package runner

import (
	"context"
	"net/http"

	"github.com/tidbcloud/AgentTeam/internal/extension/connection"
	"github.com/tidbcloud/AgentTeam/internal/extension/egress"
)

// CredentialSource resolves the decrypted credential object of the single
// active App connection behind one Service installation. The server wire
// adapts the App store onto this consumer-side interface; the runtime never
// touches persistence directly.
type CredentialSource interface {
	ResolveProviderCredentials(
		ctx context.Context,
		workspaceID string,
		installationID string,
	) (Credentials, error)
}

// ConnectionConfig is the shared bounded non-secret connection fact map.
type ConnectionConfig = connection.Config

// ConnectionConfigField is one provider-owned config key with a complete
// code-defined value enum.
type ConnectionConfigField = connection.EnumField

// ConnectionConfigContract constrains prepared config to the exact
// provider-owned key and value allowlists validated during bootstrap.
type ConnectionConfigContract = connection.Contract

// ResolvedConnection is the installation-scoped runtime material for
// providers that need a persisted code-owned topology or capability choice in
// addition to credentials.
type ResolvedConnection struct {
	Credentials Credentials
	Config      ConnectionConfig
}

// ConnectionSource resolves both encrypted credentials and the non-secret
// code-owned connection config selected during validation.
type ConnectionSource interface {
	ResolveProviderConnection(
		ctx context.Context,
		workspaceID string,
		installationID string,
		configContract ConnectionConfigContract,
	) (ResolvedConnection, error)
}

// guardedProviderTransport is the shared guarded dial path for provider REST
// clients. Tests override the transport at client construction; they must
// never weaken this default.
func guardedProviderTransport() http.RoundTripper {
	transport := egress.NewGuardedTransport()
	return transport
}