import { useMemo } from "react";
import { useAtomValue } from "@effect/atom-react";
import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
import {
  OAuthClientSlug,
  type IntegrationSlug,
  type OAuthClientOrigin,
  type Owner,
} from "@executor-js/sdk/shared";
import { getDomain } from "tldts";

import { oauthClientsOptimisticAtom } from "../api/atoms";

// ---------------------------------------------------------------------------
// OAuth client (registered app) selection for an integration's connect flow.
//
// An owner can register MANY apps; each is a distinct owner-scoped `oauth_client`
// row with its own slug. The connect flow lists the MANUAL apps usable for an
// integration and lets the user pick one or register a new one. Matching is by
// recorded intent first (an app registered from this integration's dialog, or
// whose OAuth endpoint HOST exactly matches the integration's declared host),
// then by registrable root domain as a subdued near-miss tier. User-owned apps
// are listed before workspace ones.
//
// DCR (dynamic client registration) clients are plumbing, not apps: they are
// minted automatically and reused per authorization server, so they NEVER appear
// in this picker. They stay visible for management elsewhere (the modal's
// "Auto-registered clients" surface), keyed off `origin.kind`.
// ---------------------------------------------------------------------------

export interface OAuthClientOption {
  readonly owner: Owner;
  readonly slug: OAuthClientSlug;
  readonly grant: "authorization_code" | "client_credentials";
  readonly authorizationUrl: string;
  readonly tokenUrl: string;
  readonly clientId: string;
  /** How the app came to exist. `manual` apps are pickable (with `integration`
   *  recording which dialog registered them); `dynamic_client_registration`
   *  apps are excluded from the picker entirely. */
  readonly origin: OAuthClientOrigin;
}

/** True for the auto-minted DCR clients that must never surface in the app
 *  picker. Legacy null-origin rows are already classified by the backend's
 *  `parseOAuthClientOrigin` heuristic, so this reads the parsed kind directly. */
export const isDcrClient = (app: OAuthClientOption): boolean =>
  app.origin.kind === "dynamic_client_registration";

/** True for host-operated first-party apps (config-declared, `first-party:`
 *  slugs). They rank ABOVE user/workspace apps when they match an integration:
 *  the one-click "nothing to paste" path is the default, BYO the escape hatch. */
export const isFirstPartyClient = (app: OAuthClientOption): boolean =>
  app.origin.kind === "first_party";

/** Mirror the host's first-party scope boundary in the picker. The server is
 *  authoritative; this prevents offering a built-in app for a flow it will
 *  reject. An explicit policy with unknown scopes fails closed. */
const firstPartyClientAllowsScopes = (
  app: OAuthClientOption,
  requestedScopes: readonly string[] | undefined,
  discoversScopes: boolean,
): boolean => {
  if (app.origin.kind !== "first_party" || app.origin.allowedScopes === undefined) return true;
  // MCP providers discover their scopes at OAuth start. The server intersects
  // that catalog with this same allow-list before redirecting, so an absent
  // static scope list is safe only on the explicit discovery path.
  if (requestedScopes === undefined) return discoversScopes;
  const allowed = new Set(app.origin.allowedScopes);
  return requestedScopes.every((scope) => allowed.has(scope));
};

const hostOf = (url: string): string | undefined => {
  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: URL() throws on invalid input; treat as "no host"
  try {
    return new URL(url).host.toLowerCase();
  } catch {
    return undefined;
  }
};

/** The registrable ("tld+1") root domain of a URL, e.g.
 *  `accounts.google.com` → `google.com`. Falls back to the full host for
 *  localhost / IP literals (where `tldts.getDomain` returns null) so local-dev
 *  MCP servers still match by exact host. Returns undefined for unparseable URLs. */
const getRootDomain = (url: string): string | undefined => {
  const root = getDomain(url);
  if (root) return root.toLowerCase();
  return hostOf(url);
};

export interface UseOAuthClientsResult {
  /** Tier 1 — apps that match this integration by RECORDED INTENT (registered
   *  from its dialog) or EXACT endpoint host, user-owned first. These are the
   *  apps that belong to this integration; the picker defaults to the first one.
   *  When an endpoint was declared but nothing matched exactly, this is EMPTY. */
  readonly clients: readonly OAuthClientOption[];
  /** Tier 2 — apps that only match by registrable root domain (a near-miss: same
   *  provider family, different exact host / not stamped to this integration).
   *  Surfaced in a visually separate, subdued "Other apps on this provider"
   *  section — NEVER silently mixed into `clients`. Present whenever there are
   *  such near-misses, even when tier 1 is non-empty. */
  readonly nearMatches: readonly OAuthClientOption[];
  /** Unrelated apps (different root domain), kept only as the opt-in escape hatch
   *  ("use a different registered app") when NOTHING matched the declared
   *  endpoint at all. Empty once anything in tier 1 or tier 2 matched. */
  readonly otherClients: readonly OAuthClientOption[];
  /** True until the clients list has loaded at least once. */
  readonly loading: boolean;
  /**
   * Whether an app is EXACT-matched (tier 1) to the integration.
   *
   * - `true`  — either no endpoint filter was requested (the integration
   *   declares no endpoints), or at least one app matched by recorded intent or
   *   exact endpoint host. `clients` is that tier-1 subset.
   * - `false` — the integration declared endpoint(s) but no app matched exactly.
   *   `clients` is EMPTY (the UI shows an empty state + a register CTA). Any
   *   root-domain near-misses are still offered via `nearMatches`; truly
   *   unrelated apps via `otherClients`.
   */
  readonly endpointMatched: boolean;
  /** Convenience flag for the UI: a register-an-app CTA should be shown because
   *  an endpoint was declared and nothing exact-matched. Equals `!endpointMatched`
   *  once loaded. */
  readonly displayRegisterCTA: boolean;
}

/** Stable empty-list reference so the picker memo doesn't re-run while the
 *  optimistic clients atom is still loading (a fresh `[]` each render would
 *  invalidate the memo key). */
const EMPTY_CLIENTS: readonly OAuthClientOption[] = [];

/** Host/root equality that matches ONLY when both sides parsed to a real value.
 *  `hostOf`/`getRootDomain` return undefined for URLs `new URL()` can't parse,
 *  so a bare `a === b` would treat two unparseable endpoints as equal
 *  (`undefined === undefined`). Every host/root comparison in this module must
 *  go through this so an unparseable value never counts as a match. */
const hostEq = (a: string | undefined, b: string | undefined): boolean =>
  a !== undefined && b !== undefined && a === b;

/** Sort first-party apps first (the one-click default), then user-owned before
 *  shared workspace apps. */
const sortUserFirst = (apps: readonly OAuthClientOption[]): readonly OAuthClientOption[] =>
  [...apps].sort((a: OAuthClientOption, b: OAuthClientOption) => {
    const aFirstParty = isFirstPartyClient(a);
    if (aFirstParty !== isFirstPartyClient(b)) return aFirstParty ? -1 : 1;
    return a.owner === b.owner ? 0 : a.owner === "user" ? -1 : 1;
  });

/**
 * Pure matcher (no React/atoms) — split owner-visible apps into three honest
 * tiers for an integration's connect picker.
 *
 * FIRST, DCR clients are dropped entirely: they are auto-minted plumbing reused
 * per authorization server, not apps a user picks. They stay manageable through
 * a separate surface, never the picker.
 *
 * Then the remaining MANUAL apps are graded:
 * - `matched` (tier 1): the app was registered from THIS integration's dialog
 *   (`origin.integration === integration`, recorded intent), OR its OAuth
 *   endpoint HOST exactly matches the integration's declared host (token host
 *   when a token endpoint is declared, else the authorize host). This is the
 *   subset that truly belongs to the integration.
 * - `nearMatches` (tier 2): the app shares the integration's REGISTRABLE ROOT
 *   DOMAIN ("tld+1") but is not a tier-1 match — a same-provider near-miss (e.g.
 *   an app on `mcp.cloudflare.com` for a REST integration on `api.cloudflare.com`).
 *   Silently promoting these into tier 1 is the bug this change fixes.
 * - `unmatched`: unrelated provider (different root), offered only as the escape
 *   hatch when nothing matched at all.
 *
 * When the integration declares no endpoints (and no match is required), every
 * manual app is tier 1 (no filter to grade against).
 */
export function selectClientsForEndpoints(
  all: readonly OAuthClientOption[],
  endpoints: {
    readonly tokenUrl?: string;
    readonly authorizationUrl?: string;
    /** The integration whose picker this is. A manual app stamped with this
     *  integration (recorded intent) is a tier-1 match regardless of host. */
    readonly integration?: IntegrationSlug;
    /** Complete scope set declared by the selected OAuth auth method. Used to
     *  hide scope-limited first-party apps that the host will reject. */
    readonly scopes?: readonly string[];
    /** The OAuth service discovers provider scopes at connect time and caps a
     *  first-party app's result to its configured allow-list. */
    readonly discoversScopes?: boolean;
    /** When set, an integration that targets a SPECIFIC server (MCP, whose
     *  endpoints are discovered at connect) must match by endpoint — absent
     *  endpoints mean NO match (show the register CTA), never "every app
     *  matches". Prevents auto-selecting an unrelated provider's app. */
    readonly requireEndpointMatch?: boolean;
  },
): {
  readonly matched: readonly OAuthClientOption[];
  readonly nearMatches: readonly OAuthClientOption[];
  readonly unmatched: readonly OAuthClientOption[];
  readonly endpointMatched: boolean;
} {
  // DCR clients are plumbing, never picker options.
  const manual = all.filter(
    (app) =>
      !isDcrClient(app) &&
      firstPartyClientAllowsScopes(app, endpoints.scopes, endpoints.discoversScopes === true),
  );

  const intent = endpoints.integration;
  const matchesIntent = (app: OAuthClientOption): boolean => {
    if (intent == null) return false;
    // A first-party app declaring this integration is intent-matched the same
    // way a BYO app registered from this dialog is.
    if (app.origin.kind === "first_party") {
      return (app.origin.integrations ?? []).includes(intent);
    }
    return (
      app.origin.kind === "manual" &&
      app.origin.integration != null &&
      app.origin.integration === intent
    );
  };

  const wantedTokenHost = endpoints.tokenUrl ? hostOf(endpoints.tokenUrl) : undefined;
  const wantedAuthorizationHost = endpoints.authorizationUrl
    ? hostOf(endpoints.authorizationUrl)
    : undefined;
  const wantedTokenRoot = endpoints.tokenUrl ? getRootDomain(endpoints.tokenUrl) : undefined;
  const wantedAuthorizationRoot = endpoints.authorizationUrl
    ? getRootDomain(endpoints.authorizationUrl)
    : undefined;

  // No declared endpoints. A server-targeting integration must NOT match every
  // app (it would auto-select an unrelated provider); surface the register CTA
  // instead. Otherwise (no endpoint filter at all) every manual app is usable.
  if (!wantedTokenRoot && !wantedAuthorizationRoot) {
    if (endpoints.requireEndpointMatch) {
      // Even with no declared endpoints, an app registered from THIS dialog is a
      // real tier-1 match (the user built it here on purpose).
      const matched = manual.filter(matchesIntent);
      const rest = manual.filter((app) => !matchesIntent(app));
      return {
        matched: sortUserFirst(matched),
        nearMatches: [],
        unmatched: sortUserFirst(rest),
        endpointMatched: matched.length > 0,
      };
    }
    return {
      matched: sortUserFirst(manual),
      nearMatches: [],
      unmatched: [],
      endpointMatched: true,
    };
  }

  const matched: OAuthClientOption[] = [];
  const nearMatches: OAuthClientOption[] = [];
  const unmatched: OAuthClientOption[] = [];
  for (const app of manual) {
    const appTokenHost = hostOf(app.tokenUrl);
    const appAuthorizationHost = hostOf(app.authorizationUrl);
    const appTokenRoot = getRootDomain(app.tokenUrl);
    const appAuthorizationRoot = getRootDomain(app.authorizationUrl);
    // Exact HOST match against the declared endpoint (token host first, since the
    // token endpoint is what the SDK actually calls; authorize host as fallback
    // when no token endpoint was declared).
    const exactHostMatch = wantedTokenHost
      ? hostEq(appTokenHost, wantedTokenHost)
      : hostEq(appAuthorizationHost, wantedAuthorizationHost) ||
        hostEq(appTokenHost, wantedAuthorizationHost);
    // Same registrable root domain (the old, looser heuristic) — now only a
    // tier-2 signal.
    const rootMatch = wantedTokenRoot
      ? hostEq(appTokenRoot, wantedTokenRoot)
      : hostEq(appAuthorizationRoot, wantedAuthorizationRoot) ||
        hostEq(appTokenRoot, wantedAuthorizationRoot);
    if (matchesIntent(app) || exactHostMatch) matched.push(app);
    else if (rootMatch) nearMatches.push(app);
    else unmatched.push(app);
  }
  return {
    matched: sortUserFirst(matched),
    nearMatches: sortUserFirst(nearMatches),
    unmatched: sortUserFirst(unmatched),
    endpointMatched: matched.length > 0,
  };
}

export function useOAuthClientsForIntegration(opts: {
  readonly tokenUrl?: string;
  readonly authorizationUrl?: string;
  readonly integration?: IntegrationSlug;
  readonly scopes?: readonly string[];
  readonly discoversScopes?: boolean;
  readonly requireEndpointMatch?: boolean;
}): UseOAuthClientsResult {
  // Read the optimistic list so a just-registered/edited/removed app paints
  // immediately, instead of flashing the stale server list until the refetch
  // lands. The modal's management menu reads the same optimistic atom, so the
  // picker rows and their actions stay consistent.
  const clientsResult = useAtomValue(oauthClientsOptimisticAtom);
  const loaded = AsyncResult.isSuccess(clientsResult);
  const all = loaded ? (clientsResult.value as readonly OAuthClientOption[]) : EMPTY_CLIENTS;

  // Memoize the grade: `selectClientsForEndpoints` parses every client's URLs
  // with tldts, and the modal passes a FRESH inline options object each render,
  // so without this every keystroke would re-grade all clients. Key on the
  // primitive inputs plus the `all` array reference (a new optimistic list is a
  // new array), NOT on `opts` identity.
  const selection = useMemo(
    () =>
      selectClientsForEndpoints(all, {
        tokenUrl: opts.tokenUrl,
        authorizationUrl: opts.authorizationUrl,
        integration: opts.integration,
        scopes: opts.scopes,
        discoversScopes: opts.discoversScopes,
        requireEndpointMatch: opts.requireEndpointMatch,
      }),
    [
      all,
      opts.tokenUrl,
      opts.authorizationUrl,
      opts.integration,
      opts.scopes,
      opts.discoversScopes,
      opts.requireEndpointMatch,
    ],
  );

  if (!loaded) {
    return {
      clients: [],
      nearMatches: [],
      otherClients: [],
      loading: true,
      endpointMatched: true,
      displayRegisterCTA: false,
    };
  }

  const { matched, nearMatches, unmatched, endpointMatched } = selection;
  // EXPLICIT outcome: `clients` is the tier-1 (exact/intent) subset the picker
  // defaults into. `nearMatches` (root-domain-only) is always surfaced, but in a
  // separate subdued section so it is never mistaken for a real match. When an
  // endpoint was declared but nothing exact-matched, `clients` is EMPTY and a
  // register CTA is flagged; the unrelated `unmatched` apps stay in `otherClients`
  // as the last-resort escape hatch.
  return {
    clients: endpointMatched ? matched : [],
    nearMatches,
    otherClients: endpointMatched ? [] : unmatched,
    loading: false,
    endpointMatched,
    displayRegisterCTA: !endpointMatched,
  };
}

/**
 * The auto-registered (DCR) clients relevant to an integration, for the
 * management surface (list + delete). These are hidden from the app picker but
 * must stay visible SOMEWHERE. A DCR client is relevant when it records this
 * integration as its origin (Part A stamps `origin.integration`), or — for
 * legacy clients minted before the stamp — when its endpoints share the
 * integration's declared/discovered root domain.
 */
export function selectDcrClientsForIntegration(
  all: readonly OAuthClientOption[],
  opts: {
    readonly integration?: IntegrationSlug;
    readonly tokenUrl?: string;
    readonly authorizationUrl?: string;
  },
): readonly OAuthClientOption[] {
  const wantedTokenRoot = opts.tokenUrl ? getRootDomain(opts.tokenUrl) : undefined;
  const wantedAuthorizationRoot = opts.authorizationUrl
    ? getRootDomain(opts.authorizationUrl)
    : undefined;
  const relevant = all.filter((app) => {
    if (!isDcrClient(app)) return false;
    if (
      opts.integration != null &&
      app.origin.kind === "dynamic_client_registration" &&
      app.origin.integration != null &&
      app.origin.integration === opts.integration
    ) {
      return true;
    }
    if (!wantedTokenRoot && !wantedAuthorizationRoot) return false;
    const appTokenRoot = getRootDomain(app.tokenUrl);
    const appAuthorizationRoot = getRootDomain(app.authorizationUrl);
    return (
      hostEq(appTokenRoot, wantedTokenRoot) ||
      hostEq(appAuthorizationRoot, wantedTokenRoot) ||
      hostEq(appAuthorizationRoot, wantedAuthorizationRoot) ||
      hostEq(appTokenRoot, wantedAuthorizationRoot)
    );
  });
  return sortUserFirst(relevant);
}

const slugifyName = (name: string): string =>
  name
    .toLowerCase()
    .replace(/[^a-z0-9]+/g, "-")
    .replace(/^-+|-+$/g, "");

/** A unique OAuth client slug derived from a display name, deduped against the
 *  owner's existing client slugs. */
export function uniqueClientSlug(name: string, existing: readonly string[]): OAuthClientSlug {
  const base = slugifyName(name) || "oauth-app";
  if (!existing.includes(base)) return OAuthClientSlug.make(base);
  let suffix = 2;
  while (existing.includes(`${base}-${suffix}`)) suffix += 1;
  return OAuthClientSlug.make(`${base}-${suffix}`);
}

/**
 * Optimistic (client-side) DCR client slug derived from the authorization
 * server host, for immediate/placeholder display only.
 *
 * The AUTHORITATIVE slug is computed server-side by `dcrClientSlug` in
 * `packages/core/sdk/src/oauth-service.ts`, which is resource-aware (an AS
 * serving multiple RFC 8707 resources gets distinct, hash-suffixed slugs). This
 * host-only form deliberately ignores resource: it is a best-effort placeholder
 * the UI shows before the server responds, and the server recomputes and
 * persists the real slug on registration. Do NOT rely on it matching the stored
 * slug for a multi-resource server.
 */
export function optimisticDcrClientSlug(issuerOrEndpoint: string): OAuthClientSlug {
  const host = hostOf(issuerOrEndpoint);
  const base = host === undefined ? "" : slugifyName(host);
  return OAuthClientSlug.make(`dcr-${base || "authorization-server"}`);
}

/** Humanize a client slug for display ("spotify-prod" → "Spotify prod").
 *  First-party slugs drop their namespace prefix ("first-party:github" →
 *  "Github") — the row's badge already says it's the built-in app. */
export function clientDisplayName(slug: string): string {
  const bare = slug.startsWith("first-party:") ? slug.slice("first-party:".length) : slug;
  const text = bare.replace(/[-_]/g, " ").trim();
  return text.length > 0 ? text.charAt(0).toUpperCase() + text.slice(1) : slug;
}

/** The host shown next to an app in the picker (the token endpoint's host). */
export function clientHost(tokenUrl: string): string {
  return hostOf(tokenUrl) ?? tokenUrl;
}