/**
 * Owner-preview token — lets the authenticated owner of a PRIVATE deployed app
 * open its deployment URL on a preview subdomain.
 *
 * Main-domain session cookies are host-scoped to `CUSTOM_DOMAIN` and are NOT
 * sent to preview subdomains, so the routing gate cannot see the normal session
 * there. Instead the UI mints this short-lived, deployment-scoped token and
 * appends it to the deployment URL; on first hit the gate sets an HttpOnly,
 * subdomain-scoped cookie so subsequent requests need no query param.
 */
import { JWTUtils } from './jwtUtils';

const OWNER_PREVIEW_PURPOSE = 'owner_preview';
export const OWNER_PREVIEW_TOKEN_TTL_SECONDS = 60 * 60; // 1 hour
export const OWNER_PREVIEW_QUERY_PARAM = '__vibesdk_owner';
export const OWNER_PREVIEW_COOKIE_NAME = '__vibesdk_owner';

export interface OwnerPreviewClaims {
	/** The app owner's user id. */
	userId: string;
	/** The deployment id (== preview subdomain) this token is scoped to. */
	deploymentId: string;
}

export async function signOwnerPreviewToken(
	env: { JWT_SECRET: string },
	claims: OwnerPreviewClaims,
): Promise<string> {
	const jwt = JWTUtils.getInstance(env);
	return jwt.signPayload(
		{ ...claims, purpose: OWNER_PREVIEW_PURPOSE },
		OWNER_PREVIEW_TOKEN_TTL_SECONDS,
	);
}

/**
 * Verify a token and confirm it was minted for `expectedDeploymentId`.
 * Returns the owner user id on success, or `null` otherwise.
 */
export async function verifyOwnerPreviewToken(
	env: { JWT_SECRET: string },
	token: string,
	expectedDeploymentId: string,
): Promise<string | null> {
	const jwt = JWTUtils.getInstance(env);
	const payload = await jwt.verifyPayload(token);
	if (!payload) return null;
	if (payload.purpose !== OWNER_PREVIEW_PURPOSE) return null;
	if (typeof payload.deploymentId !== 'string' || payload.deploymentId !== expectedDeploymentId) {
		return null;
	}
	if (typeof payload.userId !== 'string' || payload.userId.trim() === '') return null;
	return payload.userId;
}

/** Read the owner-preview token from the `?__vibesdk_owner=` query param. */
export function readOwnerPreviewTokenFromQuery(url: URL): string | null {
	const token = url.searchParams.get(OWNER_PREVIEW_QUERY_PARAM);
	return token && token.trim() !== '' ? token : null;
}

/** Read the owner-preview cookie value from a request's `Cookie` header. */
export function readOwnerPreviewCookie(request: Request): string | null {
	const header = request.headers.get('Cookie');
	if (!header) return null;
	for (const pair of header.split(';')) {
		const idx = pair.indexOf('=');
		if (idx === -1) continue;
		const name = pair.slice(0, idx).trim();
		if (name === OWNER_PREVIEW_COOKIE_NAME) {
			return pair.slice(idx + 1).trim();
		}
	}
	return null;
}

/**
 * Build the `Set-Cookie` value for the HttpOnly owner-preview cookie. It is
 * scoped to the exact preview subdomain (no `Domain` attribute) and `Path=/`.
 */
export function buildOwnerPreviewCookie(opts: {
	token: string;
	secure: boolean;
	ttlSeconds?: number;
}): string {
	const { token, secure } = opts;
	const maxAge = opts.ttlSeconds ?? OWNER_PREVIEW_TOKEN_TTL_SECONDS;
	const parts = [
		`${OWNER_PREVIEW_COOKIE_NAME}=${token}`,
		'Path=/',
		`Max-Age=${maxAge}`,
		'HttpOnly',
		'SameSite=Lax',
	];
	if (secure) parts.push('Secure');
	return parts.join('; ');
}