import * as Context from "effect/Context";
import * as Crypto from "effect/Crypto";
import * as DateTime from "effect/DateTime";
import * as Effect from "effect/Effect";
import * as Encoding from "effect/Encoding";
import * as Layer from "effect/Layer";
import * as Option from "effect/Option";
import * as Schema from "effect/Schema";
import { and, eq, isNull, ne, notExists } from "drizzle-orm";

import * as RelayDb from "../db.ts";
import { relayEnvironmentCredentials, relayEnvironmentLinks } from "../persistence/schema.ts";

export class EnvironmentCredentialCreatePersistenceError extends Schema.TaggedErrorClass<EnvironmentCredentialCreatePersistenceError>()(
  "EnvironmentCredentialCreatePersistenceError",
  { cause: Schema.Defect() },
) {
  override get message(): string {
    return "Failed to persist environment credential";
  }
}

export class EnvironmentCredentialAuthenticatePersistenceError extends Schema.TaggedErrorClass<EnvironmentCredentialAuthenticatePersistenceError>()(
  "EnvironmentCredentialAuthenticatePersistenceError",
  { cause: Schema.Defect() },
) {
  override get message(): string {
    return "Failed to authenticate environment credential";
  }
}

export class EnvironmentCredentialRevokePersistenceError extends Schema.TaggedErrorClass<EnvironmentCredentialRevokePersistenceError>()(
  "EnvironmentCredentialRevokePersistenceError",
  { cause: Schema.Defect() },
) {
  override get message(): string {
    return "Failed to revoke environment credential";
  }
}

export interface EnvironmentCredentialPrincipal {
  readonly credentialId: string;
  readonly environmentId: string;
  readonly environmentPublicKey: string;
}

export class EnvironmentCredentials extends Context.Service<
  EnvironmentCredentials,
  {
    readonly create: (input: {
      readonly environmentId: string;
      readonly environmentPublicKey: string;
    }) => Effect.Effect<string, EnvironmentCredentialCreatePersistenceError>;
    readonly authenticate: (
      token: string,
    ) => Effect.Effect<
      Option.Option<EnvironmentCredentialPrincipal>,
      EnvironmentCredentialAuthenticatePersistenceError
    >;
    readonly revokeForEnvironmentPublicKey: (input: {
      readonly environmentId: string;
      readonly environmentPublicKey: string;
    }) => Effect.Effect<boolean, EnvironmentCredentialRevokePersistenceError>;
  }
>()("t3code-relay/environments/EnvironmentCredentials") {}

const make = Effect.gen(function* () {
  const db = yield* RelayDb.RelayDb;
  const crypto = yield* Crypto.Crypto;
  const hashToken = (token: string) =>
    crypto
      .digest("SHA-256", new TextEncoder().encode(token))
      .pipe(Effect.map(Encoding.encodeBase64Url));
  const randomTokenPart = (segments: number) =>
    Effect.map(Effect.all(Array.from({ length: segments }, () => crypto.randomUUIDv4)), (values) =>
      values.join("").replaceAll("-", ""),
    );
  const makeCredential = Effect.fnUntraced(function* () {
    const credentialId = yield* randomTokenPart(2);
    const secret = yield* randomTokenPart(3);
    return {
      credentialId,
      token: `t3env_${credentialId}_${secret}`,
    };
  });

  return EnvironmentCredentials.of({
    create: Effect.fn("relay.environment_credentials.create")(
      function* (input) {
        yield* Effect.annotateCurrentSpan({ "relay.environment_id": input.environmentId });
        const credential = yield* makeCredential();
        const credentialHash = yield* hashToken(credential.token);
        const now = DateTime.formatIso(yield* DateTime.now);
        yield* db.insert(relayEnvironmentCredentials).values({
          credentialId: credential.credentialId,
          environmentId: input.environmentId,
          environmentPublicKey: input.environmentPublicKey,
          credentialHash,
          revokedAt: null,
          createdAt: now,
          updatedAt: now,
        });
        yield* db
          .update(relayEnvironmentCredentials)
          .set({
            revokedAt: now,
            updatedAt: now,
          })
          .where(
            and(
              eq(relayEnvironmentCredentials.environmentId, input.environmentId),
              eq(relayEnvironmentCredentials.environmentPublicKey, input.environmentPublicKey),
              ne(relayEnvironmentCredentials.credentialId, credential.credentialId),
              isNull(relayEnvironmentCredentials.revokedAt),
            ),
          );
        return credential.token;
      },
      Effect.mapError((cause) => new EnvironmentCredentialCreatePersistenceError({ cause })),
    ),

    authenticate: Effect.fn("relay.environment_credentials.authenticate")(
      function* (token) {
        const credentialHash = yield* hashToken(token);
        const rows = yield* db
          .select({
            credentialId: relayEnvironmentCredentials.credentialId,
            environmentId: relayEnvironmentCredentials.environmentId,
            environmentPublicKey: relayEnvironmentCredentials.environmentPublicKey,
          })
          .from(relayEnvironmentCredentials)
          .where(
            and(
              eq(relayEnvironmentCredentials.credentialHash, credentialHash),
              isNull(relayEnvironmentCredentials.revokedAt),
            ),
          )
          .limit(1);
        const row = rows[0];
        if (row) {
          yield* Effect.annotateCurrentSpan({ "relay.environment_id": row.environmentId });
        }
        return row
          ? Option.some({
              credentialId: row.credentialId,
              environmentId: row.environmentId,
              environmentPublicKey: row.environmentPublicKey,
            })
          : Option.none();
      },
      Effect.mapError((cause) => new EnvironmentCredentialAuthenticatePersistenceError({ cause })),
    ),

    revokeForEnvironmentPublicKey: Effect.fn(
      "relay.environment_credentials.revoke_for_environment_public_key",
    )(
      function* (input) {
        yield* Effect.annotateCurrentSpan({ "relay.environment_id": input.environmentId });
        const revokedAt = DateTime.formatIso(yield* DateTime.now);
        const rows = yield* db
          .update(relayEnvironmentCredentials)
          .set({
            revokedAt,
            updatedAt: revokedAt,
          })
          .where(
            and(
              eq(relayEnvironmentCredentials.environmentId, input.environmentId),
              eq(relayEnvironmentCredentials.environmentPublicKey, input.environmentPublicKey),
              isNull(relayEnvironmentCredentials.revokedAt),
              notExists(
                db
                  .select({ userId: relayEnvironmentLinks.userId })
                  .from(relayEnvironmentLinks)
                  .where(
                    and(
                      eq(relayEnvironmentLinks.environmentId, input.environmentId),
                      eq(relayEnvironmentLinks.environmentPublicKey, input.environmentPublicKey),
                      isNull(relayEnvironmentLinks.revokedAt),
                    ),
                  ),
              ),
            ),
          )
          .returning({
            credentialId: relayEnvironmentCredentials.credentialId,
          });
        return rows.length > 0;
      },
      Effect.mapError((cause) => new EnvironmentCredentialRevokePersistenceError({ cause })),
    ),
  });
});

export const layer = Layer.effect(EnvironmentCredentials, make);