import { BetterFetchError, betterFetch } from "@better-fetch/fetch";
import {
	createAuthorizationURL,
	generateState,
	HIDE_METADATA,
	parseState,
	validateAuthorizationCode,
	validateToken,
} from "better-auth";
import {
	APIError,
	createAuthEndpoint,
	getSessionFromCtx,
	sessionMiddleware,
} from "better-auth/api";
import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
import { generateRandomString } from "better-auth/crypto";
import { handleOAuthUserInfo } from "better-auth/oauth2";
import { decodeJwt } from "jose";
import * as saml from "samlify";
import type { BindingContext } from "samlify/types/src/entity";
import type { IdentityProvider } from "samlify/types/src/entity-idp";
import * as z from "zod";
import * as constants from "../constants";
import { assignOrganizationFromProvider } from "../linking";
import type { HydratedOIDCConfig } from "../oidc";
import {
	DiscoveryError,
	discoverOIDCConfig,
	ensureRuntimeDiscovery,
	mapDiscoveryErrorToAPIError,
} from "../oidc";
import { validateConfigAlgorithms } from "../saml";
import { SAML_ERROR_CODES } from "../saml/error-codes";
import { generateRelayState } from "../saml-state";
import type {
	AuthnRequestRecord,
	OIDCConfig,
	SAMLAssertionExtract,
	SAMLConfig,
	SAMLSessionRecord,
	SSOOptions,
	SSOProvider,
} from "../types";
import { domainMatches, safeJsonParse, validateEmailDomain } from "../utils";
import { getVerificationIdentifier } from "./domain-verification";
import {
	createIdP,
	createSAMLPostForm,
	createSP,
	findSAMLProvider,
} from "./helpers";
import { getSafeRedirectUrl, processSAMLResponse } from "./saml-pipeline";

/**
 * Builds the OIDC redirect URI. Uses the shared `redirectURI` option
 * when set, otherwise falls back to `/sso/callback/:providerId`.
 */
function getOIDCRedirectURI(
	baseURL: string,
	providerId: string,
	options?: SSOOptions,
): string {
	if (options?.redirectURI?.trim()) {
		try {
			// Full URL — use as-is
			new URL(options.redirectURI);
			return options.redirectURI;
		} catch {
			// Relative path — append to baseURL
			const path = options.redirectURI.startsWith("/")
				? options.redirectURI
				: `/${options.redirectURI}`;
			return `${baseURL}${path}`;
		}
	}
	return `${baseURL}/sso/callback/${providerId}`;
}

export {
	type SAMLConditions,
	type TimestampValidationOptions,
	validateSAMLTimestamp,
} from "../saml/timestamp";

const spMetadataQuerySchema = z.object({
	providerId: z.string(),
	format: z.enum(["xml", "json"]).default("xml"),
});

export const spMetadata = (options?: SSOOptions) => {
	return createAuthEndpoint(
		"/sso/saml2/sp/metadata",
		{
			method: "GET",
			query: spMetadataQuerySchema,
			metadata: {
				openapi: {
					operationId: "getSSOServiceProviderMetadata",
					summary: "Get Service Provider metadata",
					description: "Returns the SAML metadata for the Service Provider",
					responses: {
						"200": {
							description: "SAML metadata in XML format",
						},
					},
				},
			},
		},
		async (ctx) => {
			const provider = await ctx.context.adapter.findOne<{
				id: string;
				samlConfig: string;
			}>({
				model: "ssoProvider",
				where: [
					{
						field: "providerId",
						value: ctx.query.providerId,
					},
				],
			});
			if (!provider) {
				throw new APIError("NOT_FOUND", {
					message: "No provider found for the given providerId",
				});
			}

			const parsedSamlConfig = safeJsonParse<SAMLConfig>(provider.samlConfig);
			if (!parsedSamlConfig) {
				throw new APIError("BAD_REQUEST", {
					message: "Invalid SAML configuration",
				});
			}

			const sloLocation = `${ctx.context.baseURL}/sso/saml2/sp/slo/${ctx.query.providerId}`;
			const singleLogoutService = options?.saml?.enableSingleLogout
				? [
						{
							Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
							Location: sloLocation,
						},
						{
							Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
							Location: sloLocation,
						},
					]
				: undefined;

			const sp = parsedSamlConfig.spMetadata.metadata
				? saml.ServiceProvider({
						metadata: parsedSamlConfig.spMetadata.metadata,
					})
				: saml.SPMetadata({
						entityID:
							parsedSamlConfig.spMetadata?.entityID || parsedSamlConfig.issuer,
						assertionConsumerService: [
							{
								Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
								Location:
									parsedSamlConfig.callbackUrl ||
									`${ctx.context.baseURL}/sso/saml2/sp/acs/${ctx.query.providerId}`,
							},
						],
						singleLogoutService,
						wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
						authnRequestsSigned: parsedSamlConfig.authnRequestsSigned || false,
						nameIDFormat: parsedSamlConfig.identifierFormat
							? [parsedSamlConfig.identifierFormat]
							: undefined,
					});
			return new Response(sp.getMetadata(), {
				headers: {
					"Content-Type": "application/xml",
				},
			});
		},
	);
};

const ssoProviderBodySchema = z.object({
	providerId: z.string({}).meta({
		description:
			"The ID of the provider. This is used to identify the provider during login and callback",
	}),
	issuer: z.string({}).meta({
		description: "The issuer of the provider",
	}),
	domain: z.string({}).meta({
		description:
			"The domain(s) of the provider. For enterprise multi-domain SSO where a single IdP serves multiple email domains, use comma-separated values (e.g., 'company.com,subsidiary.com,acquired-company.com')",
	}),
	oidcConfig: z
		.object({
			clientId: z.string({}).meta({
				description: "The client ID",
			}),
			clientSecret: z.string({}).meta({
				description: "The client secret",
			}),
			authorizationEndpoint: z
				.string({})
				.meta({
					description: "The authorization endpoint",
				})
				.optional(),
			tokenEndpoint: z
				.string({})
				.meta({
					description: "The token endpoint",
				})
				.optional(),
			userInfoEndpoint: z
				.string({})
				.meta({
					description: "The user info endpoint",
				})
				.optional(),
			tokenEndpointAuthentication: z
				.enum(["client_secret_post", "client_secret_basic"])
				.optional(),
			jwksEndpoint: z
				.string({})
				.meta({
					description: "The JWKS endpoint",
				})
				.optional(),
			discoveryEndpoint: z.string().optional(),
			skipDiscovery: z
				.boolean()
				.meta({
					description:
						"Skip OIDC discovery during registration. When true, you must provide authorizationEndpoint, tokenEndpoint, and jwksEndpoint manually.",
				})
				.optional(),
			scopes: z
				.array(z.string(), {})
				.meta({
					description:
						"The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']",
				})
				.optional(),
			pkce: z
				.boolean({})
				.meta({
					description: "Whether to use PKCE for the authorization flow",
				})
				.default(true)
				.optional(),
			mapping: z
				.object({
					id: z.string({}).meta({
						description: "Field mapping for user ID (defaults to 'sub')",
					}),
					email: z.string({}).meta({
						description: "Field mapping for email (defaults to 'email')",
					}),
					emailVerified: z
						.string({})
						.meta({
							description:
								"Field mapping for email verification (defaults to 'email_verified')",
						})
						.optional(),
					name: z.string({}).meta({
						description: "Field mapping for name (defaults to 'name')",
					}),
					image: z
						.string({})
						.meta({
							description: "Field mapping for image (defaults to 'picture')",
						})
						.optional(),
					extraFields: z.record(z.string(), z.any()).optional(),
				})
				.optional(),
		})
		.optional(),
	samlConfig: z
		.object({
			entryPoint: z.string({}).meta({
				description: "The entry point of the provider",
			}),
			cert: z.string({}).meta({
				description: "The certificate of the provider",
			}),
			callbackUrl: z.string({}).meta({
				description: "The callback URL of the provider",
			}),
			audience: z.string().optional(),
			idpMetadata: z
				.object({
					metadata: z.string().optional(),
					entityID: z.string().optional(),
					cert: z.string().optional(),
					privateKey: z.string().optional(),
					privateKeyPass: z.string().optional(),
					isAssertionEncrypted: z.boolean().optional(),
					encPrivateKey: z.string().optional(),
					encPrivateKeyPass: z.string().optional(),
					singleSignOnService: z
						.array(
							z.object({
								Binding: z.string().meta({
									description: "The binding type for the SSO service",
								}),
								Location: z.string().meta({
									description: "The URL for the SSO service",
								}),
							}),
						)
						.optional()
						.meta({
							description: "Single Sign-On service configuration",
						}),
				})
				.optional(),
			spMetadata: z.object({
				metadata: z.string().optional(),
				entityID: z.string().optional(),
				binding: z.string().optional(),
				privateKey: z.string().optional(),
				privateKeyPass: z.string().optional(),
				isAssertionEncrypted: z.boolean().optional(),
				encPrivateKey: z.string().optional(),
				encPrivateKeyPass: z.string().optional(),
			}),
			wantAssertionsSigned: z.boolean().optional(),
			authnRequestsSigned: z.boolean().optional(),
			signatureAlgorithm: z.string().optional(),
			digestAlgorithm: z.string().optional(),
			identifierFormat: z.string().optional(),
			privateKey: z.string().optional(),
			decryptionPvk: z.string().optional(),
			additionalParams: z.record(z.string(), z.any()).optional(),
			mapping: z
				.object({
					id: z.string({}).meta({
						description: "Field mapping for user ID (defaults to 'nameID')",
					}),
					email: z.string({}).meta({
						description: "Field mapping for email (defaults to 'email')",
					}),
					emailVerified: z
						.string({})
						.meta({
							description: "Field mapping for email verification",
						})
						.optional(),
					name: z.string({}).meta({
						description: "Field mapping for name (defaults to 'displayName')",
					}),
					firstName: z
						.string({})
						.meta({
							description:
								"Field mapping for first name (defaults to 'givenName')",
						})
						.optional(),
					lastName: z
						.string({})
						.meta({
							description:
								"Field mapping for last name (defaults to 'surname')",
						})
						.optional(),
					extraFields: z.record(z.string(), z.any()).optional(),
				})
				.optional(),
		})
		.optional(),
	organizationId: z
		.string({})
		.meta({
			description:
				"If organization plugin is enabled, the organization id to link the provider to",
		})
		.optional(),
	overrideUserInfo: z
		.boolean({})
		.meta({
			description:
				"Override user info with the provider info. Defaults to false",
		})
		.default(false)
		.optional(),
});

export const registerSSOProvider = <O extends SSOOptions>(options: O) => {
	return createAuthEndpoint(
		"/sso/register",
		{
			method: "POST",
			body: ssoProviderBodySchema,
			use: [sessionMiddleware],
			metadata: {
				openapi: {
					operationId: "registerSSOProvider",
					summary: "Register an OIDC provider",
					description:
						"This endpoint is used to register an OIDC provider. This is used to configure the provider and link it to an organization",
					responses: {
						"200": {
							description: "OIDC provider created successfully",
							content: {
								"application/json": {
									schema: {
										type: "object",
										properties: {
											issuer: {
												type: "string",
												format: "uri",
												description: "The issuer URL of the provider",
											},
											domain: {
												type: "string",
												description:
													"The domain of the provider, used for email matching",
											},
											domainVerified: {
												type: "boolean",
												description:
													"A boolean indicating whether the domain has been verified or not",
											},
											domainVerificationToken: {
												type: "string",
												description:
													"Domain verification token. It can be used to prove ownership over the SSO domain",
											},
											oidcConfig: {
												type: "object",
												properties: {
													issuer: {
														type: "string",
														format: "uri",
														description: "The issuer URL of the provider",
													},
													pkce: {
														type: "boolean",
														description:
															"Whether PKCE is enabled for the authorization flow",
													},
													clientId: {
														type: "string",
														description: "The client ID for the provider",
													},
													clientSecret: {
														type: "string",
														description: "The client secret for the provider",
													},
													authorizationEndpoint: {
														type: "string",
														format: "uri",
														nullable: true,
														description: "The authorization endpoint URL",
													},
													discoveryEndpoint: {
														type: "string",
														format: "uri",
														description: "The discovery endpoint URL",
													},
													userInfoEndpoint: {
														type: "string",
														format: "uri",
														nullable: true,
														description: "The user info endpoint URL",
													},
													scopes: {
														type: "array",
														items: { type: "string" },
														nullable: true,
														description:
															"The scopes requested from the provider",
													},
													tokenEndpoint: {
														type: "string",
														format: "uri",
														nullable: true,
														description: "The token endpoint URL",
													},
													tokenEndpointAuthentication: {
														type: "string",
														enum: ["client_secret_post", "client_secret_basic"],
														nullable: true,
														description:
															"Authentication method for the token endpoint",
													},
													jwksEndpoint: {
														type: "string",
														format: "uri",
														nullable: true,
														description: "The JWKS endpoint URL",
													},
													mapping: {
														type: "object",
														nullable: true,
														properties: {
															id: {
																type: "string",
																description:
																	"Field mapping for user ID (defaults to 'sub')",
															},
															email: {
																type: "string",
																description:
																	"Field mapping for email (defaults to 'email')",
															},
															emailVerified: {
																type: "string",
																nullable: true,
																description:
																	"Field mapping for email verification (defaults to 'email_verified')",
															},
															name: {
																type: "string",
																description:
																	"Field mapping for name (defaults to 'name')",
															},
															image: {
																type: "string",
																nullable: true,
																description:
																	"Field mapping for image (defaults to 'picture')",
															},
															extraFields: {
																type: "object",
																additionalProperties: { type: "string" },
																nullable: true,
																description: "Additional field mappings",
															},
														},
														required: ["id", "email", "name"],
													},
												},
												required: [
													"issuer",
													"pkce",
													"clientId",
													"clientSecret",
													"discoveryEndpoint",
												],
												description: "OIDC configuration for the provider",
											},
											organizationId: {
												type: "string",
												nullable: true,
												description: "ID of the linked organization, if any",
											},
											userId: {
												type: "string",
												description:
													"ID of the user who registered the provider",
											},
											providerId: {
												type: "string",
												description: "Unique identifier for the provider",
											},
											redirectURI: {
												type: "string",
												format: "uri",
												description:
													"The redirect URI for the provider callback",
											},
										},
										required: [
											"issuer",
											"domain",
											"oidcConfig",
											"userId",
											"providerId",
											"redirectURI",
										],
									},
								},
							},
						},
					},
				},
			},
		},
		async (ctx) => {
			const user = ctx.context.session?.user;
			if (!user) {
				throw new APIError("UNAUTHORIZED");
			}

			const limit =
				typeof options?.providersLimit === "function"
					? await options.providersLimit(user)
					: (options?.providersLimit ?? 10);

			if (!limit) {
				throw new APIError("FORBIDDEN", {
					message: "SSO provider registration is disabled",
				});
			}

			const providers = await ctx.context.adapter.findMany({
				model: "ssoProvider",
				where: [{ field: "userId", value: user.id }],
			});

			if (providers.length >= limit) {
				throw new APIError("FORBIDDEN", {
					message: "You have reached the maximum number of SSO providers",
				});
			}

			const body = ctx.body;
			const issuerValidator = z.string().url();
			if (issuerValidator.safeParse(body.issuer).error) {
				throw new APIError("BAD_REQUEST", {
					message: "Invalid issuer. Must be a valid URL",
				});
			}

			if (body.samlConfig?.idpMetadata?.metadata) {
				const maxMetadataSize =
					options?.saml?.maxMetadataSize ??
					constants.DEFAULT_MAX_SAML_METADATA_SIZE;
				if (
					new TextEncoder().encode(body.samlConfig.idpMetadata.metadata)
						.length > maxMetadataSize
				) {
					throw new APIError("BAD_REQUEST", {
						message: `IdP metadata exceeds maximum allowed size (${maxMetadataSize} bytes)`,
					});
				}
			}

			if (ctx.body.organizationId) {
				const organization = await ctx.context.adapter.findOne({
					model: "member",
					where: [
						{
							field: "userId",
							value: user.id,
						},
						{
							field: "organizationId",
							value: ctx.body.organizationId,
						},
					],
				});
				if (!organization) {
					throw new APIError("BAD_REQUEST", {
						message: "You are not a member of the organization",
					});
				}
			}

			const existingProvider = await ctx.context.adapter.findOne({
				model: "ssoProvider",
				where: [
					{
						field: "providerId",
						value: body.providerId,
					},
				],
			});

			if (existingProvider) {
				ctx.context.logger.info(
					`SSO provider creation attempt with existing providerId: ${body.providerId}`,
				);
				throw new APIError("UNPROCESSABLE_ENTITY", {
					message: "SSO provider with this providerId already exists",
				});
			}

			let hydratedOIDCConfig: HydratedOIDCConfig | null = null;
			if (body.oidcConfig && !body.oidcConfig.skipDiscovery) {
				try {
					hydratedOIDCConfig = await discoverOIDCConfig({
						issuer: body.issuer,
						existingConfig: {
							discoveryEndpoint: body.oidcConfig.discoveryEndpoint,
							authorizationEndpoint: body.oidcConfig.authorizationEndpoint,
							tokenEndpoint: body.oidcConfig.tokenEndpoint,
							jwksEndpoint: body.oidcConfig.jwksEndpoint,
							userInfoEndpoint: body.oidcConfig.userInfoEndpoint,
							tokenEndpointAuthentication:
								body.oidcConfig.tokenEndpointAuthentication,
						},
						isTrustedOrigin: (url: string) => ctx.context.isTrustedOrigin(url),
					});
				} catch (error) {
					if (error instanceof DiscoveryError) {
						throw mapDiscoveryErrorToAPIError(error);
					}
					throw error;
				}
			}

			const buildOIDCConfig = () => {
				if (!body.oidcConfig) return null;

				if (body.oidcConfig.skipDiscovery) {
					return JSON.stringify({
						issuer: body.issuer,
						clientId: body.oidcConfig.clientId,
						clientSecret: body.oidcConfig.clientSecret,
						authorizationEndpoint: body.oidcConfig.authorizationEndpoint,
						tokenEndpoint: body.oidcConfig.tokenEndpoint,
						tokenEndpointAuthentication:
							body.oidcConfig.tokenEndpointAuthentication ||
							"client_secret_basic",
						jwksEndpoint: body.oidcConfig.jwksEndpoint,
						pkce: body.oidcConfig.pkce,
						discoveryEndpoint:
							body.oidcConfig.discoveryEndpoint ||
							`${body.issuer}/.well-known/openid-configuration`,
						mapping: body.oidcConfig.mapping,
						scopes: body.oidcConfig.scopes,
						userInfoEndpoint: body.oidcConfig.userInfoEndpoint,
						overrideUserInfo:
							ctx.body.overrideUserInfo ||
							options?.defaultOverrideUserInfo ||
							false,
					});
				}

				if (!hydratedOIDCConfig) return null;

				return JSON.stringify({
					issuer: hydratedOIDCConfig.issuer,
					clientId: body.oidcConfig.clientId,
					clientSecret: body.oidcConfig.clientSecret,
					authorizationEndpoint: hydratedOIDCConfig.authorizationEndpoint,
					tokenEndpoint: hydratedOIDCConfig.tokenEndpoint,
					tokenEndpointAuthentication:
						hydratedOIDCConfig.tokenEndpointAuthentication,
					jwksEndpoint: hydratedOIDCConfig.jwksEndpoint,
					pkce: body.oidcConfig.pkce,
					discoveryEndpoint: hydratedOIDCConfig.discoveryEndpoint,
					mapping: body.oidcConfig.mapping,
					scopes: body.oidcConfig.scopes,
					userInfoEndpoint: hydratedOIDCConfig.userInfoEndpoint,
					overrideUserInfo:
						ctx.body.overrideUserInfo ||
						options?.defaultOverrideUserInfo ||
						false,
				});
			};

			if (body.samlConfig) {
				validateConfigAlgorithms(
					{
						signatureAlgorithm: body.samlConfig.signatureAlgorithm,
						digestAlgorithm: body.samlConfig.digestAlgorithm,
					},
					options?.saml?.algorithms,
				);

				// Validate that the config has a usable IdP entry point
				const hasIdpMetadata = body.samlConfig.idpMetadata?.metadata;
				let hasEntryPoint = false;
				if (body.samlConfig.entryPoint) {
					try {
						new URL(body.samlConfig.entryPoint);
						hasEntryPoint = true;
					} catch {
						// not a valid URL
					}
				}
				const hasSingleSignOnService =
					body.samlConfig.idpMetadata?.singleSignOnService?.length;
				if (!hasIdpMetadata && !hasEntryPoint && !hasSingleSignOnService) {
					throw new APIError("BAD_REQUEST", {
						message:
							"SAML configuration requires either idpMetadata.metadata (IdP metadata XML), idpMetadata.singleSignOnService, or a valid entryPoint URL",
					});
				}
			}

			const provider = await ctx.context.adapter.create<
				Record<string, any>,
				SSOProvider<O>
			>({
				model: "ssoProvider",
				data: {
					issuer: body.issuer,
					domain: body.domain,
					domainVerified: false,
					oidcConfig: buildOIDCConfig(),
					samlConfig: body.samlConfig
						? JSON.stringify({
								issuer: body.issuer,
								entryPoint: body.samlConfig.entryPoint,
								cert: body.samlConfig.cert,
								callbackUrl: body.samlConfig.callbackUrl,
								audience: body.samlConfig.audience,
								idpMetadata: body.samlConfig.idpMetadata,
								spMetadata: body.samlConfig.spMetadata,
								wantAssertionsSigned: body.samlConfig.wantAssertionsSigned,
								authnRequestsSigned: body.samlConfig.authnRequestsSigned,
								signatureAlgorithm: body.samlConfig.signatureAlgorithm,
								digestAlgorithm: body.samlConfig.digestAlgorithm,
								identifierFormat: body.samlConfig.identifierFormat,
								privateKey: body.samlConfig.privateKey,
								decryptionPvk: body.samlConfig.decryptionPvk,
								additionalParams: body.samlConfig.additionalParams,
								mapping: body.samlConfig.mapping,
							})
						: null,
					organizationId: body.organizationId,
					userId: ctx.context.session.user.id,
					providerId: body.providerId,
				},
			});

			let domainVerificationToken: string | undefined;
			let domainVerified: boolean | undefined;

			if (options?.domainVerification?.enabled) {
				domainVerified = false;
				domainVerificationToken = generateRandomString(24);

				await ctx.context.internalAdapter.createVerificationValue({
					identifier: getVerificationIdentifier(options, provider.providerId),
					value: domainVerificationToken as string,
					expiresAt: new Date(Date.now() + 3600 * 24 * 7 * 1000), // 1 week
				});
			}

			type SSOProviderResponse = {
				redirectURI: string;
				oidcConfig: OIDCConfig | null;
				samlConfig: SAMLConfig | null;
			} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig">;

			type SSOProviderReturn = O["domainVerification"] extends { enabled: true }
				? SSOProviderResponse & {
						domainVerified: boolean;
						domainVerificationToken: string;
					}
				: SSOProviderResponse;

			const result = {
				...provider,
				oidcConfig: safeJsonParse<OIDCConfig>(
					provider.oidcConfig as unknown as string,
				),
				samlConfig: safeJsonParse<SAMLConfig>(
					provider.samlConfig as unknown as string,
				),
				redirectURI: getOIDCRedirectURI(
					ctx.context.baseURL,
					provider.providerId,
					options,
				),
				...(options?.domainVerification?.enabled ? { domainVerified } : {}),
				...(options?.domainVerification?.enabled
					? { domainVerificationToken }
					: {}),
			};

			return ctx.json(result as SSOProviderReturn);
		},
	);
};

const signInSSOBodySchema = z.object({
	email: z
		.string({})
		.meta({
			description:
				"The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided",
		})
		.optional(),
	organizationSlug: z
		.string({})
		.meta({
			description: "The slug of the organization to sign in with",
		})
		.optional(),
	providerId: z
		.string({})
		.meta({
			description:
				"The ID of the provider to sign in with. This can be provided instead of email or issuer",
		})
		.optional(),
	domain: z
		.string({})
		.meta({
			description: "The domain of the provider.",
		})
		.optional(),
	callbackURL: z.string({}).meta({
		description: "The URL to redirect to after login",
	}),
	errorCallbackURL: z
		.string({})
		.meta({
			description: "The URL to redirect to after login",
		})
		.optional(),
	newUserCallbackURL: z
		.string({})
		.meta({
			description: "The URL to redirect to after login if the user is new",
		})
		.optional(),
	scopes: z
		.array(z.string(), {})
		.meta({
			description: "Scopes to request from the provider.",
		})
		.optional(),
	loginHint: z
		.string({})
		.meta({
			description:
				"Login hint to send to the identity provider (e.g., email or identifier). If supported, will be sent as 'login_hint'.",
		})
		.optional(),
	requestSignUp: z
		.boolean({})
		.meta({
			description:
				"Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider",
		})
		.optional(),
	providerType: z.enum(["oidc", "saml"]).optional(),
});

export const signInSSO = (options?: SSOOptions) => {
	return createAuthEndpoint(
		"/sign-in/sso",
		{
			method: "POST",
			body: signInSSOBodySchema,
			metadata: {
				openapi: {
					operationId: "signInWithSSO",
					summary: "Sign in with SSO provider",
					description:
						"This endpoint is used to sign in with an SSO provider. It redirects to the provider's authorization URL",
					requestBody: {
						content: {
							"application/json": {
								schema: {
									type: "object",
									properties: {
										email: {
											type: "string",
											description:
												"The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided",
										},
										issuer: {
											type: "string",
											description:
												"The issuer identifier, this is the URL of the provider and can be used to verify the provider and identify the provider during login. It's optional if the email is provided",
										},
										providerId: {
											type: "string",
											description:
												"The ID of the provider to sign in with. This can be provided instead of email or issuer",
										},
										callbackURL: {
											type: "string",
											description: "The URL to redirect to after login",
										},
										errorCallbackURL: {
											type: "string",
											description: "The URL to redirect to after login",
										},
										newUserCallbackURL: {
											type: "string",
											description:
												"The URL to redirect to after login if the user is new",
										},
										loginHint: {
											type: "string",
											description:
												"Login hint to send to the identity provider (e.g., email or identifier). If supported, sent as 'login_hint'.",
										},
									},
									required: ["callbackURL"],
								},
							},
						},
					},
					responses: {
						"200": {
							description:
								"Authorization URL generated successfully for SSO sign-in",
							content: {
								"application/json": {
									schema: {
										type: "object",
										properties: {
											url: {
												type: "string",
												format: "uri",
												description:
													"The authorization URL to redirect the user to for SSO sign-in",
											},
											redirect: {
												type: "boolean",
												description:
													"Indicates that the client should redirect to the provided URL",
												enum: [true],
											},
										},
										required: ["url", "redirect"],
									},
								},
							},
						},
					},
				},
			},
		},
		async (ctx) => {
			const body = ctx.body;
			let { email, organizationSlug, providerId, domain } = body;
			if (
				!options?.defaultSSO?.length &&
				!email &&
				!organizationSlug &&
				!domain &&
				!providerId
			) {
				throw new APIError("BAD_REQUEST", {
					message: "email, organizationSlug, domain or providerId is required",
				});
			}
			domain = body.domain || email?.split("@")[1];
			let orgId = "";
			if (organizationSlug) {
				orgId = await ctx.context.adapter
					.findOne<{ id: string }>({
						model: "organization",
						where: [
							{
								field: "slug",
								value: organizationSlug,
							},
						],
					})
					.then((res) => {
						if (!res) {
							return "";
						}
						return res.id;
					});
			}
			let provider: SSOProvider<SSOOptions> | null = null;
			if (options?.defaultSSO?.length) {
				// Find matching default SSO provider by providerId
				const matchingDefault = providerId
					? options.defaultSSO.find(
							(defaultProvider) => defaultProvider.providerId === providerId,
						)
					: options.defaultSSO.find(
							(defaultProvider) => defaultProvider.domain === domain,
						);

				if (matchingDefault) {
					provider = {
						issuer:
							matchingDefault.samlConfig?.issuer ||
							matchingDefault.oidcConfig?.issuer ||
							"",
						providerId: matchingDefault.providerId,
						userId: "default",
						oidcConfig: matchingDefault.oidcConfig,
						samlConfig: matchingDefault.samlConfig,
						domain: matchingDefault.domain,
						...(options.domainVerification?.enabled
							? { domainVerified: true }
							: {}),
					} as SSOProvider<SSOOptions>;
				}
			}
			if (!providerId && !orgId && !domain) {
				throw new APIError("BAD_REQUEST", {
					message: "providerId, orgId or domain is required",
				});
			}
			// Try to find provider in database
			if (!provider) {
				const parseProvider = (res: SSOProvider<SSOOptions> | null) => {
					if (!res) return null;
					return {
						...res,
						oidcConfig: res.oidcConfig
							? safeJsonParse<OIDCConfig>(
									res.oidcConfig as unknown as string,
								) || undefined
							: undefined,
						samlConfig: res.samlConfig
							? safeJsonParse<SAMLConfig>(
									res.samlConfig as unknown as string,
								) || undefined
							: undefined,
					};
				};

				if (providerId || orgId) {
					// Exact match for providerId or orgId
					provider = parseProvider(
						await ctx.context.adapter.findOne<SSOProvider<SSOOptions>>({
							model: "ssoProvider",
							where: [
								{
									field: providerId ? "providerId" : "organizationId",
									value: providerId || orgId!,
								},
							],
						}),
					);
				} else if (domain) {
					// For domain lookup, support comma-separated domains
					// First try exact match (fast path)
					provider = parseProvider(
						await ctx.context.adapter.findOne<SSOProvider<SSOOptions>>({
							model: "ssoProvider",
							where: [{ field: "domain", value: domain }],
						}),
					);
					// If not found, search all providers for comma-separated domain match
					if (!provider) {
						const allProviders = await ctx.context.adapter.findMany<
							SSOProvider<SSOOptions>
						>({
							model: "ssoProvider",
						});
						const matchingProvider = allProviders.find((p) =>
							domainMatches(domain, p.domain),
						);
						provider = parseProvider(matchingProvider ?? null);
					}
				}
			}

			if (!provider) {
				throw new APIError("NOT_FOUND", {
					message: "No provider found for the issuer",
				});
			}

			if (body.providerType) {
				if (body.providerType === "oidc" && !provider.oidcConfig) {
					throw new APIError("BAD_REQUEST", {
						message: "OIDC provider is not configured",
					});
				}
				if (body.providerType === "saml" && !provider.samlConfig) {
					throw new APIError("BAD_REQUEST", {
						message: "SAML provider is not configured",
					});
				}
			}

			if (
				options?.domainVerification?.enabled &&
				!("domainVerified" in provider && provider.domainVerified)
			) {
				throw new APIError("UNAUTHORIZED", {
					message: "Provider domain has not been verified",
				});
			}

			if (provider.oidcConfig && body.providerType !== "saml") {
				let config = provider.oidcConfig;
				try {
					config = await ensureRuntimeDiscovery(
						provider.oidcConfig,
						provider.issuer,
						(url) => ctx.context.isTrustedOrigin(url),
					);
				} catch (error) {
					if (error instanceof DiscoveryError) {
						throw mapDiscoveryErrorToAPIError(error);
					}
					throw error;
				}
				if (!config.authorizationEndpoint) {
					throw new APIError("BAD_REQUEST", {
						message: "Invalid OIDC configuration. Authorization URL not found.",
					});
				}
				const state = await generateState(
					ctx,
					undefined,
					options?.redirectURI?.trim()
						? { ssoProviderId: provider.providerId }
						: false,
				);
				const redirectURI = getOIDCRedirectURI(
					ctx.context.baseURL,
					provider.providerId,
					options,
				);
				const authorizationURL = await createAuthorizationURL({
					id: provider.issuer,
					options: {
						clientId: config.clientId,
						clientSecret: config.clientSecret,
					},
					redirectURI,
					state: state.state,
					codeVerifier: config.pkce ? state.codeVerifier : undefined,
					scopes: ctx.body.scopes ||
						config.scopes || ["openid", "email", "profile", "offline_access"],
					loginHint: ctx.body.loginHint || email,
					authorizationEndpoint: config.authorizationEndpoint,
				});
				return ctx.json({
					url: authorizationURL.toString(),
					redirect: true,
				});
			}
			if (provider.samlConfig) {
				const parsedSamlConfig =
					typeof provider.samlConfig === "object"
						? provider.samlConfig
						: safeJsonParse<SAMLConfig>(
								provider.samlConfig as unknown as string,
							);
				if (!parsedSamlConfig) {
					throw new APIError("BAD_REQUEST", {
						message: "Invalid SAML configuration",
					});
				}

				if (
					parsedSamlConfig.authnRequestsSigned &&
					!parsedSamlConfig.spMetadata?.privateKey &&
					!parsedSamlConfig.privateKey
				) {
					throw new APIError("BAD_REQUEST", {
						message:
							"authnRequestsSigned is enabled but no privateKey provided in spMetadata or samlConfig",
					});
				}

				const { state: relayState } = await generateRelayState(
					ctx,
					undefined,
					false,
				);

				let metadata = parsedSamlConfig.spMetadata.metadata;

				if (!metadata) {
					metadata =
						saml
							.SPMetadata({
								entityID:
									parsedSamlConfig.spMetadata?.entityID ||
									parsedSamlConfig.issuer,
								assertionConsumerService: [
									{
										Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
										Location:
											parsedSamlConfig.callbackUrl ||
											`${ctx.context.baseURL}/sso/saml2/sp/acs/${provider.providerId}`,
									},
								],
								wantMessageSigned:
									parsedSamlConfig.wantAssertionsSigned || false,
								authnRequestsSigned:
									parsedSamlConfig.authnRequestsSigned || false,
								nameIDFormat: parsedSamlConfig.identifierFormat
									? [parsedSamlConfig.identifierFormat]
									: undefined,
							})
							.getMetadata() || "";
				}

				const sp = saml.ServiceProvider({
					metadata: metadata,
					allowCreate: true,
					privateKey:
						parsedSamlConfig.spMetadata?.privateKey ||
						parsedSamlConfig.privateKey,
					privateKeyPass: parsedSamlConfig.spMetadata?.privateKeyPass,
					relayState,
				});

				const idpData = parsedSamlConfig.idpMetadata;
				let idp: IdentityProvider;
				if (!idpData?.metadata) {
					idp = saml.IdentityProvider({
						entityID: idpData?.entityID || parsedSamlConfig.issuer,
						singleSignOnService: idpData?.singleSignOnService || [
							{
								Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
								Location: parsedSamlConfig.entryPoint,
							},
						],
						signingCert: idpData?.cert || parsedSamlConfig.cert,
						wantAuthnRequestsSigned:
							parsedSamlConfig.authnRequestsSigned || false,
						isAssertionEncrypted: idpData?.isAssertionEncrypted || false,
						encPrivateKey: idpData?.encPrivateKey,
						encPrivateKeyPass: idpData?.encPrivateKeyPass,
					});
				} else {
					idp = saml.IdentityProvider({
						metadata: idpData.metadata,
						privateKey: idpData.privateKey,
						privateKeyPass: idpData.privateKeyPass,
						isAssertionEncrypted: idpData.isAssertionEncrypted,
						encPrivateKey: idpData.encPrivateKey,
						encPrivateKeyPass: idpData.encPrivateKeyPass,
					});
				}
				const loginRequest = sp.createLoginRequest(
					idp,
					"redirect",
				) as BindingContext & {
					entityEndpoint: string;
					type: string;
					id: string;
				};
				if (!loginRequest) {
					throw new APIError("BAD_REQUEST", {
						message: "Invalid SAML request",
					});
				}

				const shouldSaveRequest =
					loginRequest.id &&
					options?.saml?.enableInResponseToValidation !== false;
				if (shouldSaveRequest) {
					const ttl =
						options?.saml?.requestTTL ?? constants.DEFAULT_AUTHN_REQUEST_TTL_MS;
					const record: AuthnRequestRecord = {
						id: loginRequest.id,
						providerId: provider.providerId,
						createdAt: Date.now(),
						expiresAt: Date.now() + ttl,
					};
					await ctx.context.internalAdapter.createVerificationValue({
						identifier: `${constants.AUTHN_REQUEST_KEY_PREFIX}${record.id}`,
						value: JSON.stringify(record),
						expiresAt: new Date(record.expiresAt),
					});
				}

				return ctx.json({
					url: loginRequest.context,
					redirect: true,
				});
			}
			throw new APIError("BAD_REQUEST", {
				message: "Invalid SSO provider",
			});
		},
	);
};

const callbackSSOQuerySchema = z.object({
	code: z.string().optional(),
	state: z.string(),
	error: z.string().optional(),
	error_description: z.string().optional(),
});

/**
 * Core OIDC callback handler logic, shared between the per-provider and
 * shared callback endpoints. Resolves the provider, exchanges the
 * authorization code for tokens, and creates a session.
 *
 * @param stateData - Pre-parsed state data. If not provided, it will be
 *   parsed from the request context.
 */
async function handleOIDCCallback(
	ctx: any,
	options: SSOOptions | undefined,
	providerId: string,
	stateData?: Awaited<ReturnType<typeof parseState>>,
) {
	const { code, error, error_description } = ctx.query;
	if (!stateData) {
		stateData = await parseState(ctx);
	}
	if (!stateData) {
		const errorURL =
			ctx.context.options.onAPIError?.errorURL ||
			`${ctx.context.baseURL}/error`;
		throw ctx.redirect(`${errorURL}?error=invalid_state`);
	}
	const { callbackURL, errorURL, newUserURL, requestSignUp } = stateData;
	if (!code || error) {
		throw ctx.redirect(
			`${
				errorURL || callbackURL
			}?error=${error}&error_description=${error_description}`,
		);
	}
	let provider: SSOProvider<SSOOptions> | null = null;
	if (options?.defaultSSO?.length) {
		const matchingDefault = options.defaultSSO.find(
			(defaultProvider) => defaultProvider.providerId === providerId,
		);
		if (matchingDefault) {
			provider = {
				...matchingDefault,
				issuer: matchingDefault.oidcConfig?.issuer || "",
				userId: "default",
				...(options.domainVerification?.enabled
					? { domainVerified: true }
					: {}),
			} as SSOProvider<SSOOptions>;
		}
	}
	if (!provider) {
		provider = await ctx.context.adapter
			.findOne({
				model: "ssoProvider",
				where: [
					{
						field: "providerId",
						value: providerId,
					},
				],
			})
			.then((res: { oidcConfig: string } | null) => {
				if (!res) {
					return null;
				}
				return {
					...res,
					oidcConfig: safeJsonParse<OIDCConfig>(res.oidcConfig) || undefined,
				} as SSOProvider<SSOOptions>;
			});
	}
	if (!provider) {
		throw ctx.redirect(
			`${
				errorURL || callbackURL
			}?error=invalid_provider&error_description=provider not found`,
		);
	}

	if (
		options?.domainVerification?.enabled &&
		!("domainVerified" in provider && provider.domainVerified)
	) {
		throw new APIError("UNAUTHORIZED", {
			message: "Provider domain has not been verified",
		});
	}

	let config = provider.oidcConfig;

	if (!config) {
		throw ctx.redirect(
			`${
				errorURL || callbackURL
			}?error=invalid_provider&error_description=provider not found`,
		);
	}

	try {
		config = await ensureRuntimeDiscovery(config, provider.issuer, (url) =>
			ctx.context.isTrustedOrigin(url),
		);
	} catch (error) {
		if (error instanceof DiscoveryError) {
			throw ctx.redirect(
				`${
					errorURL || callbackURL
				}?error=discovery_failed&error_description=${encodeURIComponent(error.message)}`,
			);
		}
		throw ctx.redirect(
			`${
				errorURL || callbackURL
			}?error=discovery_failed&error_description=unexpected_discovery_error`,
		);
	}
	if (!config.scopes) {
		config = {
			...config,
			scopes: ["openid", "email", "profile", "offline_access"],
		};
	}

	if (!config.tokenEndpoint) {
		throw ctx.redirect(
			`${
				errorURL || callbackURL
			}?error=invalid_provider&error_description=token_endpoint_not_found`,
		);
	}

	const tokenResponse = await validateAuthorizationCode({
		code,
		codeVerifier: config.pkce ? stateData.codeVerifier : undefined,
		redirectURI: getOIDCRedirectURI(
			ctx.context.baseURL,
			provider.providerId,
			options,
		),
		options: {
			clientId: config.clientId,
			clientSecret: config.clientSecret,
		},
		tokenEndpoint: config.tokenEndpoint,
		authentication:
			config.tokenEndpointAuthentication === "client_secret_post"
				? "post"
				: "basic",
	}).catch((e) => {
		ctx.context.logger.error("Error validating authorization code", e);
		if (e instanceof BetterFetchError) {
			throw ctx.redirect(
				`${
					errorURL || callbackURL
				}?error=invalid_provider&error_description=${e.message}`,
			);
		}
		return null;
	});
	if (!tokenResponse) {
		throw ctx.redirect(
			`${
				errorURL || callbackURL
			}?error=invalid_provider&error_description=token_response_not_found`,
		);
	}
	let userInfo: {
		id?: string;
		email?: string;
		name?: string;
		image?: string;
		emailVerified?: boolean;
		[key: string]: any;
	} | null = null;
	const mapping = config.mapping || {};

	if (config.userInfoEndpoint) {
		const userInfoResponse = await betterFetch<Record<string, unknown>>(
			config.userInfoEndpoint,
			{
				headers: {
					Authorization: `Bearer ${tokenResponse.accessToken}`,
				},
			},
		);
		if (userInfoResponse.error) {
			throw ctx.redirect(
				`${errorURL || callbackURL}?error=invalid_provider&error_description=${
					userInfoResponse.error.message
				}`,
			);
		}
		const rawUserInfo = userInfoResponse.data;
		userInfo = {
			...Object.fromEntries(
				Object.entries(mapping.extraFields || {}).map(([key, value]) => [
					key,
					rawUserInfo[value],
				]),
			),
			id: rawUserInfo[mapping.id || "sub"] as string | undefined,
			email: rawUserInfo[mapping.email || "email"] as string | undefined,
			emailVerified: options?.trustEmailVerified
				? (rawUserInfo[mapping.emailVerified || "email_verified"] as
						| boolean
						| undefined)
				: false,
			name: rawUserInfo[mapping.name || "name"] as string | undefined,
			image: rawUserInfo[mapping.image || "picture"] as string | undefined,
		};
	} else if (tokenResponse.idToken) {
		const idToken = decodeJwt(tokenResponse.idToken);
		if (!config.jwksEndpoint) {
			throw ctx.redirect(
				`${
					errorURL || callbackURL
				}?error=invalid_provider&error_description=jwks_endpoint_not_found`,
			);
		}
		const verified = await validateToken(
			tokenResponse.idToken,
			config.jwksEndpoint,
			{
				audience: config.clientId,
				issuer: provider.issuer,
			},
		).catch((e) => {
			ctx.context.logger.error(e);
			return null;
		});
		if (!verified) {
			throw ctx.redirect(
				`${
					errorURL || callbackURL
				}?error=invalid_provider&error_description=token_not_verified`,
			);
		}

		userInfo = {
			...Object.fromEntries(
				Object.entries(mapping.extraFields || {}).map(([key, value]) => [
					key,
					verified.payload[value],
				]),
			),
			id: idToken[mapping.id || "sub"],
			email: idToken[mapping.email || "email"],
			emailVerified: options?.trustEmailVerified
				? idToken[mapping.emailVerified || "email_verified"]
				: false,
			name: idToken[mapping.name || "name"],
			image: idToken[mapping.image || "picture"],
		} as {
			id?: string;
			email?: string;
			name?: string;
			image?: string;
			emailVerified?: boolean;
		};
	} else {
		throw ctx.redirect(
			`${
				errorURL || callbackURL
			}?error=invalid_provider&error_description=user_info_endpoint_not_found`,
		);
	}

	if (!userInfo.email || !userInfo.id) {
		throw ctx.redirect(
			`${
				errorURL || callbackURL
			}?error=invalid_provider&error_description=missing_user_info`,
		);
	}
	const isTrustedProvider =
		"domainVerified" in provider &&
		(provider as { domainVerified?: boolean }).domainVerified === true &&
		validateEmailDomain(userInfo.email, provider.domain);

	const linked = await handleOAuthUserInfo(ctx, {
		userInfo: {
			email: userInfo.email,
			name: userInfo.name || "",
			id: userInfo.id,
			image: userInfo.image,
			emailVerified: options?.trustEmailVerified
				? userInfo.emailVerified || false
				: false,
		},
		account: {
			idToken: tokenResponse.idToken,
			accessToken: tokenResponse.accessToken,
			refreshToken: tokenResponse.refreshToken,
			accountId: userInfo.id,
			providerId: provider.providerId,
			accessTokenExpiresAt: tokenResponse.accessTokenExpiresAt,
			refreshTokenExpiresAt: tokenResponse.refreshTokenExpiresAt,
			scope: tokenResponse.scopes?.join(","),
		},
		callbackURL,
		disableSignUp: options?.disableImplicitSignUp && !requestSignUp,
		overrideUserInfo: config.overrideUserInfo,
		isTrustedProvider,
	});
	if (linked.error) {
		throw ctx.redirect(`${errorURL || callbackURL}?error=${linked.error}`);
	}
	const { session, user } = linked.data!;

	if (
		options?.provisionUser &&
		(linked.isRegister || options.provisionUserOnEveryLogin)
	) {
		await options.provisionUser({
			user,
			userInfo,
			token: tokenResponse,
			provider,
		});
	}

	await assignOrganizationFromProvider(ctx as any, {
		user,
		profile: {
			providerType: "oidc",
			providerId: provider.providerId,
			accountId: userInfo.id,
			email: userInfo.email,
			emailVerified: Boolean(userInfo.emailVerified),
			rawAttributes: userInfo,
		},
		provider,
		token: tokenResponse,
		provisioningOptions: options?.organizationProvisioning,
	});

	await setSessionCookie(ctx, {
		session,
		user,
	});
	let toRedirectTo: string;
	try {
		const url = linked.isRegister ? newUserURL || callbackURL : callbackURL;
		toRedirectTo = url.toString();
	} catch {
		toRedirectTo = linked.isRegister ? newUserURL || callbackURL : callbackURL;
	}
	throw ctx.redirect(toRedirectTo);
}

const callbackSSOEndpointConfig = {
	method: "GET" as const,
	query: callbackSSOQuerySchema,
	allowedMediaTypes: [
		"application/x-www-form-urlencoded",
		"application/json",
	] as const,
	metadata: {
		...HIDE_METADATA,
		openapi: {
			operationId: "handleSSOCallback",
			summary: "Callback URL for SSO provider",
			description:
				"This endpoint is used as the callback URL for SSO providers. It handles the authorization code and exchanges it for an access token",
			responses: {
				"302": {
					description: "Redirects to the callback URL",
				},
			},
		},
	},
};

export const callbackSSO = (options?: SSOOptions) => {
	return createAuthEndpoint(
		"/sso/callback/:providerId",
		callbackSSOEndpointConfig,
		async (ctx) => {
			return handleOIDCCallback(ctx, options, ctx.params.providerId);
		},
	);
};

/**
 * Shared OIDC callback endpoint (no `:providerId` in path).
 * Used when `options.redirectURI` is set — the `providerId` is read from
 * the OAuth state instead of the URL path.
 */
export const callbackSSOShared = (options?: SSOOptions) => {
	return createAuthEndpoint(
		"/sso/callback",
		{
			...callbackSSOEndpointConfig,
			metadata: {
				...callbackSSOEndpointConfig.metadata,
				openapi: {
					...callbackSSOEndpointConfig.metadata.openapi,
					operationId: "handleSSOCallbackShared",
					summary: "Shared callback URL for all SSO providers",
					description:
						"This endpoint is used as a shared callback URL for all SSO providers when `redirectURI` is configured. The provider is identified via the OAuth state parameter.",
				},
			},
		},
		async (ctx) => {
			const stateData = await parseState(ctx);
			if (!stateData) {
				const errorURL =
					ctx.context.options.onAPIError?.errorURL ||
					`${ctx.context.baseURL}/error`;
				throw ctx.redirect(`${errorURL}?error=invalid_state`);
			}

			const providerId = stateData.ssoProviderId as string | undefined;
			if (!providerId) {
				const errorURL = stateData.errorURL || stateData.callbackURL;
				throw ctx.redirect(
					`${errorURL}?error=invalid_state&error_description=missing_provider_id`,
				);
			}

			return handleOIDCCallback(ctx, options, providerId, stateData);
		},
	);
};

const callbackSSOSAMLBodySchema = z.object({
	SAMLResponse: z.string(),
	RelayState: z.string().optional(),
});

export const callbackSSOSAML = (options?: SSOOptions) => {
	return createAuthEndpoint(
		"/sso/saml2/callback/:providerId",
		{
			method: ["GET", "POST"],
			body: callbackSSOSAMLBodySchema.optional(),
			query: z
				.object({
					RelayState: z.string().optional(),
				})
				.optional(),
			metadata: {
				...HIDE_METADATA,
				allowedMediaTypes: [
					"application/x-www-form-urlencoded",
					"application/json",
				],
				openapi: {
					operationId: "handleSAMLCallback",
					summary: "Callback URL for SAML provider",
					description:
						"This endpoint is used as the callback URL for SAML providers. Supports both GET and POST methods for IdP-initiated and SP-initiated flows.",
					responses: {
						"302": {
							description: "Redirects to the callback URL",
						},
						"400": {
							description: "Invalid SAML response",
						},
						"401": {
							description: "Unauthorized - SAML authentication failed",
						},
					},
				},
			},
		},
		async (ctx) => {
			const { providerId } = ctx.params;
			const appOrigin = new URL(ctx.context.baseURL).origin;
			const errorURL =
				ctx.context.options.onAPIError?.errorURL || `${appOrigin}/error`;
			const currentCallbackPath = `${ctx.context.baseURL}/sso/saml2/callback/${providerId}`;

			// Determine if this is a GET request by checking both method AND body presence
			// When called via auth.api.*, ctx.method may not be reliable, so we also check for body
			const isGetRequest = ctx.method === "GET" && !ctx.body?.SAMLResponse;

			if (isGetRequest) {
				const session = await getSessionFromCtx(ctx);

				if (!session?.session) {
					throw ctx.redirect(`${errorURL}?error=invalid_request`);
				}

				const relayState = ctx.query?.RelayState as string | undefined;
				const safeRedirectUrl = getSafeRedirectUrl(
					relayState,
					currentCallbackPath,
					appOrigin,
					(url, settings) => ctx.context.isTrustedOrigin(url, settings),
				);

				throw ctx.redirect(safeRedirectUrl);
			}

			if (!ctx.body?.SAMLResponse) {
				throw new APIError("BAD_REQUEST", {
					message: "SAMLResponse is required for POST requests",
				});
			}

			const safeRedirectUrl = await processSAMLResponse(
				ctx,
				{
					SAMLResponse: ctx.body.SAMLResponse,
					RelayState: ctx.body.RelayState,
					providerId,
					currentCallbackPath,
				},
				options,
			);
			throw ctx.redirect(safeRedirectUrl);
		},
	);
};

const acsEndpointBodySchema = z.object({
	SAMLResponse: z.string(),
	RelayState: z.string().optional(),
});

export const acsEndpoint = (options?: SSOOptions) => {
	return createAuthEndpoint(
		"/sso/saml2/sp/acs/:providerId",
		{
			method: "POST",
			body: acsEndpointBodySchema,
			metadata: {
				...HIDE_METADATA,
				allowedMediaTypes: [
					"application/x-www-form-urlencoded",
					"application/json",
				],
				openapi: {
					operationId: "handleSAMLAssertionConsumerService",
					summary: "SAML Assertion Consumer Service",
					description:
						"Handles SAML responses from IdP after successful authentication",
					responses: {
						"302": {
							description:
								"Redirects to the callback URL after successful authentication",
						},
					},
				},
			},
		},
		async (ctx) => {
			const { providerId } = ctx.params;
			const currentCallbackPath = `${ctx.context.baseURL}/sso/saml2/sp/acs/${providerId}`;
			const appOrigin = new URL(ctx.context.baseURL).origin;

			try {
				const safeRedirectUrl = await processSAMLResponse(
					ctx,
					{
						SAMLResponse: ctx.body.SAMLResponse,
						RelayState: ctx.body.RelayState,
						providerId,
						currentCallbackPath,
					},
					options,
				);
				throw ctx.redirect(safeRedirectUrl);
			} catch (error) {
				// Re-throw redirects (they use throw for control flow)
				if (
					error instanceof Response ||
					(error &&
						typeof error === "object" &&
						"status" in error &&
						(error as any).status === 302)
				) {
					throw error;
				}
				// Translate structural SAML errors (400) into browser-friendly redirects
				// so the user returns to the app instead of seeing raw JSON.
				// Non-400 errors (404 provider not found, 401 unauthorized) propagate as-is.
				if (error instanceof APIError && error.statusCode === 400) {
					// TODO: unify error codes across endpoints (callbackSSOSAML uses
					// the raw APIError code, ACS uses lowercase snake_case for backward compat)
					const internalCode = error.body?.code || "";
					const errorCode =
						internalCode === "SAML_MULTIPLE_ASSERTIONS"
							? "multiple_assertions"
							: internalCode === "SAML_NO_ASSERTION"
								? "no_assertion"
								: internalCode.toLowerCase() || "saml_error";
					const redirectUrl = getSafeRedirectUrl(
						ctx.body.RelayState || undefined,
						currentCallbackPath,
						appOrigin,
						(url, settings) => ctx.context.isTrustedOrigin(url, settings),
					);
					throw ctx.redirect(
						`${redirectUrl}${redirectUrl.includes("?") ? "&" : "?"}error=${encodeURIComponent(errorCode)}&error_description=${encodeURIComponent(error.message)}`,
					);
				}
				throw error;
			}
		},
	);
};

const sloSchema = z.object({
	SAMLRequest: z.string().optional(),
	SAMLResponse: z.string().optional(),
	RelayState: z.string().optional(),
	SigAlg: z.string().optional(),
	Signature: z.string().optional(),
});

export const sloEndpoint = (options?: SSOOptions) => {
	return createAuthEndpoint(
		"/sso/saml2/sp/slo/:providerId",
		{
			method: ["GET", "POST"],
			body: sloSchema.optional(),
			query: sloSchema.optional(),
			metadata: {
				...HIDE_METADATA,
				allowedMediaTypes: [
					"application/x-www-form-urlencoded",
					"application/json",
				],
			},
		},
		async (ctx) => {
			if (!options?.saml?.enableSingleLogout) {
				throw APIError.from(
					"BAD_REQUEST",
					SAML_ERROR_CODES.SINGLE_LOGOUT_NOT_ENABLED,
				);
			}

			const { providerId } = ctx.params;

			const samlRequest = ctx.body?.SAMLRequest || ctx.query?.SAMLRequest;
			const samlResponse = ctx.body?.SAMLResponse || ctx.query?.SAMLResponse;
			const relayState = ctx.body?.RelayState || ctx.query?.RelayState;
			const appOrigin = new URL(ctx.context.baseURL).origin;
			const safeErrorURL = getSafeRedirectUrl(
				relayState,
				`${appOrigin}/sso/saml2/sp/slo/${providerId}`,
				appOrigin,
				(url, settings) => ctx.context.isTrustedOrigin(url, settings),
			);

			if (!samlRequest && !samlResponse) {
				throw ctx.redirect(
					`${safeErrorURL}?error=invalid_request&error_description=missing_logout_data`,
				);
			}

			const provider = await findSAMLProvider(
				providerId,
				options,
				ctx.context.adapter,
			);
			if (!provider?.samlConfig) {
				throw APIError.from(
					"NOT_FOUND",
					SAML_ERROR_CODES.SAML_PROVIDER_NOT_FOUND,
				);
			}

			const config = provider.samlConfig as SAMLConfig;
			const sp = createSP(config, ctx.context.baseURL, providerId, {
				sloOptions: {
					wantLogoutRequestSigned: options?.saml?.wantLogoutRequestSigned,
					wantLogoutResponseSigned: options?.saml?.wantLogoutResponseSigned,
				},
			});
			const idp = createIdP(config);

			if (samlResponse) {
				return handleLogoutResponse(ctx, sp, idp, relayState, providerId);
			}

			return handleLogoutRequest(ctx, sp, idp, relayState, providerId);
		},
	);
};

async function handleLogoutResponse(
	ctx: any,
	sp: ReturnType<typeof createSP>,
	idp: ReturnType<typeof createIdP>,
	relayState: string | undefined,
	providerId: string,
) {
	const binding =
		ctx.method === "POST" && ctx.body?.SAMLResponse ? "post" : "redirect";

	let parsed: Awaited<ReturnType<typeof sp.parseLogoutResponse>> | undefined;
	try {
		parsed = await sp.parseLogoutResponse(idp, binding, {
			body: ctx.body,
			query: ctx.query,
		});
	} catch (error) {
		ctx.context.logger.error("LogoutResponse validation failed", { error });
		throw APIError.from(
			"BAD_REQUEST",
			SAML_ERROR_CODES.INVALID_LOGOUT_RESPONSE,
		);
	}

	const extract = parsed?.extract as {
		response?: { inResponseTo?: string };
		status?: string;
		statusCode?: string;
	};

	const statusCode =
		extract?.statusCode ||
		extract?.status ||
		(parsed as any)?.samlContent?.status?.statusCode;
	if (statusCode && statusCode !== constants.SAML_STATUS_SUCCESS) {
		ctx.context.logger.warn("LogoutResponse indicates failure", { statusCode });
		throw APIError.from("BAD_REQUEST", SAML_ERROR_CODES.LOGOUT_FAILED_AT_IDP);
	}

	const inResponseTo = extract?.response?.inResponseTo;
	if (inResponseTo) {
		const key = `${constants.LOGOUT_REQUEST_KEY_PREFIX}${inResponseTo}`;
		const pendingRequest =
			await ctx.context.internalAdapter.findVerificationValue(key);

		if (!pendingRequest) {
			ctx.context.logger.warn(
				"LogoutResponse references unknown or expired request",
				{ inResponseTo },
			);
		}

		await ctx.context.internalAdapter
			.deleteVerificationByIdentifier(key)
			.catch((e: unknown) =>
				ctx.context.logger.warn(
					"Failed to delete logout request verification value",
					e,
				),
			);
	}

	deleteSessionCookie(ctx);

	const appOrigin = new URL(ctx.context.baseURL).origin;
	const safeRedirectUrl = getSafeRedirectUrl(
		relayState,
		`${appOrigin}/sso/saml2/sp/slo/${providerId}`,
		appOrigin,
		(url, settings) => ctx.context.isTrustedOrigin(url, settings),
	);
	throw ctx.redirect(safeRedirectUrl);
}

async function handleLogoutRequest(
	ctx: any,
	sp: ReturnType<typeof createSP>,
	idp: ReturnType<typeof createIdP>,
	relayState: string | undefined,
	providerId: string,
) {
	const binding =
		ctx.method === "POST" && ctx.body?.SAMLRequest ? "post" : "redirect";

	let parsed: Awaited<ReturnType<typeof sp.parseLogoutRequest>> | undefined;
	try {
		parsed = await sp.parseLogoutRequest(idp, binding, {
			body: ctx.body,
			query: ctx.query,
		});
	} catch (error) {
		ctx.context.logger.error("LogoutRequest validation failed", { error });
		throw APIError.from("BAD_REQUEST", SAML_ERROR_CODES.INVALID_LOGOUT_REQUEST);
	}
	if (!parsed?.extract) {
		throw APIError.from("BAD_REQUEST", SAML_ERROR_CODES.INVALID_LOGOUT_REQUEST);
	}

	const { nameID } = parsed.extract;
	const sessionIndex = (parsed.extract as SAMLAssertionExtract).sessionIndex;

	const key = `${constants.SAML_SESSION_KEY_PREFIX}${providerId}:${nameID}`;
	const stored = await ctx.context.internalAdapter.findVerificationValue(key);

	if (stored) {
		const data = safeJsonParse<SAMLSessionRecord>(stored.value);
		if (data) {
			if (
				!sessionIndex ||
				!data.sessionIndex ||
				sessionIndex === data.sessionIndex
			) {
				await ctx.context.internalAdapter
					.deleteSession(data.sessionId)
					.catch((e: unknown) =>
						ctx.context.logger.warn("Failed to delete session during SLO", {
							error: e,
						}),
					);
				await ctx.context.internalAdapter
					.deleteVerificationByIdentifier(
						`${constants.SAML_SESSION_BY_ID_PREFIX}${data.sessionId}`,
					)
					.catch((e: unknown) =>
						ctx.context.logger.warn(
							"Failed to delete SAML session lookup during SLO",
							e,
						),
					);
			} else {
				ctx.context.logger.warn(
					"SessionIndex mismatch in LogoutRequest - skipping session deletion",
					{
						providerId,
						requestedSessionIndex: sessionIndex,
						storedSessionIndex: data.sessionIndex,
					},
				);
			}
		}
		await ctx.context.internalAdapter
			.deleteVerificationByIdentifier(key)
			.catch((e: unknown) =>
				ctx.context.logger.warn(
					"Failed to delete SAML session key during SLO",
					e,
				),
			);
	}

	const currentSession = await getSessionFromCtx(ctx);
	if (currentSession?.session) {
		await ctx.context.internalAdapter.deleteSession(currentSession.session.id);
	}

	deleteSessionCookie(ctx);

	const requestId = parsed.extract.request?.id || "";
	const res = sp.createLogoutResponse(
		idp,
		null,
		binding,
		relayState || "",
		(template: string) =>
			template
				.replace("{InResponseTo}", requestId)
				.replace("{StatusCode}", constants.SAML_STATUS_SUCCESS),
	) as { context: string; entityEndpoint?: string };

	if (binding === "post" && res.entityEndpoint) {
		return createSAMLPostForm(
			res.entityEndpoint,
			"SAMLResponse",
			res.context,
			relayState,
		);
	}
	throw ctx.redirect(res.context);
}

export const initiateSLO = (options?: SSOOptions) => {
	return createAuthEndpoint(
		"/sso/saml2/logout/:providerId",
		{
			method: "POST",
			body: z.object({
				callbackURL: z.string().optional(),
			}),
			use: [sessionMiddleware],
			metadata: HIDE_METADATA,
		},
		async (ctx) => {
			if (!options?.saml?.enableSingleLogout) {
				throw APIError.from(
					"BAD_REQUEST",
					SAML_ERROR_CODES.SINGLE_LOGOUT_NOT_ENABLED,
				);
			}

			const { providerId } = ctx.params;
			const callbackURL = ctx.body.callbackURL || ctx.context.baseURL;

			const provider = await findSAMLProvider(
				providerId,
				options,
				ctx.context.adapter,
			);
			if (!provider?.samlConfig) {
				throw APIError.from(
					"NOT_FOUND",
					SAML_ERROR_CODES.SAML_PROVIDER_NOT_FOUND,
				);
			}

			const config = provider.samlConfig as SAMLConfig;

			const idpHasSLO =
				config.idpMetadata?.singleLogoutService?.length ||
				(config.idpMetadata?.metadata &&
					config.idpMetadata.metadata.includes("SingleLogoutService"));
			if (!idpHasSLO) {
				throw APIError.from(
					"BAD_REQUEST",
					SAML_ERROR_CODES.IDP_SLO_NOT_SUPPORTED,
				);
			}

			const sp = createSP(config, ctx.context.baseURL, providerId, {
				sloOptions: {
					wantLogoutRequestSigned: options?.saml?.wantLogoutRequestSigned,
					wantLogoutResponseSigned: options?.saml?.wantLogoutResponseSigned,
				},
			});
			const idp = createIdP(config);

			const session = ctx.context.session;
			const sessionLookupKey = `${constants.SAML_SESSION_BY_ID_PREFIX}${session.session.id}`;
			const sessionLookup =
				await ctx.context.internalAdapter.findVerificationValue(
					sessionLookupKey,
				);

			let nameID = session.user.email;
			let sessionIndex: string | undefined;
			let samlSessionKey: string | undefined;

			if (sessionLookup) {
				samlSessionKey = sessionLookup.value;
				const stored =
					await ctx.context.internalAdapter.findVerificationValue(
						samlSessionKey,
					);
				if (stored) {
					const data = safeJsonParse<SAMLSessionRecord>(stored.value);
					if (data) {
						nameID = data.nameID || nameID;
						sessionIndex = data.sessionIndex;
					}
				}
			}

			const logoutRequest = sp.createLogoutRequest(idp, "redirect", {
				logoutNameID: nameID,
				sessionIndex,
				relayState: callbackURL,
			}) as { id: string; context: string };

			const ttl =
				options?.saml?.logoutRequestTTL ??
				constants.DEFAULT_LOGOUT_REQUEST_TTL_MS;
			await ctx.context.internalAdapter.createVerificationValue({
				identifier: `${constants.LOGOUT_REQUEST_KEY_PREFIX}${logoutRequest.id}`,
				value: providerId,
				expiresAt: new Date(Date.now() + ttl),
			});

			if (samlSessionKey) {
				await ctx.context.internalAdapter
					.deleteVerificationByIdentifier(samlSessionKey)
					.catch((e) =>
						ctx.context.logger.warn(
							"Failed to delete SAML session key during logout",
							e,
						),
					);
			}
			await ctx.context.internalAdapter
				.deleteVerificationByIdentifier(sessionLookupKey)
				.catch((e) =>
					ctx.context.logger.warn(
						"Failed to delete session lookup key during logout",
						e,
					),
				);

			await ctx.context.internalAdapter.deleteSession(session.session.id);

			deleteSessionCookie(ctx);

			throw ctx.redirect(logoutRequest.context);
		},
	);
};
