← vibesdk

import { JWTUtils } from './jwtUtils';

const PREVIEW_PURPOSE = 'space_preview';
export const SPACE_PREVIEW_TOKEN_TTL_SECONDS = 30 * 60;
export const SPACE_PREVIEW_COOKIE_NAME = '__space_preview';

export interface SpacePreviewClaims {
	spaceName: string;
	branch: string;
	userId: string;
	/**
	 * The app's `previewVersion` at mint time. Compared against the app's
	 * current value at preview time so a visibility toggle (which bumps the
	 * version) revokes this token.
	 */
	previewVersion: number;
}

export async function signSpacePreviewToken(
	env: { JWT_SECRET: string },
	claims: SpacePreviewClaims,
): Promise<string> {
	const jwt = JWTUtils.getInstance(env);
	return jwt.signPayload({ ...claims, purpose: PREVIEW_PURPOSE }, SPACE_PREVIEW_TOKEN_TTL_SECONDS);
}

export async function verifySpacePreviewToken(
	env: { JWT_SECRET: string },
	token: string,
	expectedSpaceName: string,
	expectedBranch: string,
): Promise<SpacePreviewClaims | null> {
	const jwt = JWTUtils.getInstance(env);
	const payload = await jwt.verifyPayload(token);
	if (!payload) return null;
	if (payload.purpose !== PREVIEW_PURPOSE) return null;
	if (typeof payload.spaceName !== 'string' || payload.spaceName !== expectedSpaceName) return null;
	if (typeof payload.branch !== 'string' || payload.branch !== expectedBranch) return null;
	if (typeof payload.userId !== 'string' || payload.userId.trim() === '') return null;
	if (typeof payload.previewVersion !== 'number' || !Number.isFinite(payload.previewVersion)) return null;

	return {
		spaceName: payload.spaceName,
		branch: payload.branch,
		userId: payload.userId,
		previewVersion: payload.previewVersion,
	};
}

/**
 * Path the preview cookie is scoped to. No trailing slash so it prefix-matches
 * `/space/<name>/preview/<branch>/...` but not a sibling like `<branch>2`.
 */
export function buildSpacePreviewCookiePath(spaceName: string, branch: string): string {
	return `/space/${encodeURIComponent(spaceName)}/preview/${encodeURIComponent(branch)}`;
}

/**
 * Build the `Set-Cookie` value for the path-scoped HttpOnly preview cookie.
 * - Separate preview domain (cross-site iframe): `SameSite=None; Secure; Partitioned`.
 * - Same-origin (dev/main domain): `SameSite=Lax` (+ `Secure` when served over https).
 */
export function buildPreviewCookie(opts: {
	token: string;
	spaceName: string;
	branch: string;
	crossSite: boolean;
	secure: boolean;
	ttlSeconds?: number;
}): string {
	const { token, spaceName, branch, crossSite, secure } = opts;
	const maxAge = opts.ttlSeconds ?? SPACE_PREVIEW_TOKEN_TTL_SECONDS;
	const path = buildSpacePreviewCookiePath(spaceName, branch);
	const parts = [
		`${SPACE_PREVIEW_COOKIE_NAME}=${token}`,
		`Path=${path}`,
		`Max-Age=${maxAge}`,
		'HttpOnly',
	];
	if (crossSite) {
		parts.push('SameSite=None', 'Secure', 'Partitioned');
	} else {
		parts.push('SameSite=Lax');
		if (secure) parts.push('Secure');
	}
	return parts.join('; ');
}

/** Read the raw preview-cookie value from a request's `Cookie` header. */
export function readPreviewCookie(request: Request): string | null {
	const header = request.headers.get('Cookie');
	if (!header) return null;
	for (const pair of header.split(';')) {
		const idx = pair.indexOf('=');
		if (idx === -1) continue;
		const name = pair.slice(0, idx).trim();
		if (name === SPACE_PREVIEW_COOKIE_NAME) {
			return pair.slice(idx + 1).trim();
		}
	}
	return null;
}