord.id,
      workspaceId: input.sourceRecord.workspaceId,
      name: input.sourceRecord.name,
      kind: input.sourceRecord.kind,
      endpoint: input.sourceRecord.endpoint,
      status: input.sourceRecord.status,
      enabled: input.sourceRecord.enabled,
      namespace: input.sourceRecord.namespace,
      transport: input.sourceRecord.transport,
      queryParams,
      headers,
      specUrl: input.sourceRecord.specUrl,
      defaultHeaders,
      auth,
      sourceHash: input.sourceRecord.sourceHash,
      lastError: input.sourceRecord.lastError,
      createdAt: input.sourceRecord.createdAt,
      updatedAt: input.sourceRecord.updatedAt,
    } satisfies Source;
  }).pipe(
    Effect.mapError((cause) =>
      cause instanceof Error ? cause : new Error(String(cause)),
    ),
  );

export const projectSourcesFromStorage = (input: {
  sourceRecords: ReadonlyArray<StoredSourceRecord>;
  credentialBindings: ReadonlyArray<SourceCredentialBinding>;
  credentials: ReadonlyArray<Credential>;
}): Effect.Effect<ReadonlyArray<Source>, Error, never> => {
  const bindingsBySourceId = new Map(
    input.credentialBindings.map((binding) => [binding.sourceId, binding]),
  );
  const credentialsById = new Map(
    input.credentials.map((credential) => [credential.id, credential]),
  );

  return Effect.forEach(input.sourceRecords, (sourceRecord) => {
    const credentialBinding = bindingsBySourceId.get(sourceRecord.id) ?? null;
    return projectSourceFromStorage({
      sourceRecord,
      credentialBinding,
      credential:
        credentialBinding === null
          ? null
          : credentialsById.get(credentialBinding.credentialId) ?? null,
    });
  });
};