/**
 * Bridges between the legacy single-file CloudAdapter interface and the
 * shared EncryptedObjectStorage surface used by plugin sync Providers.
 */

import type {
  EncryptedObjectAccount,
  EncryptedObjectDeleteResult,
  EncryptedObjectReadResult,
  EncryptedObjectStorage,
  EncryptedObjectStorageCapabilities,
  EncryptedObjectWriteResult,
} from '../../../domain/encryptedObjectStorage';
// EncryptedObjectStorageCapabilities used for session capability gating.
import {
  DEFAULT_ENCRYPTED_SYNC_OBJECT_KEY,
} from '../../../domain/encryptedObjectStorage';
import type {
  CloudProvider,
  OAuthTokens,
  ProviderAccount,
  SyncedFile,
} from '../../../domain/sync';
import type { CloudAdapter } from './index';

const textEncoder = new TextEncoder();
const textDecoder = new TextDecoder();

function syncedFileToBytes(syncedFile: SyncedFile): Uint8Array {
  return textEncoder.encode(JSON.stringify(syncedFile));
}

function bytesToSyncedFile(bytes: Uint8Array): SyncedFile {
  const raw = textDecoder.decode(bytes);
  // Require a complete JSON object. Do not accept a valid prefix with trailing
  // garbage — that hides provider corruption from read-and-verify recovery.
  return JSON.parse(raw) as SyncedFile;
}

/** Thrown when a conditional write is rejected (revision / precondition). */
export class ConditionalWriteConflictError extends Error {
  readonly code = 'conditional_write_conflict';

  constructor(message = 'Encrypted object conditional write was rejected', options?: { cause?: unknown }) {
    super(message, options);
    this.name = 'ConditionalWriteConflictError';
  }
}

export function isConditionalWriteConflictError(error: unknown): boolean {
  if (error instanceof ConditionalWriteConflictError) return true;
  if (!error || typeof error !== 'object') return false;
  const maybe = error as { name?: unknown; code?: unknown; message?: unknown; data?: { pluginCode?: unknown } };
  if (maybe.name === 'ConditionalWriteConflictError') return true;
  if (maybe.code === 'conditional_write_conflict' || maybe.code === -32009 || maybe.code === 'failed_precondition') {
    return true;
  }
  if (maybe.data?.pluginCode === 'failed_precondition') return true;
  return typeof maybe.message === 'string'
    && /failed[_ ]precondition|expectedRevision|revision mismatch|conditional write/i.test(maybe.message);
}

/**
 * Adapt a legacy CloudAdapter into EncryptedObjectStorage.
 * Uses a single default object key matching the historical vault file name.
 */
export function cloudAdapterAsEncryptedObjectStorage(
  adapter: CloudAdapter,
  providerId: string,
  options: {
    objectKey?: string;
    capabilities?: EncryptedObjectStorageCapabilities;
  } = {},
): EncryptedObjectStorage {
  const objectKey = options.objectKey ?? DEFAULT_ENCRYPTED_SYNC_OBJECT_KEY;
  const capabilities: EncryptedObjectStorageCapabilities = options.capabilities ?? {
    revisions: false,
    conditionalWrites: false,
    atomicReplacement: true,
  };

  return {
    providerId,
    async connect(): Promise<{ account: EncryptedObjectAccount }> {
      if (!adapter.isAuthenticated) {
        throw new Error(`Cloud provider ${providerId} is not authenticated`);
      }
      await adapter.initializeSync();
      const account = adapter.accountInfo;
      if (!account) {
        return { account: { id: providerId } };
      }
      return { account: { ...account } };
    },
    async disconnect(): Promise<void> {
      adapter.signOut();
    },
    async getAccount(): Promise<EncryptedObjectAccount | null> {
      return adapter.accountInfo ? { ...adapter.accountInfo } : null;
    },
    async getCapabilities(): Promise<EncryptedObjectStorageCapabilities> {
      return { ...capabilities };
    },
    async readObject(key: string): Promise<EncryptedObjectReadResult> {
      if (key !== objectKey) {
        return { found: false, key, bytes: null };
      }
      const file = await adapter.download();
      if (!file) return { found: false, key, bytes: null };
      const bytes = syncedFileToBytes(file);
      return {
        found: true,
        key,
        bytes,
        revision: file.meta?.version != null ? String(file.meta.version) : undefined,
        contentType: 'application/json',
      };
    },
    async writeObject(key: string, bytes: Uint8Array): Promise<EncryptedObjectWriteResult> {
      if (key !== objectKey) {
        throw new Error(`Cloud adapter ${providerId} only supports object key ${objectKey}`);
      }
      const syncedFile = bytesToSyncedFile(bytes);
      // Skip a pre-upload GET for `created`. The single-object vault path does not
      // consume that flag, and WebDAV already pays for pad+verify inside upload.
      await adapter.upload(syncedFile);
      return {
        created: false,
        revision: syncedFile.meta?.version != null ? String(syncedFile.meta.version) : undefined,
      };
    },
    async deleteObject(key: string): Promise<EncryptedObjectDeleteResult> {
      if (key !== objectKey) {
        return { deleted: false };
      }
      const existing = await adapter.download();
      if (!existing) return { deleted: false };
      await adapter.deleteSync();
      return { deleted: true };
    },
  };
}

/**
 * Adapt EncryptedObjectStorage into the legacy CloudAdapter surface so the
 * existing encrypt→upload / download→decrypt manager path can drive WebDAV and
 * plugin providers through one code path.
 *
 * Authentication and resourceId must match pre-bridge CloudAdapter semantics:
 * config-backed providers (WebDAV) report authenticated as soon as credentials
 * exist so getConnectedAdapter can reuse the cached instance; resourceId must
 * preserve the persisted path (or the backing adapter's authoritative id) rather
 * than always forcing the default object key.
 */
export function encryptedObjectStorageAsCloudAdapter(
  storage: EncryptedObjectStorage,
  options: {
    objectKey?: string;
    account?: ProviderAccount | null;
    /** When true, getConnectedAdapter reuses this instance without recreating. */
    initiallyAuthenticated?: boolean;
    /** Seeded resource id (e.g. path restored from provider connection storage). */
    resourceId?: string | null;
    /**
     * Prefer the backing adapter's resource id after connect/upload (WebDAV sets
     * `/netcatty-vault.json` via initializeSync; plugins may use object keys).
     */
    resolveResourceId?: () => string | null | undefined;
    /**
     * When true, re-issue connect() even if a prior session was established.
     * Required for plugin providers whose in-process clients die on runtime
     * restart/replace while the CloudAdapter cache stays alive.
     */
    rebindSession?: boolean;
    /**
     * When true, skip the host full-byte re-read after writeObject. Use only when
     * the backing storage already performs Netcatty-grade write verification
     * (WebDAV pad+verify). Plugin providers keep host-owned verify.
     */
    assumeVerifiedWrites?: boolean;
  } = {},
): CloudAdapter {
  const objectKey = options.objectKey ?? DEFAULT_ENCRYPTED_SYNC_OBJECT_KEY;
  let account: ProviderAccount | null = options.account ?? null;
  let resourceId: string | null = options.resourceId ?? null;
  let authenticated = options.initiallyAuthenticated === true;
  /** Distinct from credential presence: plugin providers need an explicit connect. */
  let sessionConnected = false;
  /**
   * Last observed remote revision for conditional writes.
   * - string: known revision
   * - null: confirmed absent (must-not-exist write)
   * - undefined: unknown / unconditional
   */
  let lastRevision: string | null | undefined;

  const refreshResourceId = (fallback?: string | null): string | null => {
    const resolved = options.resolveResourceId?.();
    if (typeof resolved === 'string' && resolved.length > 0) {
      resourceId = resolved;
      return resourceId;
    }
    if (typeof fallback === 'string' && fallback.length > 0) {
      resourceId = fallback;
      return resourceId;
    }
    return resourceId;
  };

  let capabilities: EncryptedObjectStorageCapabilities | null = null;

  const ensureConnected = async (): Promise<void> => {
    if (sessionConnected && !options.rebindSession) return;
    // rebindSession: always re-run connect so a replaced plugin runtime gets a
    // fresh client. Connect is expected to be idempotent when still healthy.
    const result = await storage.connect();
    account = result.account;
    capabilities = await storage.getCapabilities();
    authenticated = true;
    sessionConnected = true;
    refreshResourceId(objectKey);
  };

  /** After I/O failure, force the next ensureConnected to re-issue connect(). */
  const markSessionStale = (): void => {
    sessionConnected = false;
  };

  return {
    get isAuthenticated() {
      return authenticated;
    },
    get accountInfo() {
      return account;
    },
    get resourceId() {
      return resourceId;
    },
    signOut() {
      authenticated = false;
      sessionConnected = false;
      lastRevision = undefined;
      capabilities = null;
      account = null;
      resourceId = null;
      // Fire-and-forget is intentional for CloudAdapter.signOut sync API;
      // disconnectProvider should call initializeSync/connect after a full await
      // path when a future async signOut is added to CloudAdapter.
      void Promise.resolve(storage.disconnect()).catch(() => {
        // Plugin runtime may already be gone; local sign-out still succeeds.
      });
    },
    async initializeSync(): Promise<string | null> {
      try {
        await ensureConnected();
        return refreshResourceId(objectKey);
      } catch (error) {
        markSessionStale();
        throw error;
      }
    },
    async upload(syncedFile: SyncedFile, uploadOptions?: { signal?: AbortSignal }): Promise<string> {
      try {
        await ensureConnected();
        const bytes = syncedFileToBytes(syncedFile);
        if (
          capabilities?.maxObjectBytes != null
          && bytes.byteLength > capabilities.maxObjectBytes
        ) {
          throw new Error(
            `Encrypted object exceeds provider maxObjectBytes (${capabilities.maxObjectBytes})`,
          );
        }
        if (
          capabilities?.maxObjects != null
          && capabilities.maxObjects < 1
        ) {
          throw new Error(
            `Encrypted object provider reports maxObjects < 1 (${capabilities.maxObjects})`,
          );
        }
        const conditional = capabilities?.conditionalWrites === true;
        let writeResult: EncryptedObjectWriteResult;
        try {
          writeResult = await storage.writeObject(objectKey, bytes, {
            ...(conditional && lastRevision !== undefined
              ? { expectedRevision: lastRevision }
              : {}),
            signal: uploadOptions?.signal,
          });
        } catch (writeError) {
          if (conditional && isConditionalWriteConflictError(writeError)) {
            throw new ConditionalWriteConflictError(
              writeError instanceof Error ? writeError.message : String(writeError),
              { cause: writeError },
            );
          }
          throw writeError;
        }
        if (options.assumeVerifiedWrites === true) {
          // Backing adapter already verified (e.g. WebDAV pad+verify). Still honor
          // maxObjectBytes above and refresh revision from the write result.
          if (typeof writeResult.revision === 'string' && writeResult.revision.length > 0) {
            lastRevision = writeResult.revision;
          }
        } else {
          // Host-owned write verification: re-read and compare ciphertext bytes.
          const verified = await storage.readObject(objectKey, { signal: uploadOptions?.signal });
          if (!verified.found || !verified.bytes) {
            throw new Error('Encrypted object write verification failed: object missing after write');
          }
          if (verified.bytes.byteLength !== bytes.byteLength) {
            throw new Error('Encrypted object write verification failed: size mismatch');
          }
          for (let i = 0; i < bytes.byteLength; i += 1) {
            if (verified.bytes[i] !== bytes[i]) {
              throw new Error('Encrypted object write verification failed: content mismatch');
            }
          }
          if (typeof writeResult.revision === 'string' && writeResult.revision.length > 0) {
            lastRevision = writeResult.revision;
          } else if (typeof verified.revision === 'string' && verified.revision.length > 0) {
            lastRevision = verified.revision;
          } else {
            lastRevision = undefined;
          }
        }
        authenticated = true;
        return refreshResourceId(objectKey) ?? objectKey;
      } catch (error) {
        markSessionStale();
        throw error;
      }
    },
    async download(downloadOptions?: { signal?: AbortSignal }): Promise<SyncedFile | null> {
      try {
        await ensureConnected();
        const result = await storage.readObject(objectKey, { signal: downloadOptions?.signal });
        if (!result.found || !result.bytes) {
          // Confirmed absence: next conditional write must use expectedRevision null.
          lastRevision = null;
          return null;
        }
        if (typeof result.revision === 'string' && result.revision.length > 0) {
          lastRevision = result.revision;
        } else {
          lastRevision = undefined;
        }
        return bytesToSyncedFile(result.bytes);
      } catch (error) {
        markSessionStale();
        throw error;
      }
    },
    async deleteSync(deleteOptions?: { signal?: AbortSignal }): Promise<void> {
      try {
        await ensureConnected();
        await storage.deleteObject(objectKey, {
          ...(typeof lastRevision === 'string' ? { expectedRevision: lastRevision } : {}),
          signal: deleteOptions?.signal,
        });
        lastRevision = null;
      } catch (error) {
        markSessionStale();
        throw error;
      }
    },
    getTokens(): OAuthTokens | null {
      return null;
    },
  };
}

/**
 * WebDAV-specific capabilities: atomic replacement via temp+MOVE, no native revisions.
 */
export function webdavEncryptedObjectCapabilities(): EncryptedObjectStorageCapabilities {
  return {
    revisions: false,
    conditionalWrites: false,
    atomicReplacement: true,
  };
}

export function isWebdavProvider(provider: CloudProvider): boolean {
  return provider === 'webdav';
}