import { Effect } from "effect";

import { definePlugin } from "@executor-js/sdk/core";

import {
  makeConfiguredWorkOSVaultClient,
  type WorkOSVaultClient,
  WorkOSVaultClientInstantiationError,
  type WorkOSVaultCredentials,
} from "./client";
import {
  WORKOS_VAULT_PROVIDER_KEY,
  makeWorkOSVaultSecretProvider,
  makeWorkosVaultStore,
  workosVaultSchema,
  type WorkOSVaultContextForScope,
  type WorkosVaultStore,
} from "./secret-store";

// ---------------------------------------------------------------------------
// Plugin options — either pass a pre-built client (for tests / injection)
// or the WorkOS credentials to build one at startup. An `objectPrefix`
// override is available for multi-tenant installations.
// ---------------------------------------------------------------------------

export interface WorkOSVaultPluginOptions {
  readonly client?: WorkOSVaultClient;
  readonly credentials?: WorkOSVaultCredentials;
  readonly objectPrefix?: string;
  /**
   * Override the default scope-id → vault-context mapping. Each key
   * returned becomes an independent KEK-matching dimension, so hosts
   * whose scope ids have a non-default shape can split them into
   * meaningful fields (user/org/workspace/…) rather than a single
   * opaque string.
   */
  readonly contextForScope?: WorkOSVaultContextForScope;
}

const makeWorkOSVaultExtension = () =>
  ({
    providerKey: WORKOS_VAULT_PROVIDER_KEY,
  }) as const;

export type WorkOSVaultExtension = ReturnType<typeof makeWorkOSVaultExtension>;

// The plugin's typed store is just its metadata-store wrapper. The
// secret provider closes over this store plus the resolved WorkOS
// client; the scope id is threaded in per-call by the executor's
// secrets facade.
type WorkosVaultPluginStore = WorkosVaultStore;

const buildClient = (
  options: WorkOSVaultPluginOptions | undefined,
): Effect.Effect<WorkOSVaultClient, WorkOSVaultClientInstantiationError, never> => {
  if (options?.client) return Effect.succeed(options.client);
  if (options?.credentials) {
    return makeConfiguredWorkOSVaultClient(options.credentials);
  }
  return Effect.fail(
    new WorkOSVaultClientInstantiationError({
      cause: "workosVaultPlugin requires either `client` or `credentials` to be provided",
    }),
  );
};

export const workosVaultPlugin = definePlugin((options?: WorkOSVaultPluginOptions) => ({
  id: "workosVault" as const,
  packageName: "@executor-js/plugin-workos-vault",
  schema: workosVaultSchema,
  storage: (deps): WorkosVaultPluginStore => makeWorkosVaultStore(deps),

  extension: makeWorkOSVaultExtension,

  secretProviders: (ctx) => {
    // Build (or accept) the WorkOS client once at startup. If
    // credentials are bad this throws synchronously via Effect.runSync,
    // which is what we want — the executor fails to start rather
    // than surfacing bad credentials on first secret access.
    const client = Effect.runSync(buildClient(options));
    return [
      makeWorkOSVaultSecretProvider({
        client,
        store: ctx.storage,
        objectPrefix: options?.objectPrefix,
        contextForScope: options?.contextForScope,
      }),
    ];
  },
}));