// ---------------------------------------------------------------------------
// Cloud API — non-protected (auth) endpoints + org-protected executor endpoints
// ---------------------------------------------------------------------------

import { env } from "cloudflare:workers";
import * as Sentry from "@sentry/cloudflare";
import {
  HttpApiBuilder,
  HttpApiSwagger,
  HttpMiddleware,
  HttpRouter,
  HttpServer,
} from "@effect/platform";
import { Effect, Layer } from "effect";
import { Autumn } from "autumn-js";
import { autumnHandler } from "autumn-js/backend";

import { CoreExecutorApi } from "@executor/api";
import { CoreHandlers, ExecutorService, ExecutionEngineService } from "@executor/api/server";
import { createExecutionEngine } from "@executor/execution";
import { makeDynamicWorkerExecutor, type CodeExecutor } from "@executor/runtime-dynamic-worker";
import {
  OpenApiGroup,
  OpenApiExtensionService,
  OpenApiHandlers,
} from "@executor/plugin-openapi/api";
import { McpGroup, McpExtensionService, McpHandlers } from "@executor/plugin-mcp/api";
import {
  GoogleDiscoveryGroup,
  GoogleDiscoveryExtensionService,
  GoogleDiscoveryHandlers,
} from "@executor/plugin-google-discovery/api";
import {
  GraphqlGroup,
  GraphqlExtensionService,
  GraphqlHandlers,
} from "@executor/plugin-graphql/api";

import { OrgAuth } from "./auth/middleware";
import { OrgAuthLive, SessionAuthLive } from "./auth/middleware-live";
import { UserStoreService } from "./auth/context";
import {
  CloudAuthPublicHandlers,
  CloudSessionAuthHandlers,
  NonProtectedApi,
} from "./auth/handlers";
import { WorkOSAuth } from "./auth/workos";
import { DbService } from "./services/db";
import { createOrgExecutor } from "./services/executor";
import { TeamOrgApi } from "./team/compose";
import { TeamHandlers } from "./team/handlers";
import { TelemetryLive } from "./services/telemetry";
import { server } from "./env";

// ---------------------------------------------------------------------------
// API definitions
// ---------------------------------------------------------------------------

/** Protected (org-required) API — all the executor groups + OrgAuth middleware */
const ProtectedCloudApi = CoreExecutorApi.add(OpenApiGroup)
  .add(McpGroup)
  .add(GoogleDiscoveryGroup)
  .add(GraphqlGroup)
  .middleware(OrgAuth);

// ---------------------------------------------------------------------------
// Layers
// ---------------------------------------------------------------------------

const DbLive = DbService.Live;
const UserStoreLive = UserStoreService.Live.pipe(Layer.provide(DbLive));

const SharedServices = Layer.mergeAll(
  DbLive,
  UserStoreLive,
  WorkOSAuth.Default,
  HttpServer.layerContext,
).pipe(Layer.provideMerge(TelemetryLive));
const ProtectedCloudApiLive = HttpApiBuilder.api(ProtectedCloudApi).pipe(
  Layer.provide(
    Layer.mergeAll(
      CoreHandlers,
      OpenApiHandlers,
      McpHandlers,
      GoogleDiscoveryHandlers,
      GraphqlHandlers,
      OrgAuthLive,
    ),
  ),
);

const NonProtectedApiLive = HttpApiBuilder.api(NonProtectedApi).pipe(
  Layer.provide(Layer.mergeAll(CloudAuthPublicHandlers, CloudSessionAuthHandlers)),
  Layer.provideMerge(SessionAuthLive),
);

const TeamApiLive = HttpApiBuilder.api(TeamOrgApi).pipe(
  Layer.provide(TeamHandlers),
  Layer.provideMerge(OrgAuthLive),
);

// ---------------------------------------------------------------------------
// Public auth web handler
// ---------------------------------------------------------------------------
//
// Build per-request, not once at module load. `toWebHandler` creates a
// single long-lived `Layer.MemoMap` that memoizes `DbService.Live`'s
// `Layer.scoped` acquire — the resulting `sql` connection is created in
// the module scope, not the request scope. Workerd tears down TCP sockets
// at request boundaries, so the second request on a cached handler fails
// with "Cannot perform I/O on behalf of a different request". Building a
// fresh handler per request gives each request its own layer scope and a
// fresh socket. Auth endpoints (login/callback/me/logout) are infrequent
// so the overhead is negligible.
// ---------------------------------------------------------------------------

const RouterConfig = HttpRouter.setRouterConfig({ maxParamLength: 1000 });

const createNonProtectedHandler = () =>
  HttpApiBuilder.toWebHandler(
    NonProtectedApiLive.pipe(Layer.provideMerge(SharedServices), Layer.provideMerge(RouterConfig)),
    { middleware: HttpMiddleware.logger },
  );

const createTeamHandler = () =>
  HttpApiBuilder.toWebHandler(
    TeamApiLive.pipe(Layer.provideMerge(SharedServices), Layer.provideMerge(RouterConfig)),
    { middleware: HttpMiddleware.logger },
  );

// ---------------------------------------------------------------------------
// Protected handler — must be built per-request because the executor varies
// ---------------------------------------------------------------------------

const buildProtectedHandler = (
  organizationId: string,
  organizationName: string,
  codeExecutor: CodeExecutor,
) =>
  Effect.gen(function* () {
    const executor = yield* createOrgExecutor(
      organizationId,
      organizationName,
      server.ENCRYPTION_KEY,
    );

    const engine = createExecutionEngine({ executor, codeExecutor });

    const requestServices = Layer.mergeAll(
      Layer.succeed(ExecutorService, executor),
      Layer.succeed(ExecutionEngineService, engine),
      Layer.succeed(OpenApiExtensionService, executor.openapi),
      Layer.succeed(McpExtensionService, executor.mcp),
      Layer.succeed(GoogleDiscoveryExtensionService, executor.googleDiscovery),
      Layer.succeed(GraphqlExtensionService, executor.graphql),
    );

    return HttpApiBuilder.toWebHandler(
      HttpApiSwagger.layer({ path: "/docs" }).pipe(
        Layer.provideMerge(HttpApiBuilder.middlewareOpenApi()),
        Layer.provideMerge(ProtectedCloudApiLive),
        Layer.provideMerge(requestServices),
        Layer.provideMerge(SharedServices),
        Layer.provideMerge(HttpRouter.setRouterConfig({ maxParamLength: 1000 })),
      ),
      { middleware: HttpMiddleware.logger },
    );
  });

// ---------------------------------------------------------------------------
// Routing
// ---------------------------------------------------------------------------

const isAuthPath = (pathname: string): boolean => pathname.startsWith("/auth/");
const isAutumnPath = (pathname: string): boolean => pathname.startsWith("/autumn/");
const isTeamPath = (pathname: string): boolean => pathname.startsWith("/team/");
const isExecutionPath = (pathname: string): boolean =>
  pathname === "/executions" || /^\/executions\/[^/]+\/resume$/.test(pathname);

// ---------------------------------------------------------------------------
// Autumn billing — lazy-initialized SDK for fire-and-forget tracking
// ---------------------------------------------------------------------------

let _autumn: Autumn | null = null;
const getAutumn = () => {
  if (!_autumn && server.AUTUMN_SECRET_KEY) {
    _autumn = new Autumn({ secretKey: server.AUTUMN_SECRET_KEY });
  }
  return _autumn;
};

/**
 * Resolve the user's organization for executor creation. Reads from the
 * session cookie via WorkOS — returns null if there's no session or no
 * organization yet, so the caller can return a 403.
 */
const lookupOrgForRequest = (request: Request) =>
  Effect.gen(function* () {
    const workos = yield* WorkOSAuth;
    const result = yield* workos.authenticateRequest(request);
    if (!result || !result.organizationId) return null;
    const users = yield* UserStoreService;
    return yield* users.use((s) => s.getOrganization(result.organizationId!));
  });

// ---------------------------------------------------------------------------
// Autumn billing proxy — authenticates the session, then forwards to Autumn
// ---------------------------------------------------------------------------

const handleAutumnRequest = async (request: Request): Promise<Response> => {
  const program = Effect.gen(function* () {
    const workos = yield* WorkOSAuth;
    const result = yield* workos.authenticateRequest(request);

    if (!result || !result.organizationId) {
      return Response.json({ error: "Unauthorized" }, { status: 401 });
    }

    const url = new URL(request.url);
    const body =
      request.method !== "GET" && request.method !== "HEAD"
        ? yield* Effect.promise(() => request.json())
        : undefined;

    const { statusCode, response } = yield* Effect.promise(() =>
      autumnHandler({
        request: {
          url: url.pathname,
          method: request.method,
          body,
        },
        customerId: result.organizationId,
        customerData: {
          name: result.email,
          email: result.email,
        },
        clientOptions: {
          secretKey: server.AUTUMN_SECRET_KEY,
        },
        pathPrefix: "/autumn",
      }),
    );

    if (statusCode >= 400) {
      console.error("[autumn] upstream error:", statusCode, response);
      return Response.json({ error: "Billing request failed" }, { status: statusCode });
    }

    return Response.json(response, { status: statusCode });
  });

  return Effect.runPromise(program.pipe(Effect.provide(SharedServices), Effect.scoped)).catch(
    (err) => {
      Sentry.captureException(err);
      console.error("[autumn] request failed:", err instanceof Error ? err.stack : err);
      return Response.json({ error: "Internal server error" }, { status: 500 });
    },
  );
};

// ---------------------------------------------------------------------------
// Widget token endpoint — returns a WorkOS widget token for the session user
// ---------------------------------------------------------------------------

// ---------------------------------------------------------------------------
// Sentry tunnel — proxies client events to Sentry to bypass ad blockers
// ---------------------------------------------------------------------------

const SENTRY_HOST = "o4511196985556992.ingest.us.sentry.io";
const SENTRY_PROJECT_IDS = new Set(["4511197001416704", "4511197010067456"]);

const handleSentryTunnel = async (request: Request): Promise<Response> => {
  try {
    const body = await request.text();
    const header = body.split("\n")[0];
    const { dsn } = JSON.parse(header) as { dsn: string };
    const url = new URL(dsn);
    const projectId = url.pathname.replace("/", "");

    if (url.host !== SENTRY_HOST || !SENTRY_PROJECT_IDS.has(projectId)) {
      return new Response("Invalid Sentry DSN", { status: 400 });
    }

    return fetch(`https://${SENTRY_HOST}/api/${projectId}/envelope/`, {
      method: "POST",
      body,
    });
  } catch {
    return new Response("Invalid request", { status: 400 });
  }
};

export const handleApiRequest = async (request: Request): Promise<Response> => {
  const pathname = new URL(request.url).pathname;

  if (pathname === "/sentry-tunnel" && request.method === "POST") {
    return handleSentryTunnel(request);
  }

  if (isTeamPath(pathname)) {
    const handler = createTeamHandler();
    try {
      return await handler.handler(request);
    } finally {
      await handler.dispose();
    }
  }

  if (isAutumnPath(pathname)) {
    return handleAutumnRequest(request);
  }

  if (isAuthPath(pathname)) {
    const handler = createNonProtectedHandler();
    try {
      return await handler.handler(request);
    } finally {
      await handler.dispose();
    }
  }

  // Protected path — build the executor lazily for the request's org.
  try {
    const program = Effect.gen(function* () {
      const org = yield* lookupOrgForRequest(request);
      if (!org) return null;

      const codeExecutor = makeDynamicWorkerExecutor({ loader: env.LOADER });
      const handler = yield* buildProtectedHandler(org.id, org.name, codeExecutor);
      const response = yield* Effect.promise(() => handler.handler(request));

      // Sanitize error responses — only let declared API errors through,
      // replace anything else with a generic message to prevent leaking internals
      if (!response.ok) {
        const sanitized = yield* Effect.promise(async () => {
          try {
            const body = await response.clone().json();
            const hasTag = body && typeof body === "object" && "_tag" in body;
            if (!hasTag) {
              Sentry.captureMessage(`API ${response.status}: ${pathname}`, { level: "error" });
              return Response.json(
                { error: "Internal server error" },
                { status: response.status >= 500 ? 500 : response.status },
              );
            }
          } catch {
            Sentry.captureMessage(`API ${response.status}: ${pathname}`, { level: "error" });
            return Response.json({ error: "Internal server error" }, { status: 500 });
          }
          return null;
        });
        if (sanitized) return { response: sanitized, orgId: org.id };
      }

      return { response, orgId: org.id };
    });

    const result = await Effect.runPromise(
      program.pipe(Effect.provide(SharedServices), Effect.scoped),
    );

    if (result === null) {
      return Response.json(
        { error: "No organization in session", code: "no_organization" },
        { status: 403 },
      );
    }

    // Fire-and-forget: track execution usage
    if (isExecutionPath(pathname) && result.response.ok) {
      const autumn = getAutumn();
      if (autumn) {
        autumn
          .track({
            customerId: result.orgId,
            featureId: "executions",
            value: 1,
          })
          .catch((err) => {
            console.error("[billing] track failed:", err);
          });
      }
    }

    return result.response;
  } catch (err) {
    Sentry.captureException(err);
    console.error("[api] request failed:", err instanceof Error ? err.stack : err);
    return Response.json({ error: "Internal server error" }, { status: 500 });
  }
};