import {
  HttpApiBuilder,
} from "@effect/platform";
import * as Effect from "effect/Effect";
import * as Option from "effect/Option";

import { SecretMaterialIdSchema } from "#schema";
import {
  getLocalInstallation,
} from "../../runtime/local-operations";
import { requireRuntimeLocalWorkspace } from "../../runtime/local-runtime-context";
import {
  createDefaultSecretMaterialDeleter,
  createDefaultSecretMaterialStorer,
  createDefaultSecretMaterialUpdater,
  ENV_SECRET_PROVIDER_ID,
  KEYCHAIN_SECRET_PROVIDER_ID,
  LOCAL_SECRET_PROVIDER_ID,
  parseSecretStoreProviderId,
  resolveDefaultSecretStoreProviderId,
} from "../../runtime/secret-material-providers";
import { RuntimeSourceStoreService } from "../../runtime/source-store";
import { ControlPlaneStore } from "../../runtime/store";
import type {
  CreateSecretResult,
  InstanceConfig,
  SecretProvider,
  UpdateSecretResult,
} from "./api";

import { ControlPlaneApi } from "../api";
import {
  ControlPlaneBadRequestError,
  ControlPlaneNotFoundError,
  ControlPlaneStorageError,
} from "../errors";

const SECRET_STORE_PROVIDER_ENV = "EXECUTOR_SECRET_STORE_PROVIDER";

const getInstanceConfig = (): Effect.Effect<InstanceConfig> => {
  const explicitDefaultStoreProvider =
    parseSecretStoreProviderId(process.env[SECRET_STORE_PROVIDER_ENV]);
  const providers: SecretProvider[] = [
    {
      id: LOCAL_SECRET_PROVIDER_ID,
      name: "Local store",
      canStore: true,
    },
  ];

  if (process.platform === "darwin" || process.platform === "linux") {
    providers.push({
      id: KEYCHAIN_SECRET_PROVIDER_ID,
      name: process.platform === "darwin" ? "macOS Keychain" : "Desktop Keyring",
      canStore:
        process.platform === "darwin"
        || explicitDefaultStoreProvider === KEYCHAIN_SECRET_PROVIDER_ID,
    });
  }

  providers.push({
    id: ENV_SECRET_PROVIDER_ID,
    name: "Environment variable",
    canStore: false,
  });

  return resolveDefaultSecretStoreProviderId({
    storeProviderId: explicitDefaultStoreProvider ?? undefined,
  }).pipe(
    Effect.map((resolvedDefaultStoreProvider) => ({
      platform: process.platform,
      secretProviders: providers,
      defaultSecretStoreProvider: resolvedDefaultStoreProvider,
    })),
  );
};

const storageError = (message: string) =>
  new ControlPlaneStorageError({
    operation: "secrets",
    message,
    details: message,
  });

export const ControlPlaneLocalLive = HttpApiBuilder.group(
  ControlPlaneApi,
  "local",
  (handlers) =>
    handlers
      .handle("installation", () =>
        getLocalInstallation(),
      )
      .handle("config", () =>
        getInstanceConfig(),
      )
        .handle("listSecrets", () =>
          Effect.gen(function* () {
            const store = yield* ControlPlaneStore;
            const sourceStore = yield* RuntimeSourceStoreService;
            const runtimeLocalWorkspace = yield* requireRuntimeLocalWorkspace().pipe(
              Effect.mapError(() => storageError("Failed resolving local workspace.")),
            );
            const rows = yield* store.secretMaterials.listAll().pipe(
              Effect.mapError(() => storageError("Failed listing secrets.")),
            );
            const linkedSourcesMap = yield* sourceStore.listLinkedSecretSourcesInWorkspace(
              runtimeLocalWorkspace.installation.workspaceId,
              {
                actorAccountId: runtimeLocalWorkspace.installation.accountId,
              },
            ).pipe(
              Effect.mapError(() => storageError("Failed loading linked sources.")),
            );
            return rows.map((row) => ({
              ...row,
              linkedSources: linkedSourcesMap.get(row.id) ?? [],
            }));
          }),
      )
      .handle("createSecret", ({ payload }) =>
        Effect.gen(function* () {
          const name = payload.name.trim();
          const value = payload.value;
          const purpose = payload.purpose ?? "auth_material";
          const requestedProviderId = payload.providerId === undefined
            ? null
            : parseSecretStoreProviderId(payload.providerId);

          if (name.length === 0) {
            return yield* Effect.fail(
              new ControlPlaneBadRequestError({
                operation: "secrets.create",
                message: "Secret name is required.",
                details: "Secret name is required.",
              }),
            );
          }
          if (payload.providerId !== undefined && requestedProviderId === null) {
            return yield* Effect.fail(
              new ControlPlaneBadRequestError({
                operation: "secrets.create",
                message: `Unsupported secret provider: ${payload.providerId}`,
                details: `Unsupported secret provider: ${payload.providerId}`,
              }),
            );
          }

          const store = yield* ControlPlaneStore;
          const storeSecretMaterial = createDefaultSecretMaterialStorer({
            rows: store,
            ...(requestedProviderId ? { storeProviderId: requestedProviderId } : {}),
          });
          const ref = yield* storeSecretMaterial({
            name,
            purpose,
            value,
          }).pipe(
            Effect.mapError((cause) => storageError(
              cause instanceof Error ? cause.message : "Failed creating secret.",
            )),
          );
          const secretId = SecretMaterialIdSchema.make(ref.handle);
          const created = yield* store.secretMaterials.getById(secretId).pipe(
            Effect.mapError(() => storageError("Failed loading created secret.")),
          );

          if (Option.isNone(created)) {
            return yield* Effect.fail(storageError(`Created secret not found: ${ref.handle}`));
          }

          return {
            id: created.value.id,
            name: created.value.name,
            providerId: created.value.providerId,
            purpose: created.value.purpose,
            createdAt: created.value.createdAt,
            updatedAt: created.value.updatedAt,
          } satisfies CreateSecretResult;
        }),
      )
      .handle("updateSecret", ({ path, payload }) =>
        Effect.gen(function* () {
          const secretId = SecretMaterialIdSchema.make(path.secretId);
          const store = yield* ControlPlaneStore;

          const existing = yield* store.secretMaterials.getById(secretId).pipe(
            Effect.mapError(() => storageError("Failed looking up secret.")),
          );

          if (Option.isNone(existing)) {
            return yield* Effect.fail(
              new ControlPlaneNotFoundError({
                operation: "secrets.update",
                message: `Secret not found: ${path.secretId}`,
                details: `Secret not found: ${path.secretId}`,
              }),
            );
          }

          const update: { name?: string | null; value?: string } = {};
          if (payload.name !== undefined) update.name = payload.name.trim() || null;
          if (payload.value !== undefined) update.value = payload.value;

          const updateSecretMaterial = createDefaultSecretMaterialUpdater({
            rows: store,
          });
          const updated = yield* updateSecretMaterial({
            ref: {
              providerId: existing.value.providerId,
              handle: existing.value.id,
            },
            ...update,
          }).pipe(
            Effect.mapError(() => storageError("Failed updating secret.")),
          );

          return {
            id: updated.id,
            providerId: updated.providerId,
            name: updated.name,
            purpose: updated.purpose,
            createdAt: updated.createdAt,
            updatedAt: updated.updatedAt,
          } satisfies UpdateSecretResult;
        }),
      )
      .handle("deleteSecret", ({ path }) =>
        Effect.gen(function* () {
          const secretId = SecretMaterialIdSchema.make(path.secretId);
          const store = yield* ControlPlaneStore;

          const existing = yield* store.secretMaterials.getById(secretId).pipe(
            Effect.mapError(() => storageError("Failed looking up secret.")),
          );

          if (Option.isNone(existing)) {
            return yield* Effect.fail(
              new ControlPlaneNotFoundError({
                operation: "secrets.delete",
                message: `Secret not found: ${path.secretId}`,
                details: `Secret not found: ${path.secretId}`,
              }),
            );
          }

          const deleteSecretMaterial = createDefaultSecretMaterialDeleter({
            rows: store,
          });
          const removed = yield* deleteSecretMaterial({
            providerId: existing.value.providerId,
            handle: existing.value.id,
          }).pipe(
            Effect.mapError(() => storageError("Failed removing secret.")),
          );

          if (!removed) {
            return yield* Effect.fail(storageError(`Failed removing secret: ${path.secretId}`));
          }

          return { removed: true };
        }),
      ),
);