import {
  refreshSharedDesktopAuthSession,
  sharedDesktopAuthAccounts,
} from '../../src/auth/shared-session'
import { CHOOSE_ACCOUNT_HINT, resolveCliAuth } from '../auth'
import { rnxExit } from '../run-rnx'

function printHelp(): void {
  console.log(`
rnx auth — inspect CLI auth

usage:
  rnx auth

API keys are read from RNX_API_KEY.
Use \`rnx login\` to sign in and \`rnx logout\` to clear the desktop session.
`)
}

async function printStatus(): Promise<number> {
  const auth = resolveCliAuth()
  if (!auth) {
    console.log('  not signed in')
    console.log('  set RNX_API_KEY=sk_rnx_... or run `rnx login`')
    return 1
  }

  if (auth.kind === 'api-key') {
    console.log(`  api key ${auth.secret.slice(0, 14)}...`)
    console.log(`  source: ${auth.envName} env var`)
    return 0
  }

  if (auth.kind === 'github') {
    console.log(`  github token (${auth.source})`)
    console.log(`  repo: ${auth.repoId}`)
    return 0
  }

  const current = await refreshSharedDesktopAuthSession(auth.origin)
  const user = current?.user
  const accounts = sharedDesktopAuthAccounts(user)
  const accountId = current?.accountId ?? auth.accountId
  const account = accounts.find((candidate) => candidate.id === accountId)
  console.log(`  ${user?.email || user?.name || user?.id || 'signed in'}`)
  console.log(
    `  account: ${
      account ? `${account.name} (${account.id})` : (accountId ?? CHOOSE_ACCOUNT_HINT)
    }`,
  )
  console.log(`  origin: ${current?.origin ?? auth.origin}`)
  if (current?.updatedAt) console.log(`  updated: ${current.updatedAt}`)
  return 0
}

export async function runAuth(args: string[]): Promise<void> {
  if (args.includes('--help') || args.includes('-h')) {
    printHelp()
    return
  }

  const sub = args.find((arg) => !arg.startsWith('-'))
  if (!sub || sub === 'status') {
    process.exitCode = await printStatus()
    return
  }

  console.error(`  unknown auth command: ${sub}`)
  printHelp()
  rnxExit(1)
}