@kody/workos

import { resolveWorkosAuth, workosFetch, type ResolvedWorkosAuth } from './auth.ts'
import type { WorkosAuthInput, WorkosPageInfo, JsonRecord } from './types.ts'
import { requireString } from './types.ts'
import {
	WORKOS_API_BASE_URL,
	WORKOS_API_HOST,
	inferOperationFromPath,
	isMutatingMethod,
	nextStepForAuthFailure,
	type WorkosOperation,
} from './setup.ts'

export class WorkosApiError extends Error {
	readonly status: number
	readonly operation: WorkosOperation
	readonly details: unknown

	constructor(
		message: string,
		options: {
			status: number
			operation: WorkosOperation
			details: unknown
		},
	) {
		super(message)
		this.name = 'WorkosApiError'
		this.status = options.status
		this.operation = options.operation
		this.details = options.details
	}
}

export type WorkosRequestInput = WorkosAuthInput & {
	path: string
	method?: string
	query?: JsonRecord
	body?: JsonRecord
	operation?: WorkosOperation
}

export type WorkosResponse<T> = {
	data: T
	pageInfo: WorkosPageInfo
	status: number
}

export function normalizeWorkosPath(path: string): string {
	const trimmed = requireString(path, 'path')
	if (trimmed.startsWith('https://')) {
		const url = new URL(trimmed)
		if (url.host !== WORKOS_API_HOST) {
			throw new Error(`WorkOS requests must use host ${WORKOS_API_HOST}. Got ${url.host}.`)
		}
		return `${url.pathname}${url.search}`
	}
	return trimmed.startsWith('/') ? trimmed : `/${trimmed}`
}

export function workosUrl(path: string, query?: JsonRecord): string {
	const normalized = normalizeWorkosPath(path)
	const url = new URL(normalized, WORKOS_API_BASE_URL)
	if (query) {
		for (const [key, value] of Object.entries(query)) {
			if (value === undefined || value === null) continue
			if (Array.isArray(value)) {
				for (const item of value) {
					if (typeof item === 'string' || typeof item === 'number' || typeof item === 'boolean') {
						url.searchParams.append(key, String(item))
					} else {
						throw new Error(`query.${key} items must be strings, numbers, or booleans.`)
					}
				}
				continue
			}
			if (typeof value === 'boolean' || typeof value === 'number' || typeof value === 'string') {
				url.searchParams.set(key, String(value))
				continue
			}
			throw new Error(`query.${key} must be a string, number, boolean, or array of those.`)
		}
	}
	return url.toString()
}

function workosMessage(body: unknown, fallback: string): string {
	if (!body || typeof body !== 'object') return fallback
	const record = body as { message?: unknown; code?: unknown; error?: unknown }
	const message = typeof record.message === 'string' ? record.message : ''
	const code = typeof record.code === 'string' ? record.code : ''
	const error = typeof record.error === 'string' ? record.error : ''
	return [code, message || error].filter(Boolean).join(': ') || fallback
}

function pageInfoFromBody(body: unknown): WorkosPageInfo {
	const metadata =
		body && typeof body === 'object' && (body as { list_metadata?: unknown }).list_metadata
			? ((body as { list_metadata: JsonRecord }).list_metadata ?? {})
			: {}
	return {
		before: typeof metadata.before === 'string' ? metadata.before : null,
		after: typeof metadata.after === 'string' ? metadata.after : null,
	}
}

function dataFromBody(body: unknown): unknown {
	if (!body || typeof body !== 'object') return body
	const record = body as JsonRecord
	if (record.object === 'list' && Array.isArray(record.data)) return record.data
	return body
}

export async function workosRequest<T = unknown>(
	input: WorkosRequestInput,
): Promise<WorkosResponse<T>> {
	const method = (input.method ?? 'GET').toUpperCase()
	const path = requireString(input.path, 'path')
	const operation = inferOperationFromPath(method, normalizeWorkosPath(path), input.operation)
	const auth = await resolveWorkosAuth(input)
	return workosRequestWithAuth<T>(auth, {
		method,
		path,
		query: input.query,
		body: input.body,
		operation,
	})
}

export async function workosRequestWithAuth<T = unknown>(
	auth: ResolvedWorkosAuth,
	input: {
		method: string
		path: string
		query?: JsonRecord
		body?: JsonRecord
		operation: WorkosOperation
	},
): Promise<WorkosResponse<T>> {
	const url = workosUrl(input.path, input.query)
	const headers = new Headers({
		Accept: 'application/json',
		'User-Agent': 'kody-workos/1.0',
	})
	const init: RequestInit = { method: input.method, headers }
	if (input.body !== undefined) {
		headers.set('Content-Type', 'application/json')
		init.body = JSON.stringify(input.body)
	}

	const response = await workosFetch(auth, url, init)
	const text = await response.text()
	let parsed: unknown = text
	try {
		parsed = text ? JSON.parse(text) : null
	} catch {
		parsed = text
	}
	const message = workosMessage(parsed, response.statusText)
	if (!response.ok) {
		const authHint =
			response.status === 401 || response.status === 403
				? nextStepForAuthFailure(auth.secretName)
				: ''
		throw new WorkosApiError(
			[`WorkOS ${input.operation} failed (${response.status}): ${message}.`, authHint]
				.filter(Boolean)
				.join(' '),
			{
				status: response.status,
				operation: input.operation,
				details: parsed,
			},
		)
	}

	return {
		data: dataFromBody(parsed) as T,
		pageInfo: pageInfoFromBody(parsed),
		status: response.status,
	}
}

export { isMutatingMethod, inferOperationFromPath }