defmodule OpenAgentsWeb.ControllerPairingController do

  @moduledoc """

  Device-style pairing API for the sarah-computer-controller CLI.

  `create` is unauthenticated: it registers a pending pairing and returns a

  short code the signed-in owner approves in the browser. `show` is polled by

  the CLI with the poll secret and hands the machine token over exactly once.

  """

  use OpenAgentsWeb, :controller

  alias OpenAgents.Computer

  alias OpenAgents.Machines

  plug :verify_enabled

  def create(conn, params) do

    attributes = %{

      "name" => params["name"],

      "tier" => params["tier"] || "probe",

      "platform" => bounded(params["platform"]),

      "agent_version" => bounded(params["agent_version"]),

      "roots" => bounded_roots(params["roots"])

    }

    case Machines.start_pairing(attributes) do

      {:ok, %{pairing: pairing, code: code, poll_secret: poll_secret}} ->

        json(conn, %{

          "pairing_id" => pairing.id,

          "code" => format_code(code),

          "poll_secret" => poll_secret,

          "verify_url" => url(~p"/computers"),

          "expires_at" => DateTime.to_iso8601(pairing.expires_at),

          "interval_seconds" => 3

        })

      {:error, _changeset} ->

        conn |> put_status(:unprocessable_entity) |> json(%{"error" => "invalid_pairing"})

    end

  end

  def show(conn, %{"id" => pairing_id}) do

    poll_secret = get_req_header(conn, "x-pairing-secret") |> List.first("")

    case Machines.claim_pairing(pairing_id, poll_secret) do

      {:ok, %{token: token, machine_id: machine_id, name: name}} ->

        json(conn, %{

          "status" => "approved",

          "machine_id" => machine_id,

          "name" => name,

          "token" => token

        })

      {:error, :pairing_pending} ->

        json(conn, %{"status" => "pending"})

      {:error, :pairing_expired} ->

        conn |> put_status(:gone) |> json(%{"status" => "expired"})

      {:error, _reason} ->

        conn |> put_status(:not_found) |> json(%{"error" => "pairing_not_found"})

    end

  end

  defp verify_enabled(conn, _options) do

    if Computer.enabled?() do

      conn

    else

      conn

      |> put_status(:not_found)

      |> json(%{"error" => "computer_controller_disabled"})

      |> halt()

    end

  end

  defp bounded(value) when is_binary(value), do: String.slice(value, 0, 40)

  defp bounded(_value), do: nil

  defp bounded_roots(roots) when is_list(roots) do

    roots

    |> Enum.filter(&is_binary/1)

    |> Enum.take(16)

    |> Enum.map(&String.slice(&1, 0, 512))

  end

  defp bounded_roots(_roots), do: []

  defp format_code(<<first::binary-size(4), second::binary-size(4)>>),

    do: first <> "-" <> second

  defp format_code(code), do: code

end

defmodule OpenAgentsWeb.InferenceProxyController do

  @moduledoc """

  The Sarah inference proxy: an OpenAI-compatible `/chat/completions` surface

  a delegated probe calls with its delegation-scoped grant as the bearer.

  It authenticates the grant (never a provider credential), translates the

  request into a provider-neutral `OpenAgents.Providers.Request`, fans it into the

  configured `OpenAgents.Providers.Provider` (PROVIDER-001) — so the OpenAI key

  never leaves the server (RELEASE-002) — meters token usage against the

  grant's budget (VOICE-010 pattern), and streams the typed provider events

  back as chat-completions SSE that probe's parser consumes. Provider JSON,

  credentials, and raw errors never cross this boundary.

  The probe→proxy hop is buffered (the provider still streams from the vendor

  internally); probe's transport reads the whole body before parsing, so this

  matches its consumer and keeps failure handling honest.

  """

  use OpenAgentsWeb, :controller

  require Logger

  alias OpenAgents.Inference

  alias OpenAgents.Providers.{Request, ToolDefinition, ToolOutput}

  def create(conn, _params) do

    # The :api pipeline already parsed the JSON body into body_params; the

    # proxy never re-reads or re-parses it.

    with {:ok, token} <- bearer(conn),

         {:ok, grant} <- resolve(token),

         {:ok, request} <- build_request(grant, conn.body_params) do

      run(conn, grant, request)

    else

      {:error, reason} -> refuse(conn, reason)

    end

  end

  # ── request assembly ────────────────────────────────────────────────────

  defp build_request(grant, %{"messages" => messages} = body) when is_list(messages) do

    {system, turns} = Enum.split_with(messages, &(role(&1) == "system"))

    request = %Request{

      # The grant pins the model; a request body cannot select another.

      model_id: grant.model_id,

      instructions: join_text(system),

      input: Enum.flat_map(turns, &input_message/1),

      tool_definitions: tool_definitions(body["tools"]),

      tool_outputs: tool_outputs(turns)

    }

    if request.input == [] do

      {:error, :empty_input}

    else

      {:ok, request}

    end

  end

  defp build_request(_grant, _body), do: {:error, :invalid_request}

  defp input_message(%{"role" => "tool"}), do: []

  defp input_message(message) do

    case content_text(message) do

      "" -> []

      text -> [%{role: role(message), content: text}]

    end

  end

  defp tool_outputs(turns) do

    turns

    |> Enum.filter(&(role(&1) == "tool"))

    |> Enum.map(fn message ->

      %ToolOutput{

        call_id: text(message["tool_call_id"]),

        output: %{"content" => content_text(message)}

      }

    end)

    |> Enum.reject(&(&1.call_id == ""))

  end

  defp tool_definitions(tools) when is_list(tools) do

    Enum.flat_map(tools, fn

      %{"function" => %{"name" => name} = function} when is_binary(name) ->

        [

          %ToolDefinition{

            name: name,

            description: text(function["description"]),

            input_schema: Map.get(function, "parameters", %{}),

            strict: false

          }

        ]

      _ ->

        []

    end)

  end

  defp tool_definitions(_), do: []

  # ── run + translate ─────────────────────────────────────────────────────

  defp run(conn, grant, request) do

    provider = Application.fetch_env!(:sarah, :provider)

    parent = self()

    # The provider pushes events synchronously; capture them to this process's

    # mailbox and drain in order once the call returns.

    result = provider.stream(request, fn event -> send(parent, {:proxy_event, event}) end)

    events = drain_events([])

    case result do

      :ok ->

        usage = usage_of(events)

        _ = meter(grant, usage)

        conn

        |> put_resp_content_type("text/event-stream")

        |> put_resp_header("cache-control", "no-store")

        |> send_resp(200, sse_body(events))

      {:error, reason} ->

        # A failure that produced partial usage is still metered; the probe

        # sees a provider error, never raw provider detail.

        usage = usage_of(events)

        if usage != %{}, do: meter(grant, usage)

        Logger.warning("inference proxy provider failure: #{inspect(reason)}")

        refuse(conn, :provider_failed)

    end

  end

  defp drain_events(acc) do

    receive do

      {:proxy_event, event} -> drain_events([event | acc])

    after

      0 -> Enum.reverse(acc)

    end

  end

  defp meter(grant, usage) when usage == %{}, do: {:ok, grant}

  defp meter(grant, usage), do: Inference.record_usage(grant, usage)

  defp usage_of(events) do

    Enum.reduce(events, %{}, fn

      {:usage, usage}, _acc -> usage

      _event, acc -> acc

    end)

  end

  # Translate the ordered provider events into a chat-completions SSE body.

  defp sse_body(events) do

    saw_tool_call = Enum.any?(events, &match?({:tool_call, _}, &1))

    finish_reason = if saw_tool_call, do: "tool_calls", else: "stop"

    chunks =

      events

      |> Enum.with_index()

      |> Enum.flat_map(fn {event, index} -> event_chunks(event, index) end)

    finish = [

      data(%{"choices" => [%{"index" => 0, "delta" => %{}, "finish_reason" => finish_reason}]})

    ]

    usage_chunk =

      case usage_of(events) do

        usage when usage == %{} -> []

        usage -> [data(%{"choices" => [], "usage" => wire_usage(usage)})]

      end

    IO.iodata_to_binary([chunks, finish, usage_chunk, "data: [DONE]\n\n"])

  end

  defp event_chunks({:text_delta, text}, _index) when text != "" do

    [data(%{"choices" => [%{"index" => 0, "delta" => %{"content" => text}}]})]

  end

  defp event_chunks({:tool_call, tool_call}, index) do

    [

      data(%{

        "choices" => [

          %{

            "index" => 0,

            "delta" => %{

              "tool_calls" => [

                %{

                  "index" => index,

                  "id" => tool_call.call_id,

                  "type" => "function",

                  "function" => %{

                    "name" => tool_call.name,

                    "arguments" => tool_call.raw_arguments

                  }

                }

              ]

            }

          }

        ]

      })

    ]

  end

  defp event_chunks(_event, _index), do: []

  defp wire_usage(usage) do

    input = integer(usage["input_tokens"] || usage[:input_tokens])

    output = integer(usage["output_tokens"] || usage[:output_tokens])

    total = integer(usage["total_tokens"] || usage[:total_tokens])

    %{

      "prompt_tokens" => input,

      "completion_tokens" => output,

      "total_tokens" => if(total > 0, do: total, else: input + output)

    }

  end

  defp data(payload), do: ["data: ", Jason.encode!(payload), "\n\n"]

  # ── auth + errors ───────────────────────────────────────────────────────

  defp bearer(conn) do

    case get_req_header(conn, "authorization") do

      ["Bearer " <> token | _] when token != "" -> {:ok, token}

      _ -> {:error, :missing_grant}

    end

  end

  defp resolve(token) do

    case Inference.resolve(token) do

      {:ok, grant} -> {:ok, grant}

      {:error, reason} -> {:error, reason}

    end

  end

  defp refuse(conn, reason) do

    {status, code} = status_for(reason)

    conn

    |> put_resp_content_type("application/json")

    |> send_resp(status, Jason.encode!(%{"error" => %{"code" => code}}))

  end

  defp status_for(:missing_grant), do: {401, "missing_grant"}

  defp status_for(:grant_not_found), do: {401, "invalid_grant"}

  defp status_for(:grant_revoked), do: {403, "grant_revoked"}

  defp status_for(:grant_expired), do: {403, "grant_expired"}

  defp status_for(:grant_exhausted), do: {429, "grant_exhausted"}

  defp status_for(:grant_budget_reached), do: {429, "grant_budget_reached"}

  defp status_for(:empty_input), do: {400, "empty_input"}

  defp status_for(:invalid_request), do: {400, "invalid_request"}

  defp status_for(:body_too_large), do: {413, "body_too_large"}

  defp status_for(:invalid_json), do: {400, "invalid_json"}

  defp status_for(:provider_failed), do: {502, "provider_failed"}

  defp status_for(_), do: {400, "bad_request"}

  # ── small helpers ───────────────────────────────────────────────────────

  defp role(%{"role" => role}) when is_binary(role), do: role

  defp role(_), do: "user"

  defp content_text(%{"content" => content}) when is_binary(content), do: content

  defp content_text(%{"content" => parts}) when is_list(parts) do

    parts

    |> Enum.map(fn

      %{"text" => text} when is_binary(text) -> text

      _ -> ""

    end)

    |> Enum.join("")

  end

  defp content_text(_), do: ""

  defp join_text(messages) do

    messages |> Enum.map(&content_text/1) |> Enum.reject(&(&1 == "")) |> Enum.join("\n")

  end

  defp text(value) when is_binary(value), do: value

  defp text(_), do: ""

  defp integer(value) when is_integer(value), do: value

  defp integer(value) when is_float(value), do: trunc(value)

  defp integer(_), do: 0

end

  forward "/git", OpenAgents.Forge.GitHTTP

  scope "/", OpenAgentsWeb do

    pipe_through :api

    post "/controller/pairings", ControllerPairingController, :create

    get "/controller/pairings/:id", ControllerPairingController, :show

    post "/api/inference/proxy", InferenceProxyController, :create

  end

  scope "/api/v3", OpenAgentsWeb do

    pipe_through :api