// ---------------------------------------------------------------------------
// Shared OAuth HTTP API — one endpoint set per flow, served at
// `/scopes/:scopeId/oauth/{probe,start,complete,callback}` for every
// plugin that needs OAuth. `pluginId` lives on the request body so the
// completion callback can route to the right plugin at persist time.
// Replaces the four per-plugin copies that lived under
// `/scopes/:scopeId/{mcp,openapi,graphql,google-discovery}/oauth/*`.
// ---------------------------------------------------------------------------

import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema } from "effect/unstable/httpapi";
import { Schema } from "effect";

import {
  OAuthCompleteError,
  OAuthProbeError,
  OAuthSessionNotFoundError,
  OAuthStartError,
  OAuthStrategySchema,
  ScopeId,
  SecretBackedMap,
} from "@executor-js/sdk";

import { InternalError } from "../observability";

const ScopeParams = { scopeId: ScopeId };
// ---------------------------------------------------------------------------
// Probe — decide between dynamic-DCR and paste-your-credentials flows
// ---------------------------------------------------------------------------

const ProbePayload = Schema.Struct({
  endpoint: Schema.String,
  headers: Schema.optional(SecretBackedMap),
  queryParams: Schema.optional(SecretBackedMap),
});

const ProbeResponse = Schema.Struct({
  resourceMetadata: Schema.NullOr(Schema.Record(Schema.String, Schema.Unknown)),
  resourceMetadataUrl: Schema.NullOr(Schema.String),
  authorizationServerMetadata: Schema.NullOr(Schema.Record(Schema.String, Schema.Unknown)),
  authorizationServerMetadataUrl: Schema.NullOr(Schema.String),
  authorizationServerUrl: Schema.NullOr(Schema.String),
  supportsDynamicRegistration: Schema.Boolean,
  isBearerChallengeEndpoint: Schema.Boolean,
});

// ---------------------------------------------------------------------------
// Start — persists an `oauth2_session` row; for user-interactive flows
// returns an authorization URL, for `client-credentials` mints the
// Connection inline and returns it under `completedConnection`.
// ---------------------------------------------------------------------------

const StartPayload = Schema.Struct({
  /** Resource URL — used by probe/display, not by the start flow for
   *  static strategies. */
  endpoint: Schema.String,
  headers: Schema.optional(SecretBackedMap),
  queryParams: Schema.optional(SecretBackedMap),
  /** Where the authorization server will bounce the user's browser
   *  back to. Pass a placeholder (e.g. the token URL) for flows that
   *  don't redirect; the service still persists it. */
  redirectUrl: Schema.String,
  /** Stable id the Connection the exchange will mint. Caller typically
   *  derives this as `${pluginId}-oauth2-${namespace}` so the source
   *  row can be stamped atomically with the flow start. */
  connectionId: Schema.String,
  /** Scope where the resulting Connection + its backing secrets land. */
  tokenScope: Schema.String,
  strategy: OAuthStrategySchema,
  /** Which plugin is initiating the flow. Persisted on the session +
   *  stamped on the minted Connection's identity-label prefix. */
  pluginId: Schema.String,
  /** Human label for the minted Connection. */
  identityLabel: Schema.optional(Schema.String),
});

const StartResponse = Schema.Struct({
  sessionId: Schema.String,
  /** Present for user-interactive strategies. `null` for
   *  `client-credentials` (no redirect). */
  authorizationUrl: Schema.NullOr(Schema.String),
  /** Filled for strategies that mint the Connection inline. */
  completedConnection: Schema.NullOr(Schema.Struct({ connectionId: Schema.String })),
});

// ---------------------------------------------------------------------------
// Complete — exchange the code, mint the Connection, drop the session.
// ---------------------------------------------------------------------------

const CompletePayload = Schema.Struct({
  state: Schema.String,
  code: Schema.optional(Schema.String),
  error: Schema.optional(Schema.String),
});

const CompleteResponse = Schema.Struct({
  connectionId: Schema.String,
  expiresAt: Schema.NullOr(Schema.Number),
  scope: Schema.NullOr(Schema.String),
});

// ---------------------------------------------------------------------------
// Cancel — drop an in-flight session without exchanging.
// ---------------------------------------------------------------------------

const CancelPayload = Schema.Struct({
  sessionId: Schema.String,
  /** Scope that owns the pending OAuth session. Must match start.tokenScope. */
  tokenScope: Schema.String,
});

const CancelResponse = Schema.Struct({
  cancelled: Schema.Boolean,
});

// ---------------------------------------------------------------------------
// OAuth callback — GET with `state` + `code` (or `error`) query params.
// Renders the popup HTML directly; the popup script posts the completion
// result back to the opener via `postMessage` / `BroadcastChannel`.
// ---------------------------------------------------------------------------

const CallbackUrlParams = Schema.Struct({
  state: Schema.String,
  code: Schema.optional(Schema.String),
  error: Schema.optional(Schema.String),
  error_description: Schema.optional(Schema.String),
});

const HtmlResponse = Schema.String.pipe(HttpApiSchema.asText());

// ---------------------------------------------------------------------------
// Group
// ---------------------------------------------------------------------------

export const OAuthApi = HttpApiGroup.make("oauth")
  .add(
    HttpApiEndpoint.post("probe", "/scopes/:scopeId/oauth/probe", {
      params: ScopeParams,
      payload: ProbePayload,
      success: ProbeResponse,
      error: [InternalError, OAuthProbeError],
    }),
  )
  .add(
    HttpApiEndpoint.post("start", "/scopes/:scopeId/oauth/start", {
      params: ScopeParams,
      payload: StartPayload,
      success: StartResponse,
      error: [InternalError, OAuthStartError],
    }),
  )
  .add(
    HttpApiEndpoint.post("complete", "/scopes/:scopeId/oauth/complete", {
      params: ScopeParams,
      payload: CompletePayload,
      success: CompleteResponse,
      error: [InternalError, OAuthCompleteError, OAuthSessionNotFoundError],
    }),
  )
  .add(
    HttpApiEndpoint.post("cancel", "/scopes/:scopeId/oauth/cancel", {
      params: ScopeParams,
      payload: CancelPayload,
      success: CancelResponse,
      error: [InternalError, OAuthSessionNotFoundError],
    }),
  )
  .add(
    HttpApiEndpoint.get("callback", "/oauth/callback", {
      query: CallbackUrlParams,
      success: HtmlResponse,
      error: [InternalError, OAuthCompleteError, OAuthSessionNotFoundError],
    }),
  );