import { Effect } from "effect";

import { definePlugin } from "@executor-js/sdk/core";

import {
  makeConfiguredWorkOSVaultClient,
  type WorkOSVaultClient,
  type WorkOSVaultCredentials,
} from "./client";
import {
  WORKOS_VAULT_PROVIDER_KEY,
  makeWorkOSVaultSecretProvider,
  makeWorkosVaultStore,
  workosVaultSchema,
  type WorkOSVaultContextForScope,
  type WorkosVaultStore,
} from "./secret-store";

// ---------------------------------------------------------------------------
// Plugin options — either pass a pre-built client (for tests / injection)
// or the WorkOS credentials to build one at startup. An `objectPrefix`
// override is available for multi-tenant installations.
// ---------------------------------------------------------------------------

export interface WorkOSVaultPluginOptions {
  readonly client?: WorkOSVaultClient;
  readonly credentials?: WorkOSVaultCredentials;
  readonly objectPrefix?: string;
  /**
   * Override the default scope-id → vault-context mapping. Each key
   * returned becomes an independent KEK-matching dimension, so hosts
   * whose scope ids have a non-default shape can split them into
   * meaningful fields (user/org/workspace/…) rather than a single
   * opaque string.
   */
  readonly contextForScope?: WorkOSVaultContextForScope;
}

export interface WorkOSVaultExtension {
  readonly providerKey: typeof WORKOS_VAULT_PROVIDER_KEY;
}

// The plugin's typed store is just its metadata-store wrapper. The
// secret provider closes over this store plus the resolved WorkOS
// client; the scope id is threaded in per-call by the executor's
// secrets facade.
type WorkosVaultPluginStore = WorkosVaultStore;

const buildClient = (
  options: WorkOSVaultPluginOptions | undefined,
): Effect.Effect<WorkOSVaultClient, Error, never> => {
  if (options?.client) return Effect.succeed(options.client);
  if (options?.credentials) {
    return makeConfiguredWorkOSVaultClient(options.credentials);
  }
  return Effect.fail(
    new Error(
      "workosVaultPlugin requires either `client` or `credentials` to be provided",
    ),
  );
};

export const workosVaultPlugin = definePlugin(
  (options?: WorkOSVaultPluginOptions) => ({
    id: "workosVault" as const,
    packageName: "@executor-js/plugin-workos-vault",
    schema: workosVaultSchema,
    storage: (deps): WorkosVaultPluginStore => makeWorkosVaultStore(deps),

    extension: (_ctx): WorkOSVaultExtension => ({
      providerKey: WORKOS_VAULT_PROVIDER_KEY,
    }),

    secretProviders: (ctx) => {
      // Build (or accept) the WorkOS client once at startup. If
      // credentials are bad this throws synchronously via Effect.runSync,
      // which is what we want — the executor fails to start rather
      // than surfacing bad credentials on first secret access.
      const client = Effect.runSync(buildClient(options));
      return [
        makeWorkOSVaultSecretProvider({
          client,
          store: ctx.storage,
          objectPrefix: options?.objectPrefix,
          contextForScope: options?.contextForScope,
        }),
      ];
    },
  }),
);