package provider

import (
	"context"
	"fmt"
	"strings"

	"github.com/tidbcloud/AgentTeam/internal/coredb"
	"github.com/tidbcloud/AgentTeam/internal/store/model"
)

// Provider config kinds stored in the canonical service_provider_configs
// provider_kind column.
const (
	ProviderConfigKindGitHub = "github"
	ProviderConfigKindGitea  = "gitea"
)

// resolveProviderConfigCreatorMemberID resolves a human user id to its active
// workspace member id for the canonical service_provider_configs
// created_by_member_id foreign key.
func resolveProviderConfigCreatorMemberID(ctx context.Context, queryer coredb.QueryRower, workspaceID string, userID string) (string, error) {
	workspaceID = strings.TrimSpace(workspaceID)
	userID = strings.TrimSpace(userID)
	if workspaceID == "" || userID == "" {
		return "", badRequest("provider config creator workspace and user are required")
	}
	var memberID string
	err := queryer.QueryRow(ctx, `
SELECT id
FROM members
WHERE workspace_id = $1
  AND user_id = $2
  AND type = 'human'
  AND status = 'active'
LIMIT 1
`, workspaceID, userID).Scan(&memberID)
	if err != nil {
		return "", fmt.Errorf("resolve provider config creator member: %w", err)
	}
	return strings.TrimSpace(memberID), nil
}

// githubProviderConfigJSON builds the secret-free config column for a GitHub
// provider config. Credential-bearing fields live only in the credential
// envelope, never in this projection.
func githubProviderConfigJSON(appID int64, htmlURL string, ownerLogin string, ownerID int64) ([]byte, error) {
	return model.MarshalJSONObject("github provider config", map[string]any{
		"githubAppId": appID,
		"htmlUrl":     htmlURL,
		"ownerLogin":  ownerLogin,
		"ownerId":     ownerID,
	})
}

// githubProviderCredentialEnvelopeJSON builds the encrypted credential envelope
// column for a GitHub provider config. Callers pass the encrypted ciphertexts,
// never plaintext secrets.
func githubProviderCredentialEnvelopeJSON(clientID string, encryptedClientSecret string, encryptedPrivateKeyPEM string, encryptedWebhookSecret string) ([]byte, error) {
	return model.MarshalJSONObject("github provider credential envelope", map[string]any{
		"clientId":      clientID,
		"clientSecret":  encryptedClientSecret,
		"privateKeyPem": encryptedPrivateKeyPEM,
		"webhookSecret": encryptedWebhookSecret,
	})
}

// giteaProviderConfigJSON builds the secret-free config column for a Gitea
// provider config.
func giteaProviderConfigJSON(instanceURL string) ([]byte, error) {
	return model.MarshalJSONObject("gitea provider config", map[string]any{
		"instanceUrl": instanceURL,
	})
}

// giteaProviderCredentialEnvelopeJSON builds the encrypted credential envelope
// column for a Gitea provider config.
func giteaProviderCredentialEnvelopeJSON(encryptedAPIToken string, encryptedWebhookSecret string) ([]byte, error) {
	return model.MarshalJSONObject("gitea provider credential envelope", map[string]any{
		"apiToken":      encryptedAPIToken,
		"webhookSecret": encryptedWebhookSecret,
	})
}