// Protected-side API wiring. Kept separate from `./layers.ts` so tests
// can import the protected API + shared services without dragging in
// non-protected/org handlers (which transitively import
// `@tanstack/react-start`, unresolvable in the Workers test runtime).

import { HttpApiBuilder } from "effect/unstable/httpapi";
import { HttpRouter, HttpServer } from "effect/unstable/http";
import { Layer } from "effect";

import { observabilityMiddleware } from "@executor-js/api";
import {
  CoreHandlers,
  composePluginApi,
  composePluginHandlerLayer,
} from "@executor-js/api/server";

import { cloudPlugins } from "./cloud-plugins";
import { UserStoreService } from "../auth/context";
import { WorkOSAuth } from "../auth/workos";
import { AutumnService } from "../services/autumn";
import { DbService } from "../services/db";
import { ErrorCaptureLive } from "../observability";

// `ProtectedCloudApi` deliberately does NOT declare `.middleware(OrgAuth)`
// — auth + per-request execution stack construction live in a single
// `HttpRouter` middleware (`ExecutionStackMiddleware` in `./protected.ts`)
// which has the right ordering to provide `AuthContext` AND the executor
// services to handlers. Putting auth on the API as `HttpApiMiddleware` ran
// it INSIDE the router middleware (wrong order), and added a second auth
// pass on top of the existing one in `protected.ts`'s outer effect. The
// router-middleware approach folds both into one place.
//
// `composePluginApi(cloudPlugins)` returns a precisely typed `HttpApi`
// — the group union is derived from `typeof cloudPlugins` via the
// plugin spec's `TGroup` generic. Test harness clients type via
// `HttpApiClient.ForApi<typeof ProtectedCloudApi>` directly, with no
// per-plugin Group imports at the host.
export const ProtectedCloudApi = composePluginApi(cloudPlugins);

const ObservabilityLive = observabilityMiddleware(ProtectedCloudApi);

const DbLive = DbService.Live;
const UserStoreLive = UserStoreService.Live.pipe(Layer.provide(DbLive));

export const SharedServices = Layer.mergeAll(
  DbLive,
  UserStoreLive,
  WorkOSAuth.Default,
  AutumnService.Default,
  HttpServer.layerServices,
);

export const RouterConfig = Layer.succeed(HttpRouter.RouterConfig)({ maxParamLength: 1000 });

// Every handler the ProtectedCloudApi routes to. Plugin handler layers
// are late-binding — they require their plugin's `extensionService`
// Tag, which the per-request `ExecutionStackMiddleware` satisfies via
// `providePluginExtensions`. The test harness mirrors this; nothing
// else needs to know which plugins are wired.
export const ProtectedCloudApiHandlers = Layer.mergeAll(
  CoreHandlers,
  composePluginHandlerLayer(cloudPlugins),
);

// `ErrorCaptureLive` is provided above the handler + middleware layers
// so the `withCapture` translation path (typed-channel `StorageError →
// InternalError(traceId)`) AND the observability middleware's defect
// catchall both see the same Sentry-backed implementation.
export const ProtectedCloudApiLive = HttpApiBuilder.layer(ProtectedCloudApi).pipe(
  Layer.provide(Layer.mergeAll(ProtectedCloudApiHandlers, ObservabilityLive)),
  Layer.provide(ErrorCaptureLive),
);