import {
  evaluateDomainAccess,
  verifyDomainAccessHandoffFromSnapshot,
  type DomainAccessEvidence,
  type DomainNodeType,
  type DomainAccessStatus,
} from './domain-access.js';
import {
  TrustedSignerSnapshotLoader,
  type TrustedSignerSnapshotReceipt,
} from './trusted-signer-snapshot.js';

const IDENTIFIER_PATTERN = /^[A-Z0-9][A-Z0-9._:-]{1,159}$/;

export interface DomainIdentityProjection {
  accountVerified: boolean;
  nodeId: string;
  nodeRegistrationVerified: boolean;
}

export interface DomainIdentitySource {
  read(domainId: string, nodeType: DomainNodeType): Promise<DomainIdentityProjection>;
}

export interface DomainRuntimeHandoffCandidate {
  handoff: unknown;
  signerLookup: {
    repositoryId: string;
    signerId: string;
  };
}

export interface DomainRuntimeHandoffSource {
  read(domainId: string, nodeId: string, nodeType: DomainNodeType): Promise<DomainRuntimeHandoffCandidate | null>;
}

export interface DomainAccessProjection {
  blockers: readonly string[];
  domainId: string;
  localWorkspaceAllowed: true;
  nodeId: string;
  nodeType: DomainNodeType;
  runtimeReady: boolean;
  stage: DomainAccessStatus['stage'];
  trustSource: Readonly<TrustedSignerSnapshotReceipt>;
}

function safeIdentity(input: unknown): DomainIdentityProjection {
  if (typeof input !== 'object' || input === null || Array.isArray(input)) {
    return { accountVerified: false, nodeId: '', nodeRegistrationVerified: false };
  }
  const candidate = input as Record<string, unknown>;
  const nodeId = typeof candidate.nodeId === 'string' && IDENTIFIER_PATTERN.test(candidate.nodeId)
    ? candidate.nodeId
    : '';
  return {
    accountVerified: candidate.accountVerified === true && Boolean(nodeId),
    nodeId,
    nodeRegistrationVerified: candidate.nodeRegistrationVerified === true && Boolean(nodeId),
  };
}

export class DomainAccessOrchestrator {
  constructor(
    private readonly signerSnapshots: TrustedSignerSnapshotLoader,
    private readonly identities: DomainIdentitySource,
    private readonly handoffs: DomainRuntimeHandoffSource,
  ) {}

  async domainAccess(domainId: string, nodeType: DomainNodeType, now = Date.now()): Promise<Readonly<DomainAccessProjection>> {
    if (!IDENTIFIER_PATTERN.test(domainId)) throw new Error('domain_access_domain_invalid');
    if (nodeType !== 'local-terminal' && nodeType !== 'cloud-resident') throw new Error('domain_access_node_type_invalid');
    const [snapshot, identity] = await Promise.all([
      this.signerSnapshots.refresh(),
      this.identities.read(domainId, nodeType).then(safeIdentity, () => safeIdentity(null)),
    ]);
    const evidence: DomainAccessEvidence = {
      accountVerified: identity.accountVerified,
      domainId,
      nodeId: identity.nodeId,
      nodeRegistrationVerified: identity.nodeRegistrationVerified,
      nodeType,
    };

    if (identity.accountVerified && identity.nodeRegistrationVerified) {
      let candidate: DomainRuntimeHandoffCandidate | null = null;
      try {
        candidate = await this.handoffs.read(domainId, identity.nodeId, nodeType);
      } catch {
        candidate = null;
      }
      if (candidate) {
        try {
          const verified = verifyDomainAccessHandoffFromSnapshot(
            candidate.handoff,
            domainId,
            identity.nodeId,
            nodeType,
            candidate.signerLookup,
            snapshot,
            now,
          );
          Object.assign(evidence, verified.handoff);
        } catch {
          // Untrusted or incomplete handoffs remain absent from the projection.
        }
      }
    }

    const status = evaluateDomainAccess(evidence, now);
    return Object.freeze({
      ...status,
      blockers: Object.freeze([...status.blockers]),
      trustSource: snapshot.receipt,
    });
  }
}