/**
 * Configuration schema for the guardrails extension.
 *
 * GuardrailsConfig is the user-facing schema (all fields optional).
 * ResolvedConfig is the internal schema (all fields required, defaults applied).
 */
import type { GuardrailsFeatureId } from "../events";

/**
 * A path grant with an explicit kind. Re-exported from the core path module so
 * config consumers can import it from one place.
 */
export type { AllowedPath } from "../../core/paths/path";

import type { AllowedPath } from "../../core/paths/path";

/**
 * A pattern with explicit matching mode.
 * Default: glob for files, substring for commands.
 * regex: true means full regex matching.
 */
export interface PatternConfig {
  pattern: string;
  /** Optional description surfaced to the agent when the pattern triggers (e.g. auto-deny reason). */
  description?: string;
  regex?: boolean;
}

/**
 * Permission gate pattern. When regex is false (default), the pattern
 * is matched as substring against the raw command string.
 * When regex is true, uses full regex against the raw string.
 */
export interface DangerousPattern extends PatternConfig {
  description: string;
}

/**
 * Protection level for a policy rule.
 */
export type Protection = "none" | "readOnly" | "noAccess";

/**
 * A named policy rule. Matches files by patterns and enforces a protection level.
 */
export interface PolicyRule {
  /** Stable identifier used for deduplication across scopes. */
  id: string;
  /** Optional display name for settings/UI. */
  name?: string;
  /** Human-readable description. */
  description?: string;
  /** File patterns to protect. */
  patterns: PatternConfig[];
  /** Optional exceptions. */
  allowedPatterns?: PatternConfig[];
  /** Protection level. */
  protection: Protection;
  /** Block only when file exists on disk. Default true. */
  onlyIfExists?: boolean;
  /**
   * Allow loading the file with the shell `source` / `.` builtin even when
   * access is otherwise blocked. The values become environment variables of
   * that command without the file contents entering the agent's context.
   * Default false.
   */
  allowSourcing?: boolean;
  /** Message shown when blocked; supports {file} placeholder. */
  blockMessage?: string;
  /** Per-rule toggle. Default true. */
  enabled?: boolean;
}

export type PathAccessMode = "allow" | "ask" | "block";

/**
 * A workspace root: a directory outside cwd the agent may treat as part of
 * its workspace. Roots are announced in the system prompt and allowed by
 * path-access.
 */
export interface WorkspaceRootEntry {
  /** Directory path. Supports ~/ for home; relative paths resolve from cwd. */
  path: string;
  /** Optional short name used in autocomplete and the system prompt. */
  alias?: string;
}

export interface WorkspaceRootsConfig {
  /** Workspace root directories. Merged across scopes, deduplicated by path. */
  roots?: WorkspaceRootEntry[];
}

export interface PathAccessConfig {
  mode?: PathAccessMode;
  /**
   * Paths always allowed, regardless of cwd. Each entry carries an explicit
   * `kind`: `file` matches the exact path, `directory` matches the directory
   * and its descendants.
   */
  allowedPaths?: AllowedPath[];
}

export interface AuditConfig {
  /** Append blocked/prompted/risk events to a JSONL audit log. Default true. */
  enabled?: boolean;
  /** Audit log file path. Supports ~/ for home. */
  path?: string;
}

export interface GuardrailsConfig {
  /** JSON Schema URL for editor autocomplete and validation. Added automatically when Guardrails writes the file. */
  $schema?: string;
  /** Enable or disable all Guardrails checks. */
  enabled?: boolean;
  /** When true, include Guardrails built-in policy rules before user rules are merged. */
  applyBuiltinDefaults?: boolean;
  /** Tracks whether the setup wizard has been completed. Usually managed by Guardrails. */
  onboarding?: {
    /** Whether onboarding is complete. */
    completed?: boolean;
    /** ISO timestamp for when onboarding completed. */
    completedAt?: string;
  };
  /** Enable or disable individual Guardrails feature extensions. */
  features?: Partial<Record<GuardrailsFeatureId, boolean>>;
  /** File protection policies. */
  policies?: {
    /** Named policy rules. Rules with the same id override earlier rules across scopes. */
    rules?: PolicyRule[];
  };
  /** Outside-workspace path access settings. */
  pathAccess?: PathAccessConfig;
  /** Workspace roots: extra directories the agent knows about and may access. */
  workspaceRoots?: WorkspaceRootsConfig;
  /** Audit log of guardrails decisions. */
  audit?: AuditConfig;
  /** Dangerous bash command detection and confirmation settings. */
  permissionGate?: {
    /** Additional dangerous command patterns. */
    patterns?: DangerousPattern[];
    /** If set, replaces the default dangerous command patterns entirely. */
    customPatterns?: DangerousPattern[];
    /** When true, prompt before running dangerous commands. When false, only warn. */
    requireConfirmation?: boolean;
    /** Command patterns that bypass dangerous command prompts. */
    allowedPatterns?: PatternConfig[];
    /** Command patterns that are always blocked without prompting. */
    autoDenyPatterns?: PatternConfig[];
  };
}

export interface ResolvedConfig {
  enabled: boolean;
  applyBuiltinDefaults: boolean;
  features: Record<GuardrailsFeatureId, boolean>;
  policies: {
    rules: PolicyRule[];
  };
  pathAccess: {
    mode: PathAccessMode;
    allowedPaths: AllowedPath[];
  };
  workspaceRoots: {
    roots: WorkspaceRootEntry[];
  };
  audit: {
    enabled: boolean;
    path: string;
  };
  permissionGate: {
    patterns: DangerousPattern[];
    /** When true, use hardcoded structural matchers for built-in patterns.
     *  Set to false when customPatterns replaces the defaults. */
    useBuiltinMatchers: boolean;
    requireConfirmation: boolean;
    allowedPatterns: PatternConfig[];
    autoDenyPatterns: PatternConfig[];
  };
}