// `orders.place` — EXECUTOR (server-only, default export).
//
// Inserts the order and publishes a declared domain event in the SAME
// transaction. `ctx.events.publish(...)` fires on COMMIT and not at all on
// rollback, so a rolled-back order can neither start a fulfillment workflow nor
// tell a connected client that it exists — you do not have to sequence the two
// by hand.

import { assertOwnTenant } from '@voltro/plugin-multitenancy/guard'
import { Effect } from 'effect'
import type { AppContext } from '@voltro/runtime'
import { orderPlaced } from '../events/orders.event'

const execute = (
  input: { tenantId: string; customerName: string; amountCents: number },
  ctx: AppContext,
) => Effect.gen(function* () {
  // Cross-tenant write guard — reject a caller spoofing input.tenantId.
  assertOwnTenant(input.tenantId, ctx.request.subject)

  // Framework auto-injects an `order_…` id + the tenant/audit columns.
  const row = yield* Effect.promise(() => ctx.store.insert('orders', {
    status:       'placed',
    customerName: input.customerName,
    amountCents:  input.amountCents,
    tenantId:     input.tenantId,
  }))

  // One publish, both audiences: the `order.placed` trigger starts the
  // `orders.fulfill` workflow, and any client watching this order sees it live.
  // Both on the commit boundary — they cannot disagree about whether it
  // happened.
  yield* ctx.events!.publish(orderPlaced, { orderId: row['id'] as string }, {
    orderId:  row['id'] as string,
    tenantId: input.tenantId,
  })

  return {
    id:           row['id'] as string,
    status:       row['status'] as string,
    customerName: row['customerName'] as string,
    amountCents:  row['amountCents'] as number,
    tenantId:     row['tenantId'] as string,
  }
})

export default execute