dev.ts

import { APP_ENV, DEVTOOL_ACCESS_TOKEN } from '@01edu/api/env'
import { respond } from '@01edu/api/response'
import type { RequestContext } from '@01edu/types/context'
import { route } from '@01edu/api/router'
import { ARR, OBJ, optional, STR } from '@01edu/api/validator'
import type { Sql } from '@01edu/db'

/**
 * Authorizes access to developer routes.
 * Checks for `DEVTOOL_ACCESS_TOKEN` in the Authorization header.
 * In non-prod environments, access is allowed if no token is configured.
 *
 * @param ctx - The request context.
 * @throws {respond.UnauthorizedError} If access is denied.
 */
export const authorizeDevAccess = ({ req }: RequestContext) => {
  if (APP_ENV !== 'prod') return // always open for dev env
  const auth = req.headers.get('Authorization') || ''
  const bearer = auth.toLowerCase().startsWith('bearer ')
    ? auth.slice(7).trim()
    : ''
  if (bearer && bearer === DEVTOOL_ACCESS_TOKEN) return
  throw new respond.UnauthorizedError({ message: 'Unauthorized access' })
}

/**
 * Creates a route handler for executing arbitrary SQL queries.
 * Useful for debugging and development tools.
 *
 * @param sql - The SQL tag function to use for execution.
 * @returns A route handler configuration.
 */
export const createSqlDevRoute = (sql?: Sql) => {
  return route({
    authorize: authorizeDevAccess,
    fn: (_, { query, params }) => {
      try {
        if (!sql) {
          return respond.NotImplemented({
            message: 'Database not configured',
          })
        }
        return sql`${query}`.all(params)
      } catch (error) {
        throw new respond.BadRequestError({
          message: error instanceof Error ? error.message : 'Unexpected Error',
        })
      }
    },
    input: OBJ({
      query: STR('The SQL query to execute'),
      params: optional(OBJ({}, 'The parameters to bind to the query')),
    }),
    output: ARR(
      optional(OBJ({}, 'A single result row')),
      'List of results',
    ),
    description: 'Execute an SQL query',
  })
}

/**
 * Creates a route handler for receiving the DevTools logging token.
 * This allows the local app to send logs to the connected DevTools instance.
 */
export const createDevToolsHandshakeRoute = () => {
    return route({
        fn: (_, { token }) => {
            // @ts-ignore: Call hidden method
            const setToken = globalThis.__DEVTOOLS_SET_TOKEN__
            if (typeof setToken === 'function') {
                setToken(token)
                return { success: true }
            }
            return respond.NotImplemented({ message: 'Logger not configured for dynamic updates' })
        },
        input: OBJ({
            token: STR('The logging token from DevTools'),
        }),
        output: OBJ({}, 'Success response'),
        description: 'Receive DevTools logging token',
    })
}