//! TeamClaw server: REST API and streaming gateway (later phases add the
//! scheduler and safety worker) composed into one binary.

mod e2e;

use std::path::{Path, PathBuf};
use std::process::ExitCode;
use std::sync::Arc;

use tc_config::{AppConfig, LlmProviderKind};
use tc_llm::{AnthropicProvider, LlmProvider, OpenAiCompatProvider, ScriptedProvider};
use tc_runtime::{Runtime, RuntimeConfig};

#[tokio::main]
async fn main() -> ExitCode {
    match run().await {
        Ok(()) => ExitCode::SUCCESS,
        Err(message) => {
            eprintln!("teamclaw-server: {message}");
            ExitCode::FAILURE
        }
    }
}

/// Instantiates the configured LLM provider. The Anthropic key comes from
/// the environment until the secret broker lands in P2.
fn build_provider(config: &AppConfig) -> Result<Arc<dyn LlmProvider>, String> {
    match config.llm.provider {
        LlmProviderKind::Anthropic => {
            let key = std::env::var("ANTHROPIC_API_KEY")
                .map_err(|_| "llm.provider = \"anthropic\" requires ANTHROPIC_API_KEY")?;
            Ok(Arc::new(AnthropicProvider::new(key)))
        }
        LlmProviderKind::OpenAiCompat => {
            let base_url = config.llm.base_url.clone().expect("validated by tc-config");
            Ok(Arc::new(OpenAiCompatProvider::new(
                base_url,
                std::env::var("TEAMCLAW_LLM_API_KEY").ok(),
            )))
        }
        LlmProviderKind::Scripted => {
            let path = config
                .llm
                .scenario_path
                .clone()
                .expect("validated by tc-config");
            let provider = ScriptedProvider::from_path(Path::new(&path))
                .map_err(|e| format!("scenario load failed: {e}"))?;
            Ok(Arc::new(provider))
        }
    }
}

async fn run() -> Result<(), String> {
    let config_path =
        PathBuf::from(std::env::var("TEAMCLAW_CONFIG").unwrap_or_else(|_| "teamclaw.toml".into()));
    let config = AppConfig::load_from(&config_path).map_err(|e| e.to_string())?;

    let pool = tc_db::connect(&config.database.url, config.database.max_connections)
        .await
        .map_err(|e| format!("database connection failed: {e}"))?;
    tc_db::MIGRATOR
        .run(&pool)
        .await
        .map_err(|e| format!("migrations failed: {e}"))?;

    if e2e::enabled() {
        e2e::seed(&pool).await?;
    }

    let provider = build_provider(&config)?;
    let blob: std::sync::Arc<dyn tc_files::BlobStore> = match config.storage.backend {
        tc_config::StorageBackend::Local => std::sync::Arc::new(tc_files::LocalBlobStore::new(
            PathBuf::from(&config.storage.data_dir),
        )),
        tc_config::StorageBackend::S3 => std::sync::Arc::new(
            tc_files::S3BlobStore::connect(
                config.storage.s3_endpoint.as_deref().expect("validated"),
                config.storage.s3_bucket.as_deref().expect("validated"),
                config.storage.s3_access_key.as_deref().unwrap_or_default(),
                config.storage.s3_secret_key.as_deref().unwrap_or_default(),
            )
            .map_err(|e| format!("s3 storage: {e}"))?,
        ),
    };
    // Environment tools need a container engine; absence is tolerated
    // (shell.exec reports it per-call) so the API still serves.
    let (sandboxes, browser) = if config.sandbox.enabled {
        match tc_sandbox::DockerDriver::connect() {
            Ok(driver) => {
                let driver: std::sync::Arc<dyn tc_sandbox::SandboxDriver> =
                    std::sync::Arc::new(driver);
                let agents = std::sync::Arc::new(tc_runtime::SandboxManager::new(
                    driver.clone(),
                    &config.sandbox.image,
                ));
                let agents = if config.sandbox.warm_pool > 0 {
                    agents.warm(config.sandbox.warm_pool)
                } else {
                    agents
                };
                (
                    Some(agents),
                    Some(std::sync::Arc::new(
                        tc_runtime::SandboxManager::new(driver, &config.sandbox.browser_image)
                            .with_egress(),
                    )),
                )
            }
            Err(error) => {
                eprintln!("teamclaw-server: sandbox engine unavailable: {error}");
                (None, None)
            }
        }
    } else {
        (None, None)
    };
    let runtime = Runtime::with_blob_store(
        pool.clone(),
        provider,
        RuntimeConfig {
            model: config.llm.model.clone(),
            max_tokens: 4096,
            broker_socket: Some(PathBuf::from(&config.broker.socket_path)),
            slack_base_url: config.slack.base_url.clone(),
            sandboxes,
            browser,
        },
        blob,
    );
    // Durable §15 path: expires overdue approvals and resumes decided runs
    // even if the deciding request's process died mid-flight.
    runtime.spawn_resume_sweeper(std::time::Duration::from_secs(2));
    // Routine firings (§7.6).
    tc_scheduler::Scheduler::new(pool.clone(), runtime.clone())
        .spawn(std::time::Duration::from_secs(5));

    // Hosted identity (Clerk / OIDC): pin the issuer and load its JWKS.
    let auth_verifier = match config.auth.mode {
        tc_config::AuthMode::Clerk | tc_config::AuthMode::Oidc => {
            let issuer = config
                .auth
                .issuer_url
                .as_deref()
                .expect("validated by config");
            Some(std::sync::Arc::new(
                tc_auth::JwtVerifier::discover(issuer)
                    .await
                    .map_err(|e| format!("identity issuer: {e}"))?,
            ))
        }
        tc_config::AuthMode::Local => None,
    };

    let mut app = tc_api::router(
        tc_api::AppState::new(pool, runtime)
            .with_broker(PathBuf::from(&config.broker.socket_path))
            .with_oauth(config.oauth.clone())
            .pipe_auth_verifier(auth_verifier),
    );
    if e2e::enabled() {
        app = app.merge(e2e::slack_sink_router());
    }
    let listener = tokio::net::TcpListener::bind(config.listen_addr)
        .await
        .map_err(|e| format!("bind {} failed: {e}", config.listen_addr))?;
    println!("teamclaw-server listening on {}", config.listen_addr);
    axum::serve(listener, app)
        .await
        .map_err(|e| format!("server error: {e}"))
}