import type { OAuthUserAgent } from "@atcute/oauth-browser-client";
import { mintServiceAuth, serviceDidForHost } from "#lib/auth/agent.ts";
import { buildUrl, toResponseError } from "#lib/api/_request.ts";
import type { QueryValue, XrpcRequestInit } from "#lib/api/client.ts";
import type { Did, Nsid } from "#lib/api/syntax.ts";
import type { Fetch } from "#lib/fetch.ts";

// Authenticated client for deliberi's org.tangled.temp.* xrpc methods.
// Calls are authed with an atproto service-auth jwt: the browser mints a
// per-call token via the user's pds (getServiceAuth), scoped to the method
// (lxm) and deliberi's did:web (aud).
export interface DeliberiContext {
	readonly serviceUrl: string;
	readonly aud: Did;
	readonly agent: OAuthUserAgent;
	readonly fetch: Fetch;
}

export interface CreateDeliberiOptions {
	deliberiUrl: string;
	agent: OAuthUserAgent;
	fetch?: Fetch;
}

export const createDeliberiClient = ({
	deliberiUrl,
	agent,
	fetch
}: CreateDeliberiOptions): DeliberiContext => {
	const serviceUrl = deliberiUrl.replace(/\/+$/, "");
	// aud is derived from the url hostname so it can't drift from
	// deliberi's DELIBERI_HOSTNAME — both must match for service auth.
	const aud = serviceDidForHost(new URL(serviceUrl).host);
	return { serviceUrl, aud, agent, fetch: fetch ?? globalThis.fetch };
};

const authHeader = async (ctx: DeliberiContext, nsid: Nsid): Promise<string> => {
	const token = await mintServiceAuth(ctx.agent, { aud: ctx.aud, lxm: nsid });
	return `Bearer ${token}`;
};

export const authedGet = async <T>(
	ctx: DeliberiContext,
	nsid: Nsid,
	params?: Record<string, QueryValue>,
	init?: XrpcRequestInit
): Promise<T> => {
	const response = await ctx.fetch(buildUrl(ctx.serviceUrl, nsid, params), {
		headers: {
			accept: "application/json",
			authorization: await authHeader(ctx, nsid),
			...init?.headers
		},
		signal: init?.signal
	});
	if (!response.ok) throw await toResponseError(response);
	return (await response.json()) as T;
};

export const authedPost = async <T>(
	ctx: DeliberiContext,
	nsid: Nsid,
	body: unknown,
	init?: XrpcRequestInit
): Promise<T | null> => {
	const response = await ctx.fetch(buildUrl(ctx.serviceUrl, nsid), {
		method: "POST",
		headers: {
			"content-type": "application/json",
			accept: "application/json",
			authorization: await authHeader(ctx, nsid),
			...init?.headers
		},
		body: JSON.stringify(body ?? {}),
		signal: init?.signal
	});
	if (!response.ok) throw await toResponseError(response);
	// most temp procedures return no body (200 with empty payload)
	const text = await response.text();
	return text ? (JSON.parse(text) as T) : null;
};