// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.

package console_v1

import (
	"encoding/json"
	"fmt"
	"net/url"

	"go.probo.inc/probo/pkg/coredata"
	"go.probo.inc/probo/pkg/server/api/console/v1/types"
)

// These helpers live outside connector_resolvers.go because that file is
// regenerated by gqlgen, which does not preserve standalone functions.

// apiKeyConnectorSettings marshals the provider-specific extra settings
// for an API-key connector from the typed gqlgen input into the JSON
// blob persisted on coredata.Connector.RawSettings. It returns (nil,
// nil) for providers without extra settings.
//
// Returned errors are surfaced verbatim to the client via
// gqlutils.Invalid: they must contain only field names and structural
// information, never user-supplied values.
func apiKeyConnectorSettings(input types.CreateAPIKeyConnectorInput) (json.RawMessage, error) {
	switch input.Provider {
	case coredata.ConnectorProviderTally:
		if input.TallyOrganizationID == nil || *input.TallyOrganizationID == "" {
			return nil, fmt.Errorf("cannot create tally connector: tallyOrganizationId is required")
		}

		return json.Marshal(&coredata.TallyConnectorSettings{OrganizationID: *input.TallyOrganizationID})
	case coredata.ConnectorProviderSentry:
		if input.SentryOrganizationSlug == nil || *input.SentryOrganizationSlug == "" {
			return nil, fmt.Errorf("cannot create sentry connector: sentryOrganizationSlug is required")
		}

		return json.Marshal(&coredata.SentryConnectorSettings{OrganizationSlug: *input.SentryOrganizationSlug})
	case coredata.ConnectorProviderSupabase:
		if input.SupabaseOrganizationSlug == nil || *input.SupabaseOrganizationSlug == "" {
			return nil, fmt.Errorf("cannot create supabase connector: supabaseOrganizationSlug is required")
		}

		return json.Marshal(&coredata.SupabaseConnectorSettings{OrganizationSlug: *input.SupabaseOrganizationSlug})
	case coredata.ConnectorProviderGitHub:
		if input.GithubOrganization == nil || *input.GithubOrganization == "" {
			return nil, fmt.Errorf("cannot create github connector: githubOrganization is required")
		}

		return json.Marshal(&coredata.GitHubConnectorSettings{Organization: *input.GithubOrganization})
	case coredata.ConnectorProviderGrafana:
		if input.GrafanaBaseURL == nil || *input.GrafanaBaseURL == "" {
			return nil, fmt.Errorf("cannot create grafana connector: grafanaBaseUrl is required")
		}

		u, err := url.Parse(*input.GrafanaBaseURL)
		if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
			return nil, fmt.Errorf("cannot create grafana connector: grafanaBaseUrl must be an http(s) URL")
		}

		return json.Marshal(&coredata.GrafanaConnectorSettings{BaseURL: *input.GrafanaBaseURL})
	case coredata.ConnectorProviderOnePassword:
		if input.OnePasswordScimBridgeURL == nil || *input.OnePasswordScimBridgeURL == "" {
			return nil, fmt.Errorf("cannot create 1password connector: onePasswordScimBridgeURL is required")
		}

		u, err := url.Parse(*input.OnePasswordScimBridgeURL)
		if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
			return nil, fmt.Errorf("cannot create 1password connector: onePasswordScimBridgeURL must be an http(s) URL")
		}

		return json.Marshal(&coredata.OnePasswordConnectorSettings{SCIMBridgeURL: *input.OnePasswordScimBridgeURL})
	case coredata.ConnectorProviderMetabase:
		if input.MetabaseInstanceURL == nil || *input.MetabaseInstanceURL == "" {
			return nil, fmt.Errorf("cannot create metabase connector: metabaseInstanceUrl is required")
		}

		u, err := url.Parse(*input.MetabaseInstanceURL)
		if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
			return nil, fmt.Errorf("cannot create metabase connector: metabaseInstanceUrl must be an http(s) URL")
		}

		return json.Marshal(&coredata.MetabaseConnectorSettings{InstanceURL: *input.MetabaseInstanceURL})
	}

	return nil, nil
}

// clientCredentialsConnectorSettings marshals the provider-specific
// extra settings for a client-credentials connector. See
// apiKeyConnectorSettings for the error contract.
func clientCredentialsConnectorSettings(input types.CreateClientCredentialsConnectorInput) (json.RawMessage, error) {
	switch input.Provider {
	case coredata.ConnectorProviderOnePassword:
		if input.OnePasswordAccountID == nil || *input.OnePasswordAccountID == "" ||
			input.OnePasswordRegion == nil || *input.OnePasswordRegion == "" {
			return nil, fmt.Errorf("cannot create 1password connector: onePasswordAccountId and onePasswordRegion are required")
		}

		return json.Marshal(&coredata.OnePasswordUsersAPISettings{
			AccountID: *input.OnePasswordAccountID,
			Region:    *input.OnePasswordRegion,
		})
	}

	return nil, nil
}