import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema } from "@effect/platform";
import { Schema } from "effect";
import { ScopeId } from "@executor/sdk";
import { InternalError } from "@executor/api";

import {
  OpenApiParseError,
  OpenApiExtractionError,
  OpenApiOAuthError,
} from "../sdk/errors";
import { SpecPreview } from "../sdk/preview";
import { StoredSourceSchema } from "../sdk/store";
import {
  OAuth2Auth,
  OAuth2SourceConfig,
  OpenApiSourceBindingInput,
  OpenApiSourceBindingRef,
} from "../sdk/types";

// ---------------------------------------------------------------------------
// Params
// ---------------------------------------------------------------------------

const scopeIdParam = HttpApiSchema.param("scopeId", ScopeId);
const namespaceParam = HttpApiSchema.param("namespace", Schema.String);
const sourceScopeIdParam = HttpApiSchema.param("sourceScopeId", ScopeId);

// ---------------------------------------------------------------------------
// Payloads
// ---------------------------------------------------------------------------

const AddSpecPayload = Schema.Struct({
  spec: Schema.String,
  name: Schema.optional(Schema.String),
  baseUrl: Schema.optional(Schema.String),
  namespace: Schema.optional(Schema.String),
  headers: Schema.optional(Schema.Record({ key: Schema.String, value: Schema.Unknown })),
  oauth2: Schema.optional(Schema.Union(OAuth2Auth, OAuth2SourceConfig)),
});

const PreviewSpecPayload = Schema.Struct({
  spec: Schema.String,
});

const UpdateSourcePayload = Schema.Struct({
  name: Schema.optional(Schema.String),
  baseUrl: Schema.optional(Schema.String),
  headers: Schema.optional(Schema.Record({ key: Schema.String, value: Schema.Unknown })),
  // Set after a successful re-authenticate to refresh the source's
  // stored OAuth2 metadata.
  oauth2: Schema.optional(Schema.Union(OAuth2Auth, OAuth2SourceConfig)),
});

const UpdateSourceResponse = Schema.Struct({
  updated: Schema.Boolean,
});

const RemoveBindingPayload = Schema.Struct({
  sourceId: Schema.String,
  sourceScope: ScopeId,
  slot: Schema.String,
  scope: ScopeId,
});

// ---------------------------------------------------------------------------
// Responses
// ---------------------------------------------------------------------------

const AddSpecResponse = Schema.Struct({
  toolCount: Schema.Number,
  namespace: Schema.String,
});

// ---------------------------------------------------------------------------
// OAuth payloads / responses
// ---------------------------------------------------------------------------

// Shared identity fields for both OAuth2 flows.
//
// `sourceId` (namespace) pins the resulting Connection *name* to a
// stable per-source value so repeated sign-ins refresh an existing
// row per scope instead of spawning a fresh UUID every click. Both
// flows write at the innermost executor scope by default (per-user
// row, per-user token), which preserves per-user credentials via
// scope-stacked secret shadowing.
//
// `tokenScope` defaults to `ctx.scopes[0].id` (innermost). Callers
// can override — e.g. an admin writing an org-wide shared connection
// — and the SDK validates that the target is in the executor's stack.
const StartOAuthIdentityFields = {
  displayName: Schema.String,
  securitySchemeName: Schema.String,
  tokenUrl: Schema.String,
  clientIdSecretId: Schema.String,
  scopes: Schema.Array(Schema.String),
  tokenScope: Schema.optional(ScopeId),
  connectionId: Schema.optional(Schema.String),
  sourceId: Schema.String,
} as const;

const StartOAuthPayload = Schema.Union(
  Schema.Struct({
    ...StartOAuthIdentityFields,
    flow: Schema.Literal("authorizationCode"),
    authorizationUrl: Schema.String,
    redirectUrl: Schema.String,
    clientSecretSecretId: Schema.optional(Schema.NullOr(Schema.String)),
  }),
  // RFC 6749 §4.4 — no user-interactive step, no session, no popup. The
  // plugin exchanges tokens inline and returns a completed auth. The
  // client_secret is required (the grant is client authentication + token
  // request) and no refresh token is issued (§4.4.3).
  Schema.Struct({
    ...StartOAuthIdentityFields,
    flow: Schema.Literal("clientCredentials"),
    clientSecretSecretId: Schema.String,
  }),
);

const StartOAuthResponse = Schema.Union(
  Schema.Struct({
    flow: Schema.Literal("authorizationCode"),
    sessionId: Schema.String,
    authorizationUrl: Schema.String,
    scopes: Schema.Array(Schema.String),
  }),
  Schema.Struct({
    flow: Schema.Literal("clientCredentials"),
    auth: OAuth2Auth,
    scopes: Schema.Array(Schema.String),
  }),
);

const CompleteOAuthPayload = Schema.Struct({
  state: Schema.String,
  code: Schema.optional(Schema.String),
  error: Schema.optional(Schema.String),
});

const OAuthCallbackUrlParams = Schema.Struct({
  state: Schema.String,
  code: Schema.optional(Schema.String),
  error: Schema.optional(Schema.String),
  error_description: Schema.optional(Schema.String),
});

// HTTP status on the three domain errors lives on their class
// declarations in `../sdk/errors.ts` — see the comment there.

// ---------------------------------------------------------------------------
// Group
//
// Plugin SDK errors (OpenApiParseError, OpenApiExtractionError,
// OpenApiOAuthError) are declared once at the group level via
// `.addError(...)` — every endpoint inherits them. The errors themselves
// carry their HTTP status via `HttpApiSchema.annotations` above, so
// handlers just `return yield* ext.foo(...)` and the schema encodes
// whatever comes out.
//
// 5xx is handled at the API level: `.addError(InternalError)` adds the
// shared opaque 500 surface. Defects are captured + downgraded to it by
// an HttpApiBuilder middleware (see apps/cloud/src/observability.ts).
// StorageError → InternalError translation happens at service wiring
// time via `withCapture(executor)`.
// ---------------------------------------------------------------------------

export class OpenApiGroup extends HttpApiGroup.make("openapi")
  .add(
    HttpApiEndpoint.post("previewSpec")`/scopes/${scopeIdParam}/openapi/preview`
      .setPayload(PreviewSpecPayload)
      .addSuccess(SpecPreview),
  )
  .add(
    HttpApiEndpoint.post("addSpec")`/scopes/${scopeIdParam}/openapi/specs`
      .setPayload(AddSpecPayload)
      .addSuccess(AddSpecResponse),
  )
  .add(
    HttpApiEndpoint.get("getSource")`/scopes/${scopeIdParam}/openapi/sources/${namespaceParam}`
      .addSuccess(Schema.NullOr(StoredSourceSchema)),
  )
  .add(
    HttpApiEndpoint.patch("updateSource")`/scopes/${scopeIdParam}/openapi/sources/${namespaceParam}`
      .setPayload(UpdateSourcePayload)
      .addSuccess(UpdateSourceResponse),
  )
  .add(
    HttpApiEndpoint.get(
      "listSourceBindings",
    )`/scopes/${scopeIdParam}/openapi/sources/${namespaceParam}/base/${sourceScopeIdParam}/bindings`
      .addSuccess(Schema.Array(OpenApiSourceBindingRef)),
  )
  .add(
    HttpApiEndpoint.post("setSourceBinding")`/scopes/${scopeIdParam}/openapi/source-bindings`
      .setPayload(OpenApiSourceBindingInput)
      .addSuccess(OpenApiSourceBindingRef),
  )
  .add(
    HttpApiEndpoint.post("removeSourceBinding")`/scopes/${scopeIdParam}/openapi/source-bindings/remove`
      .setPayload(RemoveBindingPayload)
      .addSuccess(Schema.Struct({ removed: Schema.Boolean })),
  )
  .add(
    HttpApiEndpoint.post("startOAuth")`/scopes/${scopeIdParam}/openapi/oauth/start`
      .setPayload(StartOAuthPayload)
      .addSuccess(StartOAuthResponse),
  )
  .add(
    HttpApiEndpoint.post("completeOAuth")`/scopes/${scopeIdParam}/openapi/oauth/complete`
      .setPayload(CompleteOAuthPayload)
      .addSuccess(OAuth2Auth),
  )
  .add(
    HttpApiEndpoint.get("oauthCallback", "/openapi/oauth/callback")
      .setUrlParams(OAuthCallbackUrlParams)
      .addSuccess(
        Schema.Unknown.annotations(
          HttpApiSchema.annotations({ contentType: "text/html" }),
        ),
      ),
  )
  // Errors declared once at the group level — every endpoint inherits.
  // Plugin domain errors carry their own HttpApiSchema status (4xx);
  // `InternalError` is the shared opaque 500 translated at the HTTP
  // edge by `withCapture`.
  .addError(InternalError)
  .addError(OpenApiParseError)
  .addError(OpenApiExtractionError)
  .addError(OpenApiOAuthError) {}