import type { Permission, ServiceTokenEntry } from "@/lib/constants/auth";
import { forbidden, unauthorized } from "@/modules/auth/errors";

export type VerifiedServiceToken = {
  customerId: string;
  permissions: Permission[];
};

let cachedTokenMap: Map<string, ServiceTokenEntry> | null = null;

function loadTokenMap(): Map<string, ServiceTokenEntry> {
  if (cachedTokenMap) {
    return cachedTokenMap;
  }

  const raw = process.env.HOST_SERVICE_TOKENS;
  if (!raw) {
    cachedTokenMap = new Map();
    return cachedTokenMap;
  }

  let parsed: Record<string, ServiceTokenEntry>;
  try {
    parsed = JSON.parse(raw) as Record<string, ServiceTokenEntry>;
  } catch {
    throw new Error("HOST_SERVICE_TOKENS 配置无效");
  }

  cachedTokenMap = new Map(Object.entries(parsed));
  return cachedTokenMap;
}

/** 测试专用：重置缓存 */
export function resetServiceTokenCache(): void {
  cachedTokenMap = null;
}

/** 校验宿主 Service Token 与 customer_id 租户绑定 */
export function verifyServiceToken(
  token: string,
  customerId: string,
): VerifiedServiceToken {
  const entry = loadTokenMap().get(token);
  if (!entry) {
    throw unauthorized("Service Token 无效");
  }
  if (entry.customerId !== customerId) {
    throw forbidden("customer_id 与令牌租户不匹配");
  }
  return {
    customerId: entry.customerId,
    permissions: entry.permissions ?? [],
  };
}

/** 已注册宿主客户 ID 集合（markup 写操作校验用） */
export function listRegisteredCustomerIds(): string[] {
  const ids = new Set<string>();
  for (const entry of loadTokenMap().values()) {
    ids.add(entry.customerId);
  }

  const registry = process.env.CUSTOMER_REGISTRY;
  if (registry) {
    for (const part of registry.split(",")) {
      const id = part.trim();
      if (id) {
        ids.add(id);
      }
    }
  }

  return [...ids].sort();
}

export function isKnownCustomer(customerId: string): boolean {
  return listRegisteredCustomerIds().includes(customerId);
}

/** 仅校验 token 存在（middleware 用，不含 customer 绑定） */
export function parseServiceToken(token: string): VerifiedServiceToken | null {
  const entry = loadTokenMap().get(token);
  if (!entry) {
    return null;
  }
  return {
    customerId: entry.customerId,
    permissions: entry.permissions ?? [],
  };
}