@kody/workos

import { inferOperationFromPath, isMutatingMethod, workosRequest, workosUrl } from './client.ts'
import { WORKOS_API_BASE_URL } from './setup.ts'
import type { JsonRecord, WorkosAuthInput } from './types.ts'
import { optionalBoolean, optionalString, requireRecord, requireString } from './types.ts'

export type WorkosRawRequestInput = WorkosAuthInput & {
	path: string
	method?: string
	query?: JsonRecord
	body?: JsonRecord
	confirm?: boolean
	dryRun?: boolean
}

/**
 * Call the WorkOS REST API with a saved API key. Unknown and mutating
 * operations require `confirm: true`; use `dryRun: true` to preview. Prefer
 * named helpers for organizations, users, SSO, and directories.
 * @example
 * import request from 'kody:@kody/workos/request'
 * const result = await request({ path: '/organizations', query: { limit: 5 } })
 */
export async function request(input: WorkosRawRequestInput) {
	const path = requireString(input.path, 'path')
	const method = (input.method ?? 'GET').toUpperCase()
	const operation = inferOperationFromPath(method, path)
	const secretName = optionalString(input.secretName, 'secretName')
	const account = optionalString(input.account, 'account')
	const mutating = isMutatingMethod(method)

	if (input.dryRun) {
		return {
			dryRun: true,
			url: workosUrl(path, input.query),
			apiBaseUrl: WORKOS_API_BASE_URL,
			method,
			operation,
			path,
			query: input.query ?? {},
			body: input.body ?? null,
			secretName: secretName ?? null,
			account: account ?? null,
			readOnly: !mutating,
		}
	}

	if (mutating && input.confirm !== true) {
		throw new Error(
			'This WorkOS request may mutate data. Pass confirm: true only after explicit user approval, or use dryRun: true.',
		)
	}

	return workosRequest({
		path,
		method,
		query: input.query,
		body: input.body,
		operation,
		account,
		secretName,
	})
}

/**
 * Call the WorkOS REST API with a saved API key. Mutating methods require
 * `confirm: true`; use `dryRun: true` to preview.
 * @example
 * import request from 'kody:@kody/workos/request'
 * const result = await request({ path: '/organizations' })
 */
export default async function requestEntrypoint(
	params: Partial<WorkosRawRequestInput> & Record<string, unknown> = {},
) {
	const input = requireRecord(params, 'request')
	return request({
		path: requireString(input.path, 'path'),
		method: optionalString(input.method, 'method'),
		query: input.query as JsonRecord | undefined,
		body: input.body as JsonRecord | undefined,
		account: optionalString(input.account, 'account'),
		secretName: optionalString(input.secretName, 'secretName'),
		confirm: optionalBoolean(input.confirm, 'confirm'),
		dryRun: optionalBoolean(input.dryRun, 'dryRun'),
	})
}