import * as Effect from "effect/Effect";
export { InstallationWorkflow } from "../../control-plane/installation-workflow.ts";
// EXPLICIT TEST-ONLY network/admin seam. Never exported by a production entry.
import app from "../../control-plane/index.ts";
import { AuthVault as ProductionVault } from "../../control-plane/vault.ts";
import { handleOAuth } from "../../control-plane/http.ts";
import { handleInstallations } from "../../control-plane/installations.ts";
import {
  authenticatedPrincipal,
  readCookie,
  SESSION_COOKIE,
  TRANSACTION_COOKIE,
  vault,
  selectedDeploymentGrant,
} from "../../control-plane/session.ts";
import {
  endpoints,
  type CloudflareFetch,
} from "../../control-plane/cloudflare.ts";
import { decrypt, encrypt, hash } from "../../control-plane/crypto.ts";
import { loadControlPlaneSecrets } from "../../configuration/control-plane.ts";
import type { Env } from "../../control-plane/config.ts";

export { InstallationRegistry } from "../../control-plane/installation-registry.ts";

export class AuthVault extends ProductionVault {
  async fixtureAlarm() {
    await this.ctx.storage.setAlarm(Date.now() + 20);
  }
  async fixtureInspect() {
    return this.ctx.storage.get("record");
  }
  async fixtureExpire() {
    const record = await this.ctx.storage.get<{
      kind: string;
      expiresAt: number;
      iv: string;
      ciphertext: string;
    }>("record");
    if (!record) return;
    const secret = loadControlPlaneSecrets(
      this.env,
    ).credentialEncryptionKey.reveal();
    const value = await Effect.runPromise(
      decrypt<Record<string, unknown>>(
        secret,
        record,
        `${this.ctx.id}:${record.kind}:${record.expiresAt}`,
      ),
    );
    const expiresAt = Date.now() - 1;
    const sealed = await Effect.runPromise(
      encrypt(
        secret,
        { ...value, expiresAt },
        `${this.ctx.id}:${record.kind}:${expiresAt}`,
      ),
    );
    await this.ctx.storage.put("record", {
      kind: record.kind,
      expiresAt,
      ...sealed,
    });
  }
}
const codes = new Map<string, { challenge: string; mode: string }>();
let accountMode = "normal";
let exchangeCount = 0;
let revokedCount = 0;
let lastAuth = { basic: false, post: false, none: false };
const ACCOUNT_A = "a".repeat(32);
const ACCOUNT_B = "b".repeat(32);
export const network: CloudflareFetch = async (input, init) => {
  const url = new URL(
    typeof input === "string"
      ? input
      : input instanceof URL
        ? input.href
        : input.url,
  );
  if (init?.redirect !== "manual" || !init.signal)
    throw new Error("Missing redirect/timeout protection");
  if (url.href === endpoints.token) {
    exchangeCount++;
    const form = new URLSearchParams(String(init.body));
    const registered = codes.get(form.get("code") ?? "");
    codes.delete(form.get("code") ?? "");
    if (
      !registered ||
      registered.challenge !==
        (await Effect.runPromise(hash(form.get("code_verifier") ?? "")))
    )
      return Response.json(
        { error: "invalid_grant", error_description: "private-provider-error" },
        { status: 400 },
      );
    const headers = new Headers(init.headers);
    lastAuth = {
      basic: headers.get("Authorization")?.startsWith("Basic ") ?? false,
      post: form.has("client_secret"),
      none: !headers.has("Authorization") && !form.has("client_secret"),
    };
    const mode = registered.mode;
    if (mode === "network") throw new Error("private-provider-error");
    if (mode === "redirect")
      return new Response("{}", {
        status: 302,
        headers: { Location: "https://evil.example/token" },
      });
    if (mode === "invalid-client")
      return Response.json(
        {
          error: "invalid_client",
          error_description: "private-provider-error",
        },
        { status: 401 },
      );
    if (mode === "invalid-grant")
      return Response.json(
        { error: "invalid_grant", error_description: "private-provider-error" },
        { status: 400 },
      );
    return Response.json({
      access_token: `oauth-secret-sentinel-${mode}`,
      token_type: "Bearer",
      expires_in: mode === "expired" ? 0 : 3600,
      ...(mode === "scope-missing" ? { scope: "account.read" } : {}),
      refresh_token: "refresh-secret-sentinel",
      id_token: "untrusted-id-token-subject",
    });
  }
  if (url.href === endpoints.userinfo) {
    const authorization = new Headers(init?.headers).get("Authorization");
    if (authorization?.endsWith("bad-subject"))
      return Response.json({ email: "untrusted-user@example.com" });
    return Response.json({
      sub: authorization?.endsWith("second-owner")
        ? "verified-second-owner"
        : "verified-userinfo-subject",
      email: "ignored@example.com",
    });
  }
  if (url.origin + url.pathname === endpoints.accounts) {
    if (accountMode === "revoked")
      return Response.json({ success: false }, { status: 401 });
    if (accountMode === "revoked-empty")
      return new Response(null, { status: 401 });
    if (accountMode === "revoked-html")
      return new Response("<html>private-provider-error</html>", {
        status: 401,
      });
    if (accountMode === "empty-zero")
      return Response.json({
        success: true,
        result: [],
        result_info: { total_pages: 0 },
      });
    if (accountMode === "denied")
      return Response.json({ success: false }, { status: 403 });
    if (accountMode === "transient")
      return Response.json(
        { success: false, errors: [{ message: "private-provider-error" }] },
        { status: 503 },
      );
    if (accountMode === "empty")
      return Response.json({
        success: true,
        result: [],
        result_info: { total_pages: 1 },
      });
    if (accountMode === "huge")
      return Response.json({
        success: true,
        result: [],
        result_info: { total_pages: 2000 },
      });
    const page = url.searchParams.get("page");
    return Response.json({
      success: true,
      result:
        page === "1"
          ? [{ id: ACCOUNT_A, name: "Personal account" }]
          : [{ id: ACCOUNT_B, name: "Team account <script>" }],
      result_info: { total_pages: 2 },
    });
  }
  if (url.href === endpoints.revoke) {
    revokedCount++;
    return new Response(null, {
      status: accountMode === "revoke-failed" ? 503 : 200,
    });
  }
  throw new Error("Unexpected Cloudflare host/path");
};
export default {
  async fetch(request, env, ctx) {
    const path = new URL(request.url).pathname;
    if (path.startsWith("/__test__/")) {
      const body =
        request.method === "POST"
          ? ((await request.json()) as Record<string, string>)
          : {};
      if (path === "/__test__/code") {
        codes.set(body.code, {
          challenge: body.challenge,
          mode: body.mode ?? "normal",
        });
        return Response.json({ ok: true });
      }
      if (path === "/__test__/accounts") {
        accountMode = body.mode;
        return Response.json({ ok: true });
      }
      if (path === "/__test__/stats")
        return Response.json({ exchangeCount, revokedCount, lastAuth });
      if (path === "/__test__/expire") {
        const stub = env.AUTH_VAULT.get(
          env.AUTH_VAULT.idFromName(`${body.kind}:${body.ref}`),
        ) as unknown as DurableObjectStub<AuthVault>;
        await stub.fixtureExpire();
        return Response.json({ ok: true });
      }
      if (path === "/__test__/inspect") {
        const principal = await Effect.runPromise(
          authenticatedPrincipal(request, env),
        );
        const stub = env.AUTH_VAULT.get(
          env.AUTH_VAULT.idFromName(`grant:${principal.grantRef}`),
        ) as unknown as DurableObjectStub<AuthVault>;
        return Response.json({
          principal,
          record: await stub.fixtureInspect(),
        });
      }
      if (path === "/__test__/deployment-seam") {
        try {
          const { principal, grant } = await Effect.runPromise(
            selectedDeploymentGrant(request, env, network),
          );
          return Response.json({
            subject: principal.subject,
            accountId: principal.selectedAccountId,
            tokenRemainsServerSide: grant.accessToken.startsWith(
              "oauth-secret-sentinel-",
            ),
          });
        } catch {
          return Response.json({ denied: true }, { status: 403 });
        }
      }
      if (path === "/__test__/alarm") {
        await (
          env.AUTH_VAULT.get(
            env.AUTH_VAULT.idFromName(`transaction:${body.ref}`),
          ) as unknown as DurableObjectStub<AuthVault>
        ).fixtureAlarm();
        return Response.json({ ok: true });
      }
      return new Response(null, { status: 404 });
    }
    return (
      (await Effect.runPromise(handleInstallations(request, env, network))) ??
      (await Effect.runPromise(handleOAuth(request, env, network))) ??
      app.fetch!(request, env, ctx)
    );
  },
} satisfies ExportedHandler<Env>;