import * as Effect from "effect/Effect";
import { loadControlPlaneConfig } from "../configuration/control-plane.ts";
import app from "../dist/control-plane/server/worker.js";
import type { Env } from "./config.ts";
import { privateResponse } from "./http-response.ts";
import { handleOAuth } from "./http.ts";
import { handleInstallations } from "./installations.ts";
export { InstallationRegistry } from "./installation-registry.ts";
export { InstallationWorkflow } from "./installation-workflow.ts";
export { AuthVault } from "./vault.ts";
export default {
  fetch(request, env, ctx) {
    return Effect.runPromise(
      Effect.gen(function* () {
        const result =
          (yield* handleInstallations(request, env)) ??
          (yield* handleOAuth(request, env));
        if (result) return result;
        const url = new URL(request.url);
        let origin: string;
        try {
          origin = loadControlPlaneConfig(env).config.publicOrigin;
        } catch {
          return privateResponse(
            new Response("Flarebot publisher OAuth setup is required.", {
              status: 503,
            }),
          );
        }
        if (url.origin !== origin)
          return privateResponse(new Response("Forbidden", { status: 403 }));
        if (url.pathname === "/")
          return privateResponse(
            new Response(null, {
              status: 303,
              headers: { Location: "/connect" },
            }),
          );
        if (url.pathname !== "/connect" || request.method !== "GET")
          return privateResponse(new Response("Not found", { status: 404 }));
        // Public renderer gets only first-party assets. No customer runtime/Agent
        // transports, principal, credentials, metadata, or raw environment in SSR.
        const response = privateResponse(
          yield* Effect.promise(async () =>
            app.fetch!(request, { ASSETS: env.ASSETS }, ctx),
          ),
        );
        // Chromium sends Origin:null on navigation form POSTs from a no-referrer
        // document. Preserve exact-Origin CSRF checks while withholding referrers
        // from Cloudflare and other external origins. Callback responses stay no-referrer.
        response.headers.set("Referrer-Policy", "same-origin");
        return response;
      }),
      { signal: request.signal },
    );
  },
} satisfies ExportedHandler<Env>;