import assert from 'node:assert';
import BoxError from '../boxerror.js';
import oidcClients from '../oidcclients.js';
import { HttpError } from '@cloudron/connect-lastmile';
import { HttpSuccess } from '@cloudron/connect-lastmile';
import safe from 'safetydance';


async function add(req, res, next) {
    assert.strictEqual(typeof req.body, 'object');

    if (typeof req.body.name !== 'string' || !req.body.name) return next(new HttpError(400, 'name must be non-empty string'));
    if (typeof req.body.loginRedirectUri !== 'string') return next(new HttpError(400, 'loginRedirectUri must be non-empty string'));
    if (req.body.tokenSignatureAlgorithm !== 'EdDSA' && req.body.tokenSignatureAlgorithm !== 'RS256') return next(new HttpError(400, 'tokenSignatureAlgorithm must be either EdDSA or RS256'));

    // clients with appId are internal only
    if (req.body.appId) return next(new HttpError(400, 'appId cannot be specified'));

    const data = {
        name: req.body.name,
        appId: '', // always empty for custom clients
        tokenSignatureAlgorithm: req.body.tokenSignatureAlgorithm,
        loginRedirectUri: req.body.loginRedirectUri
    };

    const [error, result] = await safe(oidcClients.add(data));
    if (error) return next(BoxError.toHttpError(error));

    data.id = result.id;
    data.secret = result.secret;

    next(new HttpSuccess(201, data));
}

async function load(req, res, next) {
    assert.strictEqual(typeof req.params.clientId, 'string');

    const [error, client] = await safe(oidcClients.get(req.params.clientId));
    if (error) return next(BoxError.toHttpError(error));
    if (!client) return next(new HttpError(404, 'OIDC client not found'));
    if (client.appId) return next(new HttpError(422, 'OIDC client of an internal app'));

    req.resources.oidcClient = client;

    next();
}

async function get(req, res, next) {
    assert.strictEqual(typeof req.params.clientId, 'string');

    next(new HttpSuccess(200, req.resources.oidcClient));
}

async function update(req, res, next) {
    assert.strictEqual(typeof req.params.clientId, 'string');
    assert.strictEqual(typeof req.body, 'object');

    if (typeof req.body.name !== 'string' || !req.body.name) return next(new HttpError(400, 'name must be non-empty string'));
    if (typeof req.body.loginRedirectUri !== 'string' || !req.body.loginRedirectUri) return next(new HttpError(400, 'loginRedirectUri must be non-empty string'));
    if (req.body.tokenSignatureAlgorithm !== 'EdDSA' && req.body.tokenSignatureAlgorithm !== 'RS256') return next(new HttpError(400, 'tokenSignatureAlgorithm must be either EdDSA or RS256'));

    const data = {
        name: req.body.name,
        appId: '', // always empty for custom clients
        tokenSignatureAlgorithm: req.body.tokenSignatureAlgorithm,
        loginRedirectUri: req.body.loginRedirectUri
    };

    const [updateError] = await safe(oidcClients.update(req.params.clientId, data));
    if (updateError) return next(BoxError.toHttpError(updateError));

    next(new HttpSuccess(201, {}));
}

async function list(req, res, next) {
    const [error, result] = await safe(oidcClients.list());
    if (error) return next(BoxError.toHttpError(error));

    const clients = result.filter(client => !client.appId); // filter out oidc and proxyauth addon clients

    next(new HttpSuccess(200, { clients }));
}

async function del(req, res, next) {
    assert.strictEqual(typeof req.params.clientId, 'string');

    const [delError] = await safe(oidcClients.del(req.params.clientId));
    if (delError) return next(BoxError.toHttpError(delError));

    next(new HttpSuccess(204));
}

export default {
    load,
    add,
    list,
    get,
    update,
    del,
};
