// The `oxygenhub` authentication provider (spec §4): a session is a hub
// base URL and a personal access token, kept in SecretStorage.

import * as vscode from "vscode";
import { fetchTrusting, HubClient, Session } from "./hub";

const KEY = "oxygenhub.sessions";

export class HubAuth implements vscode.AuthenticationProvider, vscode.Disposable {
  private readonly emitter = new vscode.EventEmitter<vscode.AuthenticationProviderAuthenticationSessionsChangeEvent>();
  readonly onDidChangeSessions = this.emitter.event;
  private readonly onDidChangeEmitter = new vscode.EventEmitter<void>();
  /** Fires when the set of hubs changes. */
  readonly onDidChange = this.onDidChangeEmitter.event;
  private sessions: Session[] = [];
  /** CA files for hubs with self-signed certificates, learnt from remotes. */
  private readonly cas = new Map<string, string>();
  private readonly disposables: vscode.Disposable[] = [];

  constructor(private readonly secrets: vscode.SecretStorage) {
    this.disposables.push(vscode.authentication.registerAuthenticationProvider("oxygenhub", "OxygenHub", this, { supportsMultipleAccounts: true }));
  }

  async load(): Promise<void> {
    const raw = await this.secrets.get(KEY);
    this.sessions = raw ? (JSON.parse(raw) as Session[]) : [];
  }

  private async save(): Promise<void> {
    await this.secrets.store(KEY, JSON.stringify(this.sessions));
    this.onDidChangeEmitter.fire();
  }

  all(): Session[] {
    return [...this.sessions];
  }

  bases(): string[] {
    const configured = vscode.workspace.getConfiguration("oxygenhub").get<string[]>("hubs") ?? [];
    return [...new Set([...this.sessions.map((s) => s.base), ...configured.map((b) => b.replace(/\/$/, ""))])];
  }

  /** The session for a hub base URL, if signed in. */
  sessionFor(base: string): Session | undefined {
    return this.sessions.find((s) => s.base === base.replace(/\/$/, ""));
  }

  clientFor(base: string): HubClient {
    const b = base.replace(/\/$/, "");
    return new HubClient(b, this.sessionFor(b)?.token, this.fetchFor(b));
  }

  /** Remember the CA file a remote names for a hub (`remote.NAME.ca`). */
  setCa(base: string, caFile: string): void {
    this.cas.set(base.replace(/\/$/, ""), caFile);
  }

  /** How to reach a hub: trusting its CA file when one is known (from a
   * checkout's remote, or the `oxygenhub.caFiles` setting), else plain fetch. */
  fetchFor(base: string): typeof fetch {
    const configured = vscode.workspace.getConfiguration("oxygenhub").get<Record<string, string>>("caFiles") ?? {};
    const ca = this.cas.get(base) ?? configured[base] ?? configured[`${base}/`];
    return ca ? fetchTrusting(ca) : fetch;
  }

  private toVs(s: Session): vscode.AuthenticationSession {
    return { id: s.base, accessToken: s.token, account: { id: `${s.username ?? "?"}@${s.base}`, label: `${s.username ?? "?"} on ${s.base}` }, scopes: [] };
  }

  async getSessions(): Promise<vscode.AuthenticationSession[]> {
    return this.sessions.map((s) => this.toVs(s));
  }

  async createSession(): Promise<vscode.AuthenticationSession> {
    const s = await this.signIn();
    if (!s) {
      throw new Error("Sign in cancelled");
    }
    return this.toVs(s);
  }

  async removeSession(id: string): Promise<void> {
    const before = this.sessions.find((s) => s.base === id);
    this.sessions = this.sessions.filter((s) => s.base !== id);
    await this.save();
    if (before) {
      this.emitter.fire({ added: [], removed: [this.toVs(before)], changed: [] });
    }
  }

  /** Ask for a hub and a token, verify them, and keep the session. */
  async signIn(defaultBase?: string): Promise<Session | undefined> {
    const base = await vscode.window.showInputBox({ prompt: "Hub URL", value: defaultBase ?? this.bases()[0] ?? "https://", validateInput: (v) => (/^https?:\/\/[^/]+/.test(v) ? undefined : "A URL such as https://hub.example:7343") });
    if (!base) {
      return undefined;
    }
    const token = await vscode.window.showInputBox({ prompt: `Personal access token for ${base} (Settings › Tokens on the hub; scopes repo:read repo:write proposals:write issues:write)`, password: true });
    if (!token) {
      return undefined;
    }
    const client = new HubClient(base.replace(/\/$/, ""), token, this.fetchFor(base.replace(/\/$/, "")));
    let username: string | undefined;
    try {
      username = (await client.me()).username;
    } catch (e) {
      const pick = await vscode.window.showWarningMessage(`OxygenHub: could not read your account (${(e as Error).message}); the token may lack user:read. Keep it anyway?`, "Keep", "Cancel");
      if (pick !== "Keep") {
        return undefined;
      }
    }
    const session: Session = { base: base.replace(/\/$/, ""), token, username };
    this.sessions = [...this.sessions.filter((s) => s.base !== session.base), session];
    await this.save();
    this.emitter.fire({ added: [this.toVs(session)], removed: [], changed: [] });
    return session;
  }

  dispose(): void {
    this.disposables.forEach((d) => d.dispose());
  }
}