package adapterimpl

import (
	"context"
	"encoding/json"

	"github.com/tidbcloud/tidb-management-service/serverless-global-service/domain/adapter"
	"github.com/tidbcloud/tidb-management-service/serverless-global-service/pkg/config"
	"github.com/tidbcloud/tidb-management-service/utilities/bizerr"
)

type sys9SecretProvider struct{}

func NewSys9SecretProvider() adapter.Sys9SecretProvider {
	return &sys9SecretProvider{}
}

func (s *sys9SecretProvider) ResolveProfile(ctx context.Context, profileRef string) (*adapter.Sys9OEMProfile, error) {
	if profileRef == "" {
		return nil, bizerr.New(bizerr.ErrCodeParams, "empty sys9 profile ref")
	}

	secretJSON, err := config.GetSecretFromAwsSecretManager(ctx, profileRef, "")
	if err != nil {
		return nil, bizerr.New(bizerr.ErrCodeUnknown, "load sys9 profile failed: %v", err)
	}

	var profile adapter.Sys9OEMProfile
	if err := json.Unmarshal([]byte(secretJSON), &profile); err != nil {
		return nil, bizerr.New(bizerr.ErrCodeUnknown, "decode sys9 profile failed: %v", err)
	}
	if profile.TemporaryDPoPPublicKey == "" {
		profile.TemporaryDPoPPublicKey = profile.DPoPPublicKey
	}
	if profile.BrandID == "" || profile.AccountID == "" || profile.Issuer == "" {
		return nil, bizerr.New(bizerr.ErrCodeParams, "invalid sys9 profile content")
	}
	if profile.EdgeBinding != nil && len(profile.EdgeBinding) == 0 {
		return nil, bizerr.New(bizerr.ErrCodeParams, "invalid sys9 profile content: edge_binding must be a non-empty object")
	}
	if profile.SubjectAnchor == "" || profile.SubjectAnchorVersion <= 0 {
		return nil, bizerr.New(bizerr.ErrCodeParams, "invalid sys9 profile content: subject_anchor and subject_anchor_version are required")
	}
	if profile.EntityAnchor == "" || profile.EntityAnchorVersion <= 0 {
		return nil, bizerr.New(bizerr.ErrCodeParams, "invalid sys9 profile content: entity_anchor and entity_anchor_version are required")
	}

	return &profile, nil
}