{-# LANGUAGE TemplateHaskell #-}

-- This file is part of the Wire Server implementation.
--
-- Copyright (C) 2025 Wire Swiss GmbH <opensource@wire.com>
--
-- This program is free software: you can redistribute it and/or modify it under
-- the terms of the GNU Affero General Public License as published by the Free
-- Software Foundation, either version 3 of the License, or (at your option) any
-- later version.
--
-- This program is distributed in the hope that it will be useful, but WITHOUT
-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-- details.
--
-- You should have received a copy of the GNU Affero General Public License along
-- with this program. If not, see <https://www.gnu.org/licenses/>.

module Wire.BrigAPIAccess where

import Data.Aeson
import Data.ByteString.Conversion
import Data.Handle (Handle)
import Data.HavePendingInvitations (HavePendingInvitations (..))
import Data.Id
import Data.Misc
import Data.Qualified
import Imports
import Network.HTTP.Types.Status
import Network.Wai.Utilities.Error qualified as Wai
import Polysemy
import Polysemy.Error
import SAML2.WebSSO qualified as SAML
import Web.Cookie (SetCookie)
import Web.Scim.Filter qualified as Scim
import Wire.API.Connection
import Wire.API.Error
import Wire.API.Error.Galley
import Wire.API.Locale
import Wire.API.MLS.CipherSuite
import Wire.API.Routes.Internal.Brig
import Wire.API.Routes.Internal.Brig.Connection
import Wire.API.Routes.Internal.Galley.TeamFeatureNoConfigMulti qualified as Multi
import Wire.API.Team.Export
import Wire.API.Team.Feature
import Wire.API.Team.Role (Role)
import Wire.API.Team.Size
import Wire.API.User
import Wire.API.User.Auth (CookieLabel)
import Wire.API.User.Auth.ReAuth
import Wire.API.User.Client
import Wire.API.User.Client.Prekey
import Wire.API.User.RichInfo
import Wire.API.UserGroup
import Wire.API.UserGroup.Pagination

data DeleteGroupManagedError = DeleteGroupManagedManagedByMismatch
  deriving (Eq, Show)

-- | When receiving tokens from other services which are 'just passing through'
-- it's error-prone useless extra work to parse and render them from JSON over and over again.
-- We'll just wrap them with this to give some level of typesafety and a reasonable JSON
-- instance
newtype OpaqueAuthToken = OpaqueAuthToken
  { opaqueAuthTokenToText :: Text
  }
  deriving newtype (Eq, Show, FromJSON, ToJSON, ToByteString)

data BrigAPIAccess m a where
  GetConnectionsUnqualified ::
    [UserId] ->
    Maybe [UserId] ->
    Maybe Relation ->
    BrigAPIAccess m [ConnectionStatus]
  GetConnections ::
    [UserId] ->
    Maybe [Qualified UserId] ->
    Maybe Relation ->
    BrigAPIAccess m [ConnectionStatusV2]
  PutConnectionInternal :: UpdateConnectionsInternal -> BrigAPIAccess m Status
  ReauthUser :: UserId -> ReAuthUser -> BrigAPIAccess m (Either AuthenticationError ())
  LookupActivatedUsers :: [UserId] -> BrigAPIAccess m [User]
  GetUsers :: [UserId] -> BrigAPIAccess m [User]
  DeleteUser :: UserId -> BrigAPIAccess m ()
  GetContactList :: UserId -> BrigAPIAccess m [UserId]
  GetSize :: TeamId -> BrigAPIAccess m TeamSize
  LookupClients :: [UserId] -> BrigAPIAccess m UserClients
  LookupClientsFull :: [UserId] -> BrigAPIAccess m UserClientsFull
  NotifyClientsAboutLegalHoldRequest ::
    UserId ->
    UserId ->
    LastPrekey ->
    BrigAPIAccess m ()
  GetLegalHoldAuthToken ::
    UserId ->
    Maybe PlainTextPassword6 ->
    BrigAPIAccess m OpaqueAuthToken
  AddLegalHoldClientToUserEither ::
    UserId ->
    ConnId ->
    [UncheckedPrekeyBundle] ->
    LastPrekey ->
    BrigAPIAccess m (Either AuthenticationError ClientId)
  RemoveLegalHoldClientFromUser :: UserId -> BrigAPIAccess m ()
  GetAccountConferenceCallingConfigClient :: UserId -> BrigAPIAccess m (Feature ConferenceCallingConfig)
  GetLocalMLSClients :: Local UserId -> CipherSuiteTag -> BrigAPIAccess m (Set ClientInfo)
  GetLocalMLSClient :: Local UserId -> ClientId -> CipherSuiteTag -> BrigAPIAccess m ClientInfo
  UpdateSearchVisibilityInbound ::
    Multi.TeamStatus SearchVisibilityInboundConfig ->
    BrigAPIAccess m ()
  GetUserExportData :: UserId -> BrigAPIAccess m (Maybe TeamExportUser)
  DeleteBot :: ConvId -> BotId -> BrigAPIAccess m ()
  UpdateSearchIndex :: UserId -> BrigAPIAccess m ()
  GetAccountsBy :: GetBy -> BrigAPIAccess m [User]
  GetUsersByVariousKeys :: [UserId] -> [Handle] -> [EmailAddress] -> HavePendingInvitations -> BrigAPIAccess m [User]
  CreateGroupInternal :: ManagedBy -> TeamId -> Maybe UserId -> NewUserGroup -> BrigAPIAccess m (Either Wai.Error UserGroup)
  GetGroupInternal :: TeamId -> UserGroupId -> Bool -> BrigAPIAccess m (Maybe UserGroup)
  GetGroupsInternal :: TeamId -> Maybe Scim.Filter -> Maybe ManagedBy -> Word -> Maybe Word -> BrigAPIAccess m UserGroupPageWithMembers
  UpdateGroup :: UpdateGroupInternalRequest -> BrigAPIAccess m (Either Wai.Error ())
  DeleteGroupInternal :: ManagedBy -> TeamId -> UserGroupId -> BrigAPIAccess m (Either DeleteGroupManagedError ())
  DeleteApp :: TeamId -> UserId -> BrigAPIAccess m ()
  GetAppIdsForTeam :: TeamId -> BrigAPIAccess m [UserId]
  SetAccountStatus :: UserId -> AccountStatus -> BrigAPIAccess m ()
  -- SAML / SCIM user management (migrated from Spar.Sem.BrigAccess)
  CreateSAML ::
    SAML.UserRef ->
    UserId ->
    TeamId ->
    Name ->
    ManagedBy ->
    Maybe Handle ->
    Maybe RichInfo ->
    Maybe Locale ->
    Role ->
    BrigAPIAccess m UserId
  CreateNoSAML ::
    Text ->
    EmailAddress ->
    UserId ->
    TeamId ->
    Name ->
    Maybe Locale ->
    Role ->
    BrigAPIAccess m UserId
  UpdateEmail :: UserId -> EmailAddress -> EmailActivation -> BrigAPIAccess m ()
  GetAccount :: HavePendingInvitations -> UserId -> BrigAPIAccess m (Maybe User)
  GetAccountByHandle :: Handle -> BrigAPIAccess m (Maybe User)
  GetByEmail :: EmailAddress -> BrigAPIAccess m (Maybe User)
  SetName :: UserId -> Name -> BrigAPIAccess m ()
  SetHandle :: UserId -> Handle -> BrigAPIAccess m ()
  SetManagedBy :: UserId -> ManagedBy -> BrigAPIAccess m ()
  DeletePendingEmailUpdate :: UserId -> BrigAPIAccess m ()
  SetSSOId :: UserId -> UserSSOId -> BrigAPIAccess m ()
  SetRichInfo :: UserId -> RichInfo -> BrigAPIAccess m ()
  SetLocale :: UserId -> Maybe Locale -> BrigAPIAccess m ()
  GetRichInfo :: UserId -> BrigAPIAccess m RichInfo
  CheckHandleAvailable :: Handle -> BrigAPIAccess m Bool
  SsoLogin :: UserId -> Maybe CookieLabel -> BrigAPIAccess m SetCookie
  GetStatus :: UserId -> BrigAPIAccess m AccountStatus
  GetStatusMaybe :: UserId -> BrigAPIAccess m (Maybe AccountStatus)
  SetStatus :: UserId -> AccountStatus -> BrigAPIAccess m ()
  GetDefaultUserLocale :: BrigAPIAccess m Locale
  CheckAdminGetTeamId :: UserId -> BrigAPIAccess m (Either Wai.Error TeamId)
  SendSAMLIdPChangedEmail :: IdpChangedNotification -> BrigAPIAccess m ()

makeSem ''BrigAPIAccess

getUser :: (Member BrigAPIAccess r) => UserId -> Sem r (Maybe User)
getUser = fmap listToMaybe . getUsers . pure

addLegalHoldClientToUser ::
  (Member BrigAPIAccess r, Member (Error AuthenticationError) r) =>
  UserId ->
  ConnId ->
  [UncheckedPrekeyBundle] ->
  LastPrekey ->
  Sem r ClientId
addLegalHoldClientToUser uid con pks lpk =
  addLegalHoldClientToUserEither uid con pks lpk
    >>= either throw pure

getConnectionsUnqualifiedBidi :: (Member BrigAPIAccess r) => [UserId] -> [UserId] -> Maybe Relation -> Maybe Relation -> Sem r ([ConnectionStatus], [ConnectionStatus])
getConnectionsUnqualifiedBidi uids1 uids2 mrel1 mrel2 = do
  res1 <- getConnectionsUnqualified uids1 (Just uids2) mrel1
  res2 <- getConnectionsUnqualified uids2 (Just uids1) mrel2
  pure (res1, res2)

ensureConnectedToLocals ::
  ( Member (ErrorS 'NotConnected) r,
    Member BrigAPIAccess r
  ) =>
  UserId ->
  [UserId] ->
  Sem r ()
ensureConnectedToLocals _ [] = pure ()
ensureConnectedToLocals u uids = do
  (connsFrom, connsTo) <-
    getConnectionsUnqualifiedBidi [u] uids (Just Accepted) (Just Accepted)
  unless (length connsFrom == length uids && length connsTo == length uids) $
    throwS @'NotConnected
