package agsbridge

import (
	"regexp"
	"strings"

	agsauth "github.com/pingcap/agent-git-service/auth"

	"github.com/tidbcloud/AgentTeam/internal/identity/trusted"
)

// Provider is the AGS embedded-identity provider used for AgentTeam users.
const Provider = "agentteam"

const maxLoginLength = 39

var loginPartPattern = regexp.MustCompile(`[^a-zA-Z0-9]+`)

// FromAgentTeam converts a AgentTeam-authenticated identity into the AGS embedded
// identity shape. Callers decide whether the result should carry site-admin
// capability for an internal request.
func FromAgentTeam(identity trusted.Identity) agsauth.Identity {
	login := LoginForAgentTeam(identity)
	return agsauth.Identity{
		Provider: Provider,
		Subject:  strings.TrimSpace(identity.Subject),
		Login:    login,
		Email:    strings.TrimSpace(identity.Email),
		Name:     firstNonEmpty(identity.Name, identity.PreferredUsername, login),
		Groups:   append([]string(nil), identity.Groups...),
	}
}

// LoginForAgentTeam derives the stable AGS login used for a AgentTeam identity.
func LoginForAgentTeam(identity trusted.Identity) string {
	base := firstNonEmpty(identity.PreferredUsername, identity.Name, identity.Email, identity.Subject)
	if base == "" {
		return ""
	}
	if before, _, ok := strings.Cut(base, "@"); ok && before != "" {
		base = before
	}
	login := strings.Trim(loginPartPattern.ReplaceAllString(base, "-"), "-")
	login = strings.ToLower(login)
	if login == "" {
		login = "agentteam-user"
	}
	if len(login) > maxLoginLength {
		login = strings.Trim(login[:maxLoginLength], "-")
	}
	return login
}

func firstNonEmpty(values ...string) string {
	for _, value := range values {
		if strings.TrimSpace(value) != "" {
			return strings.TrimSpace(value)
		}
	}
	return ""
}