/**
 * cli:provision-external-app — validate.ts
 */
import { ProvisionExternalAppInputSchema, type ValidationResult } from './types.js'

export function validate(raw: unknown): ValidationResult {
  const parsed = ProvisionExternalAppInputSchema.safeParse(raw)
  if (!parsed.success) {
    return {
      valid: false,
      errors: parsed.error.issues.map(i => `[${i.path.join('.')}] ${i.message}`),
      warnings: [],
    }
  }

  const spec = parsed.data
  const errors: string[] = []
  const warnings: string[] = []

  if (spec.baseUrl.startsWith('http://') && !/localhost|127\.0\.0\.1/.test(spec.baseUrl)) {
    errors.push('Refusing to send an admin token over plain http to a non-local host — the token grants API-account administration.')
  }
  if (new Set(spec.codes).size !== spec.codes.length) {
    warnings.push('Duplicate codes in codes[] — each grant is applied once.')
  }
  if (!spec.allowedIpAddresses) {
    warnings.push('No IP allow-list: the client will be reachable from any origin. Set allowedIpAddresses for anything beyond a local test.')
  }
  if (spec.allowedTenantIds.length === 0) {
    warnings.push('No tenant whitelist on the grants: the application may address every tenant its own binding allows.')
  }

  return { valid: errors.length === 0, errors, warnings }
}