/**
 * `dench apps validate` — static checks for a `.dench.app` folder.
 *
 * Pure: takes the manifest text and the app's text files, returns findings.
 * The CLI (`cli/apps.ts`) reads the folder (disk or workspace) and prints.
 *
 * What it catches — every one of these has shipped as a broken app before:
 *   • a `dench.<ns>.<method>(` call that does not exist on `window.dench`
 *     (with the namespace's real methods as the hint),
 *   • a call whose permission the manifest does not declare,
 *   • `dench.api.call("<id>")` / `dench.api.a.b.c(` for an id that is not a
 *     public `/api/v1` operation (or is CLI-local),
 *   • removed APIs (`dench.db.*`), deprecated aliases (`dench.apps.send`),
 *   • unknown permission scopes in the manifest,
 *   • same-origin `fetch("/api/…")` (bypasses the bridge) and external
 *     `<script src>` / `<link href>` (blocked by CSP).
 */
import {
  APP_SDK_LOCAL_OPERATIONS,
  APP_SDK_METHODS,
  APP_SDK_OPERATIONS,
  APP_SDK_SCOPES,
  appSdkOperation,
} from "./app-sdk-catalog.generated";

export type ValidationFinding = {
  level: "error" | "warning";
  code:
    | "manifest_missing"
    | "manifest_name"
    | "manifest_entry_missing"
    | "manifest_unknown_permission"
    | "unknown_method"
    | "unknown_operation"
    | "local_operation"
    | "missing_permission"
    | "deprecated_method"
    | "same_origin_fetch"
    | "external_resource"
    | "no_bridge_calls";
  message: string;
  file?: string;
  line?: number;
};

export type ValidationResult = {
  ok: boolean;
  errors: ValidationFinding[];
  warnings: ValidationFinding[];
  /** Every distinct `dench.*` call found (for `--json` consumers). */
  calls: string[];
  /** Permissions the code needs, whether or not declared. */
  requiredPermissions: string[];
};

export type AppFile = { path: string; content: string };

/** Minimal `.dench.yaml` reader: top-level scalars + block/inline lists. */
export function parseAppManifest(yaml: string): Record<string, unknown> {
  const out: Record<string, unknown> = {};
  const lines = yaml.split(/\r?\n/);
  const indentOf = (s: string) => s.length - s.trimStart().length;
  const coerce = (raw: string): string => {
    const v = raw.trim();
    if (
      (v.startsWith('"') && v.endsWith('"')) ||
      (v.startsWith("'") && v.endsWith("'"))
    ) {
      return v.slice(1, -1);
    }
    return v;
  };
  let i = 0;
  while (i < lines.length) {
    const line = lines[i];
    i += 1;
    if (!line.trim() || line.trim().startsWith("#") || indentOf(line) !== 0)
      continue;
    const m = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
    if (!m) continue;
    const key = m[1];
    const val = m[2].replace(/\s+#.*$/, "").trim();
    if (val.startsWith("[") && val.endsWith("]")) {
      out[key] = val
        .slice(1, -1)
        .split(",")
        .map((s) => coerce(s))
        .filter(Boolean);
      continue;
    }
    if (val) {
      out[key] = coerce(val);
      continue;
    }
    const items: string[] = [];
    let sawList = false;
    while (i < lines.length) {
      const next = lines[i];
      if (!next.trim()) {
        i += 1;
        continue;
      }
      if (indentOf(next) === 0) break;
      if (next.trim().startsWith("- ")) {
        sawList = true;
        items.push(coerce(next.trim().slice(2)));
      }
      i += 1;
    }
    if (sawList) out[key] = items;
  }
  return out;
}

export type DenchCall = {
  /** `ns.method`, or for dench.api: `api.call` / `api.<path>`. */
  method: string;
  /** Operation id when the call targets dench.api. */
  operationId?: string;
  file: string;
  line: number;
};

const CALL_RE =
  /\bdench\.([A-Za-z_$][\w$]*)((?:\.[A-Za-z_$][\w$]*)+)\s*\(\s*(?:(["'`])([^"'`]+)\3)?/g;

/** Every `dench.<ns>.<method>(` (and `dench.api…`) call in a text file. */
export function scanDenchCalls(file: AppFile): DenchCall[] {
  const calls: DenchCall[] = [];
  const text = file.content;
  for (const match of text.matchAll(CALL_RE)) {
    const ns = match[1];
    const rest = match[2].slice(1).split(".");
    const line = text.slice(0, match.index).split("\n").length;
    if (ns === "api") {
      if (rest[0] === "call") {
        calls.push({
          method: "api.call",
          operationId: match[4] ?? undefined,
          file: file.path,
          line,
        });
      } else if (rest[0] === "operations") {
        calls.push({ method: "api.operations", file: file.path, line });
      } else {
        const path = rest.filter((p) => p !== "$call");
        calls.push({
          method: `api.${path.join(".")}`,
          operationId: path.join("."),
          file: file.path,
          line,
        });
      }
      continue;
    }
    calls.push({ method: `${ns}.${rest[0]}`, file: file.path, line });
  }
  return calls;
}

const LEGACY_PERMISSION_NAMES = new Set([
  "objects",
  "database",
  "database:write",
  "read:crm",
  "write:crm",
  "db.read",
  "db.write",
  "files",
  "store",
  "http",
  "integrations",
  "agent",
  "chat:create",
  "chat",
  "events",
  "cron",
  "webhooks",
  "clipboard",
  "apps",
  "memory",
  "events",
  "events:subscribe",
]);

function scopeGranted(granted: Set<string>, required: string | null): boolean {
  if (required === null) return true;
  if (granted.has(required)) return true;
  const idx = required.indexOf(":");
  const group = idx === -1 ? required : required.slice(0, idx);
  const access = idx === -1 ? null : required.slice(idx + 1);
  if (granted.has(group)) return true;
  if (access === "read" && granted.has(`${group}:write`)) return true;
  const legacy: Record<string, string[]> = {
    "crm:read": [
      "objects",
      "database",
      "database:write",
      "read:crm",
      "write:crm",
    ],
    "crm:write": ["objects", "database:write", "write:crm"],
    "ai:chat": ["agent", "chat", "chat:create"],
    "agent:invoke": ["agent"],
    "memory:read": ["agent:invoke", "agent", "memory"],
    "memory:write": ["agent:invoke", "agent", "memory"],
    "cron:schedule": ["cron", "routines"],
    "webhooks:receive": ["webhooks"],
    "http:external": ["http"],
    "apps:message": ["apps"],
  };
  return (legacy[required] ?? []).some((n) => granted.has(n));
}

function isTextCode(path: string) {
  return /\.(html?|js|mjs|cjs|ts|jsx|tsx)$/i.test(path);
}

export function validateApp(input: {
  manifestYaml: string | null;
  files: AppFile[];
}): ValidationResult {
  const errors: ValidationFinding[] = [];
  const warnings: ValidationFinding[] = [];
  const push = (f: ValidationFinding) =>
    (f.level === "error" ? errors : warnings).push(f);

  // ── Manifest ─────────────────────────────────────────────────────────
  let permissions: string[] = [];
  let entry = "index.html";
  if (input.manifestYaml === null) {
    push({
      level: "error",
      code: "manifest_missing",
      message: "Missing .dench.yaml at the app root.",
      file: ".dench.yaml",
    });
  } else {
    const manifest = parseAppManifest(input.manifestYaml);
    if (typeof manifest.name !== "string" || !manifest.name.trim()) {
      push({
        level: "error",
        code: "manifest_name",
        message: "`name` is required in .dench.yaml.",
        file: ".dench.yaml",
      });
    }
    if (typeof manifest.entry === "string" && manifest.entry.trim()) {
      entry = manifest.entry.trim();
    }
    permissions = Array.isArray(manifest.permissions)
      ? (manifest.permissions as unknown[]).map(String)
      : [];
    const known = new Set<string>(APP_SDK_SCOPES);
    for (const scope of permissions) {
      if (known.has(scope)) continue;
      if (LEGACY_PERMISSION_NAMES.has(scope)) {
        warnings.push({
          level: "warning",
          code: "manifest_unknown_permission",
          message: `Permission "${scope}" is a legacy name; prefer ${suggestScope(scope)}.`,
          file: ".dench.yaml",
        });
        continue;
      }
      push({
        level: "error",
        code: "manifest_unknown_permission",
        message: `Unknown permission "${scope}". Valid scopes: ${APP_SDK_SCOPES.join(", ")}.`,
        file: ".dench.yaml",
      });
    }
  }
  if (!input.files.some((f) => f.path === entry)) {
    push({
      level: "error",
      code: "manifest_entry_missing",
      message: `Entry file "${entry}" not found in the app folder.`,
      file: entry,
    });
  }
  const granted = new Set(permissions.map((p) => p.trim()));

  // ── Calls ────────────────────────────────────────────────────────────
  const calls = input.files
    .filter((f) => isTextCode(f.path))
    .flatMap(scanDenchCalls);
  const seen = new Set<string>();
  const required = new Set<string>();
  const need = (permission: string | null, call: DenchCall, label: string) => {
    if (!permission) return;
    required.add(permission);
    if (!scopeGranted(granted, permission)) {
      push({
        level: "error",
        code: "missing_permission",
        message: `${label} needs "${permission}" — add it to .dench.yaml permissions.`,
        file: call.file,
        line: call.line,
      });
    }
  };

  for (const call of calls) {
    seen.add(
      call.operationId ? `${call.method}(${call.operationId})` : call.method,
    );

    if (call.method === "api.call" || call.method.startsWith("api.")) {
      if (call.method === "api.operations") continue;
      if (!call.operationId) {
        // dench.api.call(variable) — cannot check statically.
        continue;
      }
      const op = appSdkOperation(call.operationId);
      if (!op) {
        const isLocal = APP_SDK_LOCAL_OPERATIONS.includes(call.operationId);
        push({
          level: "error",
          code: isLocal ? "local_operation" : "unknown_operation",
          message: isLocal
            ? `dench.api: "${call.operationId}" only exists in the CLI (local state) and cannot be called from an app.`
            : `dench.api: "${call.operationId}" is not a public /api/v1 operation. ${nearestOperations(call.operationId)}`,
          file: call.file,
          line: call.line,
        });
        continue;
      }
      if (op.deprecated) {
        warnings.push({
          level: "warning",
          code: "deprecated_method",
          message: `Operation "${op.id}" is deprecated.`,
          file: call.file,
          line: call.line,
        });
      }
      need(op.permission, call, `dench.api "${op.id}"`);
      continue;
    }

    const info = APP_SDK_METHODS[call.method];
    if (!info) {
      const ns = call.method.split(".")[0];
      const available = Object.keys(APP_SDK_METHODS)
        .filter((m) => m.startsWith(`${ns}.`))
        .map((m) => m.slice(ns.length + 1));
      push({
        level: "error",
        code: "unknown_method",
        message:
          available.length > 0
            ? `dench.${call.method} does not exist. dench.${ns}.* has: ${available.join(", ")}.`
            : `dench.${call.method} does not exist (no "${ns}" namespace). Namespaces: ${[...new Set(Object.keys(APP_SDK_METHODS).map((m) => m.split(".")[0]))].join(", ")}. Anything else is dench.api.call(<operationId>) — see dench.api.operations().`,
        file: call.file,
        line: call.line,
      });
      continue;
    }
    if (info.deprecated) {
      push({
        level: call.method.startsWith("db.") ? "error" : "warning",
        code: "deprecated_method",
        message: `dench.${call.method}: ${info.deprecated}`,
        file: call.file,
        line: call.line,
      });
      if (call.method.startsWith("db.")) continue;
    }
    need(info.permission, call, `dench.${call.method}`);
  }

  // ── Bridge bypasses / CSP ────────────────────────────────────────────
  for (const file of input.files) {
    if (!isTextCode(file.path)) continue;
    for (const m of file.content.matchAll(
      /\bfetch\(\s*(["'`])(\/api\/[^"'`]*)\1/g,
    )) {
      push({
        level: "error",
        code: "same_origin_fetch",
        message: `fetch("${m[2]}") bypasses the bridge and breaks when apps move to their own origin. Use dench.api.call / the dench.* aliases.`,
        file: file.path,
        line: file.content.slice(0, m.index).split("\n").length,
      });
    }
    for (const m of file.content.matchAll(
      /<(script|link)\b[^>]*\b(?:src|href)\s*=\s*["'](https?:)?\/\/[^"']+["']/gi,
    )) {
      push({
        level: "error",
        code: "external_resource",
        message: `External <${m[1].toLowerCase()}> is blocked by the app CSP — inline it.`,
        file: file.path,
        line: file.content.slice(0, m.index).split("\n").length,
      });
    }
  }

  if (calls.length === 0 && input.files.some((f) => isTextCode(f.path))) {
    warnings.push({
      level: "warning",
      code: "no_bridge_calls",
      message:
        "No window.dench calls found — the app does not use any workspace data.",
    });
  }

  return {
    ok: errors.length === 0,
    errors,
    warnings,
    calls: [...seen].sort(),
    requiredPermissions: [...required].sort(),
  };
}

function suggestScope(legacy: string): string {
  const map: Record<string, string> = {
    objects: "crm:read / crm:write",
    database: "crm:read",
    "database:write": "crm:write",
    files: "files:read / files:write",
    store: "store:read / store:write",
    http: "http:external",
    integrations: "integrations:read / integrations:write",
    agent: "ai:chat / agent:invoke",
    chat: "ai:chat",
    "chat:create": "ai:chat",
    events: "(no permission needed — remove it)",
    "events:subscribe": "(no permission needed — remove it)",
    cron: "cron:schedule",
    webhooks: "webhooks:receive",
    clipboard: "clipboard:read / clipboard:write",
    apps: "apps:message (bus) or apps:read / apps:write (store)",
    memory: "memory:read / memory:write",
  };
  return map[legacy] ?? "a canonical scope";
}

function nearestOperations(id: string): string {
  const prefix = id.split(".")[0];
  const same = APP_SDK_OPERATIONS.filter((o) => o.id.startsWith(`${prefix}.`))
    .map((o) => o.id)
    .slice(0, 12);
  return same.length
    ? `Operations under "${prefix}": ${same.join(", ")}.`
    : "List operations with dench.api.operations() or `dench help`.";
}

/** Human-readable report. */
export function formatValidation(
  result: ValidationResult,
  appPath: string,
): string {
  const lines: string[] = [];
  const where = (f: ValidationFinding) =>
    f.file ? ` (${f.file}${f.line ? `:${f.line}` : ""})` : "";
  lines.push(
    result.ok
      ? `✔ ${appPath} is valid — ${result.calls.length} dench.* call(s), permissions needed: ${result.requiredPermissions.join(", ") || "none"}`
      : `✖ ${appPath} has ${result.errors.length} error(s)`,
  );
  for (const e of result.errors)
    lines.push(`  error   ${e.message}${where(e)}`);
  for (const w of result.warnings)
    lines.push(`  warning ${w.message}${where(w)}`);
  return lines.join("\n");
}