/**
 * adona-robot: the one call that must stay on your server.
 *
 * Node 18+ (global fetch), no dependency. Your API key never leaves this process:
 * it is exchanged at POST /v1/tokens for a twelve-hour token per end user, and the
 * browser only ever sees that token (see browser.ts).
 *
 * Mount `tokenFor` behind a route of your own, after your own login has decided who
 * the end user is. With Express, for example:
 *
 *   app.post("/market-token", requireLogin, async (req, res) => {
 *     try {
 *       res.json(await tokenFor(req.user.id, { fresh: req.query.fresh === "1" }));
 *     } catch (error) {
 *       // A key the API refused (revoked, trial ended) is an answer: 403, and the
 *       // browser stops. Anything else is temporary: 503, and the browser retries.
 *       const answer = error instanceof Refused && error.status >= 400 && error.status < 500 && error.status !== 429;
 *       res.status(answer ? 403 : 503).json({ error: String(error) });
 *     }
 *   });
 */

const API = "https://api.adona-robot.com";
const KEY = process.env.ADONA_API_KEY ?? ""; // adk_live_...
if (!KEY.startsWith("adk_")) throw new Error("ADONA_API_KEY is not set: it starts with adk_live_ or adk_test_");

export interface MarketToken {
  access_token: string;
  /** Seconds the token is still valid for. */
  expires_in: number;
}

export class Refused extends Error {
  constructor(
    readonly status: number,
    /** The part of `detail` before the first colon: branch on this. */
    readonly code: string,
  ) {
    super(`${status} ${code}`);
  }
}

// One token per end user, reused until a minute before it expires: minting one per
// page view spends the account's 300 token requests a minute for nothing.
const cache = new Map<string, { token: string; until: number }>();
const inFlight = new Map<string, Promise<MarketToken>>();
const lastFresh = new Map<string, number>();

const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));

/**
 * `fresh` skips the cache, for a browser whose token was refused after a key
 * rotation. It is honoured at most once a minute per end user, so a page that
 * asks for it in a loop cannot spend the account's budget.
 */
export function tokenFor(endUserId: string, { fresh = false } = {}): Promise<MarketToken> {
  const now = Date.now();
  const hit = cache.get(endUserId);
  const honourFresh = fresh && now - (lastFresh.get(endUserId) ?? 0) > 60_000;
  if (honourFresh) lastFresh.set(endUserId, now);
  if (hit && hit.until > now && !honourFresh) {
    return Promise.resolve({ access_token: hit.token, expires_in: Math.floor((hit.until - now) / 1000) + 60 });
  }
  // Two calls for the same end user at once share one mint.
  const pending = inFlight.get(endUserId) ?? mint(endUserId).finally(() => inFlight.delete(endUserId));
  inFlight.set(endUserId, pending);
  return pending;
}

async function mint(endUserId: string, attempts = 5): Promise<MarketToken> {
  for (let attempt = 0; ; attempt++) {
    let status = 0;
    let code = "NETWORK";
    let retryAfter = 0;
    try {
      const response = await fetch(`${API}/v1/tokens`, {
        method: "POST",
        headers: { Authorization: `Bearer ${KEY}`, "Content-Type": "application/json" },
        body: JSON.stringify({ end_user_id: endUserId }),
      });
      if (response.ok) {
        const body = (await response.json()) as MarketToken;
        const now = Date.now();
        remember(endUserId, { token: body.access_token, until: now + (body.expires_in - 60) * 1000 });
        return { access_token: body.access_token, expires_in: body.expires_in };
      }
      status = response.status;
      const detail = String(((await response.json().catch(() => ({}))) as { detail?: unknown }).detail ?? "");
      code = detail.split(":")[0].trim();
      retryAfter = Number(response.headers.get("Retry-After")) || 0;
    } catch {
      // The network: retried below like a 5xx.
    }
    // 429 TOO_MANY_ATTEMPTS clears within the minute; 5xx and the network are
    // temporary. Anything else (a revoked key, an ended trial) will not clear.
    const retryable = status === 0 || status === 429 || status >= 500;
    if (!retryable || attempt === attempts - 1) throw new Refused(status, code);
    await sleep(1000 * (retryAfter > 0 ? retryAfter : 2 ** attempt));
  }
}

function remember(endUserId: string, entry: { token: string; until: number }) {
  cache.set(endUserId, entry);
  // Forget expired tokens now and then, so the map holds live end users only.
  if (cache.size % 1000 === 0) {
    const now = Date.now();
    for (const [id, { until }] of cache) if (until <= now) cache.delete(id);
    for (const [id, at] of lastFresh) if (now - at > 60_000) lastFresh.delete(id);
  }
}