import * as plugins from './plugins.runtime.js';

type TGetIdentityCredential = () => plugins.servezoneInterfaces.data.IIdentityCredential;

type TFireRequest = <T extends plugins.typedRequestInterfaces.ITypedRequest>(
  methodArg: T['method'],
  requestArg: T['request'],
) => Promise<T['response']>;

const isExactRecord = (
  valueArg: unknown,
  keysArg: string[],
): valueArg is Record<string, unknown> => {
  try {
    return valueArg !== null
      && typeof valueArg === 'object'
      && !Array.isArray(valueArg)
      && JSON.stringify(Object.keys(valueArg).sort()) === JSON.stringify([...keysArg].sort());
  } catch {
    return false;
  }
};

const unavailableExpectationReasons = new Set([
  'recipient-unavailable',
  'workloadinit-unconfigured',
  'workloadinit-revoked',
  'targets-unavailable',
]);

const cloneManifestReference = (
  referenceArg: plugins.servezoneInterfaces.data.IResolvedSecretManifestReference,
): plugins.servezoneInterfaces.data.IResolvedSecretManifestReference => ({
  manifestId: referenceArg.manifestId,
  manifestDigest: referenceArg.manifestDigest,
  clusterId: referenceArg.clusterId,
  imageRolloutId: referenceArg.imageRolloutId,
  imageRolloutGeneration: referenceArg.imageRolloutGeneration,
  requestedImageDigest: referenceArg.requestedImageDigest,
  invocationDigest: referenceArg.invocationDigest,
  secretRolloutId: referenceArg.secretRolloutId,
  secretRolloutGeneration: referenceArg.secretRolloutGeneration,
});

const cloneEnvelope = (
  envelopeArg: plugins.smartcrypto.IX25519EnvelopeV1,
): plugins.smartcrypto.IX25519EnvelopeV1 => ({
  schemaVersion: envelopeArg.schemaVersion,
  profile: envelopeArg.profile,
  recipientKeyId: envelopeArg.recipientKeyId,
  ephemeralPublicKey: envelopeArg.ephemeralPublicKey,
  nonce: envelopeArg.nonce,
  ciphertext: envelopeArg.ciphertext,
  tag: envelopeArg.tag,
  contextDigest: envelopeArg.contextDigest,
});

const cloneCorestoreCredentialPublicationGrant = (
  grantArg: plugins.servezoneInterfacesRuntime.ICorestoreCredentialPublicationGrant,
): plugins.servezoneInterfacesRuntime.ICorestoreCredentialPublicationGrant => ({
  operationId: grantArg.operationId,
  serviceId: grantArg.serviceId,
  bindingId: grantArg.bindingId,
  capability: grantArg.capability,
  reconciliationGeneration: grantArg.reconciliationGeneration,
  expectedTargetSecretsRevision: grantArg.expectedTargetSecretsRevision,
  bindingRequestDigest: grantArg.bindingRequestDigest,
  issuedAt: grantArg.issuedAt,
  expiresAt: grantArg.expiresAt,
});

const cloneCorestoreControlCredentialMaterial = (
  materialArg: plugins.servezoneInterfacesRuntime.ICorestoreControlCredentialMaterial,
): plugins.servezoneInterfacesRuntime.ICorestoreControlCredentialMaterial => ({
  requestId: materialArg.requestId,
  clusterId: materialArg.clusterId,
  capability: materialArg.capability,
  providerConfigId: materialArg.providerConfigId,
  controlUrl: materialArg.controlUrl,
  managementScope: materialArg.managementScope,
  key: materialArg.key,
  environment: materialArg.environment,
  recipientKeyId: materialArg.recipientKeyId,
  recipientGeneration: materialArg.recipientGeneration,
  envelope: cloneEnvelope(materialArg.envelope),
});

const cloneCorestoreCredentialPublicationReceipt = (
  receiptArg: plugins.servezoneInterfacesRuntime.ICorestoreCredentialPublicationReceipt,
): plugins.servezoneInterfacesRuntime.ICorestoreCredentialPublicationReceipt => ({
  mutationId: receiptArg.mutationId,
  organizationId: receiptArg.organizationId,
  clusterId: receiptArg.clusterId,
  serviceId: receiptArg.serviceId,
  bindingId: receiptArg.bindingId,
  capability: receiptArg.capability,
  grant: cloneCorestoreCredentialPublicationGrant(receiptArg.grant),
  coverage: {
    keys: receiptArg.coverage.keys.map((keyArg) => keyArg),
    versionReferences: receiptArg.coverage.versionReferences.map((referenceArg) => ({
      key: referenceArg.key,
      secretId: referenceArg.secretId,
      secretVersionId: referenceArg.secretVersionId,
    })),
  },
  expectedTargetSecretsRevision: receiptArg.expectedTargetSecretsRevision,
  targetSecretsRevision: receiptArg.targetSecretsRevision,
  ingressAdmissionBinding: {
    recipientKeyId: receiptArg.ingressAdmissionBinding.recipientKeyId,
    recipientGeneration: receiptArg.ingressAdmissionBinding.recipientGeneration,
    envelopeDigest: receiptArg.ingressAdmissionBinding.envelopeDigest,
    requestContextDigest: receiptArg.ingressAdmissionBinding.requestContextDigest,
  },
  acceptedAt: receiptArg.acceptedAt,
  replayed: receiptArg.replayed,
});

export class SecretRuntimeClient {
  constructor(
    private readonly getIdentityCredential: TGetIdentityCredential,
    private readonly fireRequest: TFireRequest,
  ) {}

  public async getSecretRecipientEnrollmentState(): Promise<
    plugins.servezoneInterfacesRuntime.IReq_GetSecretRecipientEnrollmentState['response']
  > {
    return this.fireRequest<
      plugins.servezoneInterfacesRuntime.IReq_GetSecretRecipientEnrollmentState
    >('getSecretRecipientEnrollmentState', {
      identity: this.getIdentityCredential(),
    });
  }

  public async beginSecretRecipientEnrollment(
    optionsArg: Omit<
      plugins.servezoneInterfacesRuntime.IReq_BeginSecretRecipientEnrollment['request'],
      'identity'
    >,
  ): Promise<
    plugins.servezoneInterfacesRuntime.IReq_BeginSecretRecipientEnrollment['response']
  > {
    return this.fireRequest<
      plugins.servezoneInterfacesRuntime.IReq_BeginSecretRecipientEnrollment
    >('beginSecretRecipientEnrollment', {
      identity: this.getIdentityCredential(),
      proposedRecipientKeyId: optionsArg.proposedRecipientKeyId,
      proposedPublicKey: optionsArg.proposedPublicKey,
      expectedGeneration: optionsArg.expectedGeneration,
    });
  }

  public async completeSecretRecipientEnrollment(
    optionsArg: Omit<
      plugins.servezoneInterfacesRuntime.IReq_CompleteSecretRecipientEnrollment['request'],
      'identity'
    >,
  ): Promise<
    plugins.servezoneInterfacesRuntime.IReq_CompleteSecretRecipientEnrollment['response']
  > {
    return this.fireRequest<
      plugins.servezoneInterfacesRuntime.IReq_CompleteSecretRecipientEnrollment
    >('completeSecretRecipientEnrollment', {
      identity: this.getIdentityCredential(),
      enrollmentId: optionsArg.enrollmentId,
      expectedGeneration: optionsArg.expectedGeneration,
      response: optionsArg.response,
    });
  }

  public async getCoreflowSecretRuntimeRegistrationExpectation(): Promise<
    plugins.servezoneInterfacesRuntime
      .IReq_GetCoreflowSecretRuntimeRegistrationExpectation['response']
  > {
    const response = await this.fireRequest<
      plugins.servezoneInterfacesRuntime.IReq_GetCoreflowSecretRuntimeRegistrationExpectation
    >('getCoreflowSecretRuntimeRegistrationExpectation', {
      identity: this.getIdentityCredential(),
    });
    if (isExactRecord(response, ['status', 'reason'])
      && response.status === 'unavailable'
      && unavailableExpectationReasons.has(response.reason as string)) {
      return response as plugins.servezoneInterfacesRuntime
        .IReq_GetCoreflowSecretRuntimeRegistrationExpectation['response'];
    }
    if (!isExactRecord(response, ['status', 'expectation'])
      || response.status !== 'available'
      || (await plugins.servezoneInterfacesRuntime
        .validateCoreflowSecretRuntimeRegistrationExpectation(
          response.expectation,
          Date.now(),
        )).length > 0) {
      throw new Error('secret runtime registration expectation response is invalid');
    }
    return response as plugins.servezoneInterfacesRuntime
      .IReq_GetCoreflowSecretRuntimeRegistrationExpectation['response'];
  }

  public async getResolvedSecretMaterial(
    optionsArg: plugins.servezoneInterfacesRuntime.ISecretMaterialRequestFence,
  ): Promise<plugins.servezoneInterfacesRuntime.IReq_GetResolvedSecretMaterial['response']> {
    return this.fireRequest<plugins.servezoneInterfacesRuntime.IReq_GetResolvedSecretMaterial>(
      'getResolvedSecretMaterial',
      {
        identity: this.getIdentityCredential(),
        serviceId: optionsArg.serviceId,
        imageRolloutId: optionsArg.imageRolloutId,
        imageRolloutGeneration: optionsArg.imageRolloutGeneration,
        requestedImageDigest: optionsArg.requestedImageDigest,
        secretRolloutId: optionsArg.secretRolloutId,
        secretRolloutGeneration: optionsArg.secretRolloutGeneration,
        manifestId: optionsArg.manifestId,
        manifestDigest: optionsArg.manifestDigest,
        expectedRecipientKeyId: optionsArg.expectedRecipientKeyId,
      },
    );
  }

  public async getCorestoreControlCredentialMaterial(
    optionsArg: Omit<
      plugins.servezoneInterfacesRuntime.IReq_GetCorestoreControlCredentialMaterial['request'],
      'identity'
    >,
  ): Promise<
    plugins.servezoneInterfacesRuntime.IReq_GetCorestoreControlCredentialMaterial['response']
  > {
    const response = await this.fireRequest<
      plugins.servezoneInterfacesRuntime.IReq_GetCorestoreControlCredentialMaterial
    >('getCorestoreControlCredentialMaterial', {
      identity: this.getIdentityCredential(),
      requestId: optionsArg.requestId,
      capability: optionsArg.capability,
      expectedRecipientKeyId: optionsArg.expectedRecipientKeyId,
      expectedRecipientGeneration: optionsArg.expectedRecipientGeneration,
    });
    return {
      material: cloneCorestoreControlCredentialMaterial(response.material),
    };
  }

  public async publishCorestoreCredentialMaterial(
    optionsArg: Omit<
      plugins.servezoneInterfacesRuntime.IReq_PublishCorestoreCredentialMaterial['request'],
      'identity'
    >,
  ): Promise<
    plugins.servezoneInterfacesRuntime.IReq_PublishCorestoreCredentialMaterial['response']
  > {
    const response = await this.fireRequest<
      plugins.servezoneInterfacesRuntime.IReq_PublishCorestoreCredentialMaterial
    >('publishCorestoreCredentialMaterial', {
      identity: this.getIdentityCredential(),
      mutationId: optionsArg.mutationId,
      grant: cloneCorestoreCredentialPublicationGrant(optionsArg.grant),
      expectedIngressRecipientKeyId: optionsArg.expectedIngressRecipientKeyId,
      expectedIngressRecipientGeneration: optionsArg.expectedIngressRecipientGeneration,
      envelope: cloneEnvelope(optionsArg.envelope),
    });
    return {
      receipt: cloneCorestoreCredentialPublicationReceipt(response.receipt),
    };
  }

  public async reportSecretDeploymentState(
    reportArg: plugins.servezoneInterfacesRuntime.TSecretDeploymentReport,
  ): Promise<plugins.servezoneInterfacesRuntime.IReq_ReportSecretDeploymentState['response']> {
    const common = {
      identity: this.getIdentityCredential(),
      reporterSessionId: reportArg.reporterSessionId,
      reportSequence: reportArg.reportSequence,
      serviceId: reportArg.serviceId,
      expectedPlanRevision: reportArg.expectedPlanRevision,
      desiredManifest: cloneManifestReference(reportArg.desiredManifest),
      reportedAt: reportArg.reportedAt,
      reportDigest: reportArg.reportDigest,
    } as const;
    let request: plugins.servezoneInterfacesRuntime.IReq_ReportSecretDeploymentState['request'];
    switch (reportArg.status) {
      case 'applying':
        request = { ...common, status: 'applying' };
        break;
      case 'applied':
        request = {
          ...common,
          status: 'applied',
          appliedManifest: cloneManifestReference(reportArg.appliedManifest),
        };
        break;
      case 'drifted':
        request = {
          ...common,
          status: 'drifted',
          ...(reportArg.observedManifest
            ? { observedManifest: cloneManifestReference(reportArg.observedManifest) }
            : {}),
          failureCode: reportArg.failureCode,
        };
        break;
      case 'failed':
        request = {
          ...common,
          status: 'failed',
          failureCode: reportArg.failureCode,
        };
        break;
      default:
        throw new Error('secret deployment report status is invalid');
    }
    return this.fireRequest<plugins.servezoneInterfacesRuntime.IReq_ReportSecretDeploymentState>(
      'reportSecretDeploymentState',
      request,
    );
  }
}