package app

import (
	"context"
	"fmt"
	"strings"
	"time"

	"github.com/tidbcloud/AgentTeam/internal/core/secrets"
	"github.com/tidbcloud/AgentTeam/internal/store/serviceactor"
)

// ResolveAppRuntimeWorkspaceByBearerToken resolves either an active App runner
// credential or a live runner-stream delivery token without mutating its
// last-used state. Both token columns are uniquely indexed; the distinct count
// only guards against a cross-table hash collision and keeps routing fail-closed.
func (store *Store) ResolveAppRuntimeWorkspaceByBearerToken(ctx context.Context, bearerToken string) (string, bool, error) {
	if store == nil || store.db == nil {
		return "", false, fmt.Errorf("App runtime workspace resolver is not configured")
	}
	token := strings.TrimSpace(bearerToken)
	if token == "" {
		return "", false, nil
	}
	now := time.Now().UTC()
	row := store.db.QueryRow(ctx, `
SELECT COALESCE(MIN(workspace_id), ''), COUNT(DISTINCT workspace_id)
FROM (
  SELECT workspace_id
  FROM service_runtime_credentials
  WHERE token_hash = $1
    AND service_kind = $2
    AND credential_kind = $3
    AND transport_kind = $4
    AND status = $5
    AND (expires_at IS NULL OR expires_at > $6)
  UNION ALL
  SELECT workspace_id
  FROM service_event_delivery_attempts
  WHERE delivery_token_hash = $1
    AND transport_kind = $4
    AND status IN ($7, $8, $9, $10)
    AND (delivery_token_expires_at IS NULL OR delivery_token_expires_at > $6)
) app_runtime_tokens
`, secrets.HashToken(token), serviceactor.KindApp, serviceactor.RuntimeCredentialKindRunnerStreamToken,
		serviceactor.RuntimeTransportKindRunnerStream, serviceactor.RuntimeCredentialStatusActive, now,
		serviceactor.DeliveryAttemptStatusLeased, serviceactor.DeliveryAttemptStatusDelivered,
		serviceactor.DeliveryAttemptStatusAcked, serviceactor.DeliveryAttemptStatusFailed)
	var workspaceID string
	var workspaceCount int
	if err := row.Scan(&workspaceID, &workspaceCount); err != nil {
		return "", false, fmt.Errorf("resolve App runtime workspace by token: %w", err)
	}
	workspaceID = strings.TrimSpace(workspaceID)
	if workspaceCount != 1 || workspaceID == "" {
		return "", false, nil
	}
	return workspaceID, true, nil
}