// ---------------------------------------------------------------------------
// Cloud API — non-protected (auth) endpoints + org-protected executor endpoints
// ---------------------------------------------------------------------------

import { env } from "cloudflare:workers";
import {
  HttpApiBuilder,
  HttpApiSwagger,
  HttpMiddleware,
  HttpRouter,
  HttpServer,
} from "@effect/platform";
import { Effect, Layer } from "effect";

import { CoreExecutorApi } from "@executor/api";
import { CoreHandlers, ExecutorService, ExecutionEngineService } from "@executor/api/server";
import { createExecutionEngine } from "@executor/execution";
import { makeDynamicWorkerExecutor, type CodeExecutor } from "@executor/runtime-dynamic-worker";
import {
  OpenApiGroup,
  OpenApiExtensionService,
  OpenApiHandlers,
} from "@executor/plugin-openapi/api";
import { McpGroup, McpExtensionService, McpHandlers } from "@executor/plugin-mcp/api";
import {
  GoogleDiscoveryGroup,
  GoogleDiscoveryExtensionService,
  GoogleDiscoveryHandlers,
} from "@executor/plugin-google-discovery/api";
import {
  GraphqlGroup,
  GraphqlExtensionService,
  GraphqlHandlers,
} from "@executor/plugin-graphql/api";

import { OrgAuth } from "./auth/middleware";
import { OrgAuthLive, SessionAuthLive } from "./auth/middleware-live";
import { UserStoreService } from "./auth/context";
import {
  CloudAuthPublicHandlers,
  CloudSessionAuthHandlers,
  NonProtectedApi,
} from "./auth/handlers";
import { WorkOSAuth } from "./auth/workos";
import { DbService } from "./services/db";
import { createOrgExecutor } from "./services/executor";
import { server } from "./env";

// ---------------------------------------------------------------------------
// API definitions
// ---------------------------------------------------------------------------

/** Protected (org-required) API — all the executor groups + OrgAuth middleware */
const ProtectedCloudApi = CoreExecutorApi.add(OpenApiGroup)
  .add(McpGroup)
  .add(GoogleDiscoveryGroup)
  .add(GraphqlGroup)
  .middleware(OrgAuth);

// ---------------------------------------------------------------------------
// Layers
// ---------------------------------------------------------------------------

const DbLive = DbService.Live;
const UserStoreLive = UserStoreService.Live.pipe(Layer.provide(DbLive));

const SharedServices = Layer.mergeAll(
  DbLive,
  UserStoreLive,
  WorkOSAuth.Default,
  HttpServer.layerContext,
);
const ProtectedCloudApiLive = HttpApiBuilder.api(ProtectedCloudApi).pipe(
  Layer.provide(
    Layer.mergeAll(
      CoreHandlers,
      OpenApiHandlers,
      McpHandlers,
      GoogleDiscoveryHandlers,
      GraphqlHandlers,
      OrgAuthLive,
    ),
  ),
);

const NonProtectedApiLive = HttpApiBuilder.api(NonProtectedApi).pipe(
  Layer.provide(Layer.mergeAll(CloudAuthPublicHandlers, CloudSessionAuthHandlers)),
  Layer.provideMerge(SessionAuthLive),
);

// ---------------------------------------------------------------------------
// Public auth web handler
// ---------------------------------------------------------------------------
//
// Build per-request, not once at module load. `toWebHandler` creates a
// single long-lived `Layer.MemoMap` that memoizes `DbService.Live`'s
// `Layer.scoped` acquire — the resulting `sql` connection is created in
// the module scope, not the request scope. Workerd tears down TCP sockets
// at request boundaries, so the second request on a cached handler fails
// with "Cannot perform I/O on behalf of a different request". Building a
// fresh handler per request gives each request its own layer scope and a
// fresh socket. Auth endpoints (login/callback/me/logout) are infrequent
// so the overhead is negligible.
// ---------------------------------------------------------------------------

const RouterConfig = HttpRouter.setRouterConfig({ maxParamLength: 1000 });

const createNonProtectedHandler = () =>
  HttpApiBuilder.toWebHandler(
    NonProtectedApiLive.pipe(Layer.provideMerge(SharedServices), Layer.provideMerge(RouterConfig)),
    { middleware: HttpMiddleware.logger },
  );

// ---------------------------------------------------------------------------
// Protected handler — must be built per-request because the executor varies
// ---------------------------------------------------------------------------

const buildProtectedHandler = (
  organizationId: string,
  organizationName: string,
  codeExecutor: CodeExecutor,
) =>
  Effect.gen(function* () {
    const executor = yield* createOrgExecutor(
      organizationId,
      organizationName,
      server.ENCRYPTION_KEY,
    );

    const engine = createExecutionEngine({ executor, codeExecutor });

    const requestServices = Layer.mergeAll(
      Layer.succeed(ExecutorService, executor),
      Layer.succeed(ExecutionEngineService, engine),
      Layer.succeed(OpenApiExtensionService, executor.openapi),
      Layer.succeed(McpExtensionService, executor.mcp),
      Layer.succeed(GoogleDiscoveryExtensionService, executor.googleDiscovery),
      Layer.succeed(GraphqlExtensionService, executor.graphql),
    );

    return HttpApiBuilder.toWebHandler(
      HttpApiSwagger.layer({ path: "/docs" }).pipe(
        Layer.provideMerge(HttpApiBuilder.middlewareOpenApi()),
        Layer.provideMerge(ProtectedCloudApiLive),
        Layer.provideMerge(requestServices),
        Layer.provideMerge(SharedServices),
        Layer.provideMerge(HttpRouter.setRouterConfig({ maxParamLength: 1000 })),
      ),
      { middleware: HttpMiddleware.logger },
    );
  });

// ---------------------------------------------------------------------------
// Routing
// ---------------------------------------------------------------------------

const isAuthPath = (pathname: string): boolean => pathname.startsWith("/auth/");

/**
 * Resolve the user's organization for executor creation. Reads from the
 * session cookie via WorkOS — returns null if there's no session or no
 * organization yet, so the caller can return a 403.
 */
const lookupOrgForRequest = (request: Request) =>
  Effect.gen(function* () {
    const workos = yield* WorkOSAuth;
    const result = yield* workos.authenticateRequest(request);
    if (!result || !result.organizationId) return null;
    const users = yield* UserStoreService;
    return yield* users.use((s) => s.getOrganization(result.organizationId!));
  });

export const handleApiRequest = async (request: Request): Promise<Response> => {
  const pathname = new URL(request.url).pathname;

  if (isAuthPath(pathname)) {
    const handler = createNonProtectedHandler();
    try {
      return await handler.handler(request);
    } finally {
      await handler.dispose();
    }
  }

  // Protected path — build the executor lazily for the request's org.
  try {
    const program = Effect.gen(function* () {
      const org = yield* lookupOrgForRequest(request);
      if (!org) return null;

      const codeExecutor = makeDynamicWorkerExecutor({ loader: env.LOADER });
      const handler = yield* buildProtectedHandler(org.id, org.name, codeExecutor);
      return yield* Effect.promise(() => handler.handler(request));
    });

    const result = await Effect.runPromise(
      program.pipe(Effect.provide(SharedServices), Effect.scoped),
    );

    if (result === null) {
      return Response.json(
        { error: "No organization in session", code: "no_organization" },
        { status: 403 },
      );
    }
    return result;
  } catch (err) {
    console.error("[api] request failed:", err instanceof Error ? err.stack : err);
    return Response.json(
      { error: err instanceof Error ? err.message : "Internal server error" },
      { status: 500 },
    );
  }
};