"""One-time, idempotent provisioning of the Fleet Ops demo client identity.

Docs: docs/superpowers/specs/2026-08-05-mobilityops-demo-token-design.md
"""

from __future__ import annotations

from dataclasses import dataclass
from uuid import NAMESPACE_URL, UUID, uuid5

from sqlalchemy import select
from sqlalchemy.orm import Session

from .models import (
    ClientBindingRow,
    ClientRow,
    EnvironmentRow,
    ProjectRow,
    VirtualServerRow,
    WorkspaceRow,
)

DEMO_CLIENT_ISSUER = "itworx-mcp-hub:demo-token"
DEMO_CLIENT_SUBJECT = "mobilityops-demo"
DEMO_CLIENT_ID: UUID = uuid5(NAMESPACE_URL, "https://hub.example.com/demo-client/mobilityops")


@dataclass(frozen=True)
class DemoClientResult:
    client_id: UUID
    binding_id: UUID


def provision_demo_client(
    session: Session,
    *,
    workspace_slug: str = "itworx",
    project_slug: str = "mobilityops",
    environment_name: str = "prod",
) -> DemoClientResult:
    workspace = session.scalar(select(WorkspaceRow).where(WorkspaceRow.slug == workspace_slug))
    if workspace is None:
        raise ValueError("demo client workspace is not registered")
    project = session.scalar(
        select(ProjectRow).where(
            ProjectRow.workspace_id == workspace.id,
            ProjectRow.slug == project_slug,
            ProjectRow.status == "active",
        )
    )
    if project is None:
        raise ValueError("demo client project is not registered")
    environment = session.scalar(
        select(EnvironmentRow).where(
            EnvironmentRow.workspace_id == workspace.id,
            EnvironmentRow.project_id == project.id,
            EnvironmentRow.name == environment_name,
            EnvironmentRow.status == "active",
        )
    )
    if environment is None:
        raise ValueError("demo client environment is not registered")
    # The demo client must bind to exactly one, unambiguous, externally-routed
    # virtual server. Taking "the first match" would silently bind the demo
    # identity to an arbitrary server if the project/environment ever grows a
    # second one.
    servers = session.scalars(
        select(VirtualServerRow).where(
            VirtualServerRow.workspace_id == workspace.id,
            VirtualServerRow.project_id == project.id,
            VirtualServerRow.environment_id == environment.id,
            VirtualServerRow.enabled.is_(True),
            VirtualServerRow.gateway_external_id.is_not(None),
        )
    ).all()
    if len(servers) != 1:
        raise ValueError(
            f"demo client virtual server is not uniquely determined "
            f"({len(servers)} enabled, externally-routed servers found for "
            f"{project_slug}/{environment_name}; expected exactly 1)"
        )
    server = servers[0]

    client = session.get(ClientRow, DEMO_CLIENT_ID)
    if client is None:
        client = ClientRow(
            id=DEMO_CLIENT_ID,
            workspace_id=workspace.id,
            subject=DEMO_CLIENT_SUBJECT,
            issuer=DEMO_CLIENT_ISSUER,
            client_type="mcp",
            status="active",
            record_metadata={"managedBy": "demo-token-provisioning"},
        )
        session.add(client)
        session.flush()

    binding = session.scalar(
        select(ClientBindingRow).where(
            ClientBindingRow.client_id == DEMO_CLIENT_ID,
            ClientBindingRow.virtual_server_id == server.id,
        )
    )
    if binding is None:
        binding = ClientBindingRow(
            workspace_id=workspace.id,
            project_id=project.id,
            client_id=DEMO_CLIENT_ID,
            virtual_server_id=server.id,
            enabled=True,
        )
        session.add(binding)
        session.flush()
    elif not binding.enabled:
        binding.enabled = True
        session.flush()

    return DemoClientResult(client_id=client.id, binding_id=binding.id)