import { createServerFn } from "@tanstack/react-start";
import { z } from "zod";
import { requireSupabaseAuth } from "@/integrations/supabase/auth-middleware";
import { hostSchema, reportSchema } from "./security-policy";
import { AEGIS_LIVE_MODEL, AEGIS_LIVE_TOOLS, AEGIS_LIVE_VOICE, aegisLiveInstructions } from "./aegis-live-policy";

export const startAegisLive = createServerFn({ method: "POST" }).middleware([requireSupabaseAuth])
  .inputValidator((input: unknown) => z.object({ name: z.string().trim().min(1).max(40) }).parse(input))
  .handler(async ({ data }) => {
    const key = process.env["GEMINI_API_KEY"];
    const { mintLiveToken } = await import("./gemini-live.server");
    return mintLiveToken(key, {
      model: `models/${AEGIS_LIVE_MODEL}`,
      generationConfig: { responseModalities: ["AUDIO"], speechConfig: { voiceConfig: { prebuiltVoiceConfig: { voiceName: AEGIS_LIVE_VOICE } } } },
      systemInstruction: { parts: [{ text: aegisLiveInstructions(data.name) }] },
      inputAudioTranscription: {}, outputAudioTranscription: {}, tools: AEGIS_LIVE_TOOLS,
    });
  });

export const securityOverview = createServerFn({ method: "POST" }).middleware([requireSupabaseAuth]).handler(async ({ context }) => {
  const [builds, external, reports] = await Promise.all([
    context.supabase.from("voice_builds").select("id,deployed_url,created_at").eq("user_id", context.userId).not("deployed_url", "is", null).order("created_at", { ascending: false }).limit(50),
    context.supabase.from("security_sites").select("id,hostname,verification_token,verified_at").eq("user_id", context.userId).order("created_at", { ascending: false }).limit(50),
    context.supabase.from("security_reports").select("id,hostname,report,created_at").eq("user_id", context.userId).order("created_at", { ascending: false }).limit(30),
  ]);
  if (builds.error || external.error || reports.error) throw new Error("Your security workspace could not load.");
  const cloud = [...new Map((builds.data ?? []).flatMap(b => { try { return b.deployed_url ? [[new URL(b.deployed_url).hostname, { hostname: new URL(b.deployed_url).hostname, url: b.deployed_url } ] as const] : []; } catch { return []; } })).values()];
  const { readEdgeFor } = await import("./security.server");
  const edge = await readEdgeFor((external.data ?? []).filter(s => s.verified_at).map(s => s.hostname));
  return { cloud, external: external.data ?? [], reports: (reports.data ?? []).flatMap(r => { const report = reportSchema.safeParse(r.report); return report.success ? [{ id: r.id, report: report.data }] : []; }), edge };
});

export const registerSecuritySite = createServerFn({ method: "POST" }).middleware([requireSupabaseAuth]).validator((input: unknown) => z.object({ hostname: hostSchema }).parse(input)).handler(async ({ data, context }) => {
  const { error } = await context.supabase.from("security_sites").upsert({ hostname: data.hostname, user_id: context.userId }, { onConflict: "user_id,hostname", ignoreDuplicates: true });
  if (error) throw new Error("This domain could not be saved.");
  return { saved: true };
});

export const verifySecuritySite = createServerFn({ method: "POST" }).middleware([requireSupabaseAuth]).validator((input: unknown) => z.object({ id: z.string().uuid() }).parse(input)).handler(async ({ data, context }) => {
  const { data: site, error } = await context.supabase.from("security_sites").select("id,hostname,verification_token").eq("id", data.id).eq("user_id", context.userId).maybeSingle();
  if (error || !site) throw new Error("That website is not in your account.");
  const { verifyDnsOwnership } = await import("./security.server");
  const verified = await verifyDnsOwnership(site.hostname, site.verification_token);
  if (verified) {
    const { supabaseAdmin } = await import("@/integrations/supabase/client.server");
    const { error: updateError } = await supabaseAdmin.from("security_sites").update({ verified_at: new Date().toISOString() }).eq("id", site.id).eq("user_id", context.userId);
    if (updateError) throw new Error("Ownership verified, but could not be saved.");
  }
  return { verified };
});

export const scanSecuritySite = createServerFn({ method: "POST" }).middleware([requireSupabaseAuth]).validator((input: unknown) => z.object({ hostname: hostSchema, publicScanConsent: z.literal(true) }).parse(input)).handler(async ({ data, context }) => {
  const { scanPublicSite } = await import("./security.server");
  const report = await scanPublicSite(data.hostname);
  const { error } = await context.supabase.from("security_reports").insert({ user_id: context.userId, hostname: data.hostname, report });
  if (error) throw new Error("Scan completed, but saving the report failed.");
  return report;
});

export const askAegis = createServerFn({ method: "POST" }).middleware([requireSupabaseAuth]).validator((input: unknown) => z.object({ messages: z.array(z.object({ role: z.enum(["user", "assistant"]), text: z.string().trim().min(1).max(4000) })).min(1).max(20) }).parse(input)).handler(async ({ data, context }) => {
  const { data: reports, error } = await context.supabase.from("security_reports").select("hostname,report,created_at").eq("user_id", context.userId).order("created_at", { ascending: false }).limit(3);
  if (error) throw new Error("Your scan reports are unavailable.");
  const { securityAnswer } = await import("./security.server");
  return securityAnswer(data.messages, { reports: reports ?? [], enforcement: "No changes made by Aegis. DNS and edge protection must be verified separately." });
});