import type {
  Credential,
  SecretRef,
  Source,
  WorkspaceId,
} from "#schema";
import { type SqlControlPlaneRows } from "#persistence";
import * as Effect from "effect/Effect";
import * as Option from "effect/Option";

import {
  projectSourceFromStorage,
  projectSourcesFromStorage,
  splitSourceForStorage,
} from "./source-definitions";
import { createDefaultSecretMaterialDeleter } from "./secret-material-providers";

const credentialSecretRefs = (credential: Credential): ReadonlyArray<SecretRef> => [
  {
    providerId: credential.tokenProviderId,
    handle: credential.tokenHandle,
  },
  ...(credential.refreshTokenProviderId !== null && credential.refreshTokenHandle !== null
    ? [{
        providerId: credential.refreshTokenProviderId,
        handle: credential.refreshTokenHandle,
      } satisfies SecretRef]
    : []),
];

const secretRefKey = (ref: SecretRef): string => `${ref.providerId}:${ref.handle}`;

const cleanupCredentialSecretRefs = (rows: SqlControlPlaneRows, input: {
  previous: Credential | null;
  next: Credential | null;
}) =>
  Effect.gen(function* () {
    if (input.previous === null) {
      return;
    }

    const deleteSecretMaterial = createDefaultSecretMaterialDeleter({ rows });
    const nextRefKeys = new Set(
      (input.next === null ? [] : credentialSecretRefs(input.next)).map(secretRefKey),
    );
    const refsToDelete = credentialSecretRefs(input.previous).filter(
      (ref) => !nextRefKeys.has(secretRefKey(ref)),
    );

    yield* Effect.forEach(
      refsToDelete,
      (ref) => Effect.either(deleteSecretMaterial(ref)),
      { discard: true },
    );
  });

export const loadSourcesInWorkspace = (
  rows: SqlControlPlaneRows,
  workspaceId: WorkspaceId,
) =>
  Effect.gen(function* () {
    const sourceRecords = yield* rows.sources.listByWorkspaceId(workspaceId);
    const credentialBindings = yield* rows.sourceCredentialBindings.listByWorkspaceId(workspaceId);
    const credentials = yield* rows.credentials.listByWorkspaceId(workspaceId);

    return yield* projectSourcesFromStorage({
      sourceRecords,
      credentialBindings,
      credentials,
    });
  });

export const loadSourceById = (rows: SqlControlPlaneRows, input: {
  workspaceId: WorkspaceId;
  sourceId: Source["id"];
}) =>
  Effect.gen(function* () {
    const sourceRecord = yield* rows.sources.getByWorkspaceAndId(
      input.workspaceId,
      input.sourceId,
    );

    if (Option.isNone(sourceRecord)) {
      return yield* Effect.fail(
        new Error(`Source not found: workspaceId=${input.workspaceId} sourceId=${input.sourceId}`),
      );
    }

    const credentialBinding = yield* rows.sourceCredentialBindings.getByWorkspaceAndSourceId(
      input.workspaceId,
      input.sourceId,
    );
    const credential =
      Option.isSome(credentialBinding)
        ? yield* rows.credentials.getById(credentialBinding.value.credentialId)
        : Option.none<Credential>();

    return yield* projectSourceFromStorage({
      sourceRecord: sourceRecord.value,
      credentialBinding: Option.isSome(credentialBinding) ? credentialBinding.value : null,
      credential: Option.isSome(credential) ? credential.value : null,
    });
  });

export const removeCredentialBindingForSource = (rows: SqlControlPlaneRows, input: {
  workspaceId: WorkspaceId;
  sourceId: Source["id"];
}) =>
  Effect.gen(function* () {
    const existingBinding = yield* rows.sourceCredentialBindings.getByWorkspaceAndSourceId(
      input.workspaceId,
      input.sourceId,
    );

    if (Option.isNone(existingBinding)) {
      return false;
    }

    const existingCredential = yield* rows.credentials.getById(existingBinding.value.credentialId);

    yield* rows.sourceCredentialBindings.removeByWorkspaceAndSourceId(
      input.workspaceId,
      input.sourceId,
    );

    if (Option.isSome(existingCredential)) {
      yield* rows.credentials.removeById(existingBinding.value.credentialId);
    }

    yield* cleanupCredentialSecretRefs(rows, {
      previous: Option.isSome(existingCredential) ? existingCredential.value : null,
      next: null,
    });

    return true;
  });

export const removeSourceById = (rows: SqlControlPlaneRows, input: {
  workspaceId: WorkspaceId;
  sourceId: Source["id"];
}) =>
  Effect.gen(function* () {
    yield* rows.sourceAuthSessions.removeByWorkspaceAndSourceId(
      input.workspaceId,
      input.sourceId,
    );
    yield* removeCredentialBindingForSource(rows, input);
    return yield* rows.sources.removeByWorkspaceAndId(input.workspaceId, input.sourceId);
  });

export const persistSource = (rows: SqlControlPlaneRows, source: Source) =>
  Effect.gen(function* () {
    const existing = yield* rows.sources.getByWorkspaceAndId(source.workspaceId, source.id);
    const existingBinding = yield* rows.sourceCredentialBindings.getByWorkspaceAndSourceId(
      source.workspaceId,
      source.id,
    );
    const existingCredential = Option.isSome(existingBinding)
      ? yield* rows.credentials.getById(existingBinding.value.credentialId)
      : Option.none<Credential>();
    const existingCredentialId = Option.isSome(existingBinding)
      ? existingBinding.value.credentialId
      : null;
    const existingBindingId = Option.isSome(existingBinding)
      ? existingBinding.value.id
      : null;
    const { sourceRecord, credential, credentialBinding } = splitSourceForStorage({
      source,
      existingCredentialId,
      existingBindingId,
    });

    if (Option.isNone(existing)) {
      yield* rows.sources.insert(sourceRecord);
    } else {
      const {
        id: _id,
        workspaceId: _workspaceId,
        createdAt: _createdAt,
        sourceDocumentText: _sourceDocumentText,
        ...patch
      } = sourceRecord;
      yield* rows.sources.update(source.workspaceId, source.id, patch);
    }

    if (credential === null || credentialBinding === null) {
      if (Option.isSome(existingBinding)) {
        yield* rows.sourceCredentialBindings.removeByWorkspaceAndSourceId(
          source.workspaceId,
          source.id,
        );

        if (Option.isSome(existingCredential)) {
          yield* rows.credentials.removeById(existingBinding.value.credentialId);
        }
      }
    } else {
      yield* rows.credentials.upsert(credential);
      yield* rows.sourceCredentialBindings.upsert(credentialBinding);
    }

    yield* cleanupCredentialSecretRefs(rows, {
      previous: Option.isSome(existingCredential) ? existingCredential.value : null,
      next: credential,
    });

    return source;
  });