import { spawnSync } from 'node:child_process'
import { readFileSync, writeFileSync } from 'node:fs'
import { accountLoginScope } from '../src/auth/integration-oauth-scopes.mjs'

const origin = new URL(process.env.REAMS_PUBLIC_ORIGIN)
const provider = new URL(process.env.VITE_HAPPYVIEW_URL)
if (origin.protocol !== 'https:' || origin.href !== `${origin.origin}/` || origin.username || origin.password) throw new Error('REAMS_PUBLIC_ORIGIN must be a bare HTTPS origin')
if (provider.protocol !== 'https:' || provider.username || provider.password || provider.hash) throw new Error('VITE_HAPPYVIEW_URL must be an HTTPS provider URL')
if (!process.env.VITE_HAPPYVIEW_CLIENT_KEY?.trim() || !process.env.VITE_ATPROTO_OAUTH_SCOPE?.trim()) throw new Error('Provide the public HappyView client key and base OAuth scope at build time')
const callback = `${origin.origin}/oauth-callback.html`
const scope = accountLoginScope(process.env.VITE_ATPROTO_OAUTH_SCOPE)
const result = spawnSync('npm', ['run', 'build:atproto'], {
  stdio: 'inherit', env: { ...process.env, VITE_ATPROTO_CONFIDENTIAL_OAUTH: '1', VITE_ATPROTO_OAUTH_CALLBACK_URL: callback },
})
if (result.error) throw result.error
if (result.status !== 0) process.exit(result.status ?? 1)
if (JSON.parse(readFileSync('dist/atproto/oauth-login-scope.json', 'utf8')).scope !== scope) throw new Error('Compiled login scope disagrees with container configuration')
writeFileSync('dist/atproto/deployment-config.json', JSON.stringify({
  version: 1, clientId: `${origin.origin}/oauth-client-metadata.json`, redirectUri: callback, scope,
  happyviewUrl: provider.href, happyviewClientKey: process.env.VITE_HAPPYVIEW_CLIENT_KEY,
}))