import { isRecord, stringValue } from "./utils.js";
import { ENV_API_KEY, WORKOS_TOKEN_PREFIX } from "./env.js";
import { walkAuthPaths, walkClineProviderSettings, type AuthKeyOptions } from "./config-store.js";

export {
  defaultAuthPaths,
  walkAuthPaths,
  walkClineProviderSettings,
  type AuthKeyOptions,
} from "./config-store.js";

const PI_AUTH_FIELDS = ["clinefree", "clinepass"] as const;

function resolveClineProvidersKey(parsed: Record<string, unknown>): string | undefined {
  return walkClineProviderSettings(parsed, (settings) => stringValue(settings.apiKey));
}

function resolvePiProviderApiKey(parsed: Record<string, unknown>): string | undefined {
  for (const field of PI_AUTH_FIELDS) {
    const value = parsed[field];
    if (typeof value === "string") return value;
    if (!isRecord(value)) continue;

    const access = stringValue(value.access);
    if (access && !access.startsWith(WORKOS_TOKEN_PREFIX)) return access;
  }
  return undefined;
}

export function resolveApiKey(
  providedKey?: string,
  options: AuthKeyOptions = {},
): string | undefined {
  if (providedKey) return providedKey;

  const env = options.env ?? process.env;
  if (env[ENV_API_KEY]) return env[ENV_API_KEY];

  return walkAuthPaths(options, (parsed) => {
    const clineKey = resolveClineProvidersKey(parsed);
    if (clineKey) return clineKey;

    const apiKey = stringValue(parsed.apiKey);
    if (apiKey) return apiKey;

    return resolvePiProviderApiKey(parsed);
  });
}