import { env } from "../env.js";

//#region src/middleware/cors.ts
/**
* Extract the base domain from a hostname (e.g., 'app.preview.inkeep.com' -> 'preview.inkeep.com')
*/
function getBaseDomain(hostname) {
	const parts = hostname.split(".");
	if (parts.length >= 3) return parts.slice(-3).join(".");
	return hostname;
}
/**
* Extract the registrable domain (eTLD+1) from a hostname.
* e.g., 'api.agents.inkeep.com' -> 'inkeep.com', 'app.inkeep.com' -> 'inkeep.com'
*/
function getRootDomain(hostname) {
	const parts = hostname.split(".");
	if (parts.length >= 2) return parts.slice(-2).join(".");
	return hostname;
}
/**
* Check if a request origin is allowed for CORS
* Development: Allow any localhost origin
* Production: Allow same base domain, same root domain (when UI URL is configured), or configured UI URL
*/
function isOriginAllowed(origin) {
	if (!origin) return false;
	try {
		const requestUrl = new URL(origin);
		const apiUrl = new URL(env.INKEEP_AGENTS_API_URL || "http://localhost:3002");
		const uiUrl = env.INKEEP_AGENTS_MANAGE_UI_URL ? new URL(env.INKEEP_AGENTS_MANAGE_UI_URL) : null;
		if (requestUrl.hostname === "localhost" || requestUrl.hostname === "127.0.0.1") return true;
		if (uiUrl && requestUrl.hostname === uiUrl.hostname) return true;
		if (getBaseDomain(requestUrl.hostname) === getBaseDomain(apiUrl.hostname)) return true;
		if (uiUrl) {
			const requestRootDomain = getRootDomain(requestUrl.hostname);
			const apiRootDomain = getRootDomain(apiUrl.hostname);
			const uiRootDomain = getRootDomain(uiUrl.hostname);
			if (requestRootDomain === apiRootDomain && apiRootDomain === uiRootDomain && requestRootDomain === uiRootDomain) return true;
		}
		return false;
	} catch {
		return false;
	}
}
const originHandler = (origin) => isOriginAllowed(origin) ? origin : null;
/**
* CORS configuration for auth routes (Better Auth, session endpoints)
*/
const authCorsConfig = {
	origin: originHandler,
	allowHeaders: [
		"content-type",
		"Content-Type",
		"authorization",
		"Authorization",
		"User-Agent"
	],
	allowMethods: [
		"POST",
		"GET",
		"OPTIONS"
	],
	exposeHeaders: ["Content-Length"],
	maxAge: 600,
	credentials: true
};
/**
* CORS configuration for default API routes
*/
const defaultCorsConfig = {
	origin: originHandler,
	allowMethods: [
		"GET",
		"POST",
		"PUT",
		"DELETE",
		"OPTIONS",
		"PATCH"
	],
	allowHeaders: ["*"],
	exposeHeaders: ["Content-Length"],
	maxAge: 86400,
	credentials: true
};
/**
* CORS configuration for playground routes
*/
const playgroundCorsConfig = {
	origin: originHandler,
	allowHeaders: [
		"content-type",
		"Content-Type",
		"authorization",
		"Authorization",
		"User-Agent"
	],
	allowMethods: ["POST", "OPTIONS"],
	exposeHeaders: ["Content-Length"],
	maxAge: 600,
	credentials: true
};
/**
* CORS configuration for run routes (streaming, more permissive)
*/
const runCorsConfig = {
	origin: "*",
	allowMethods: [
		"GET",
		"POST",
		"PUT",
		"DELETE",
		"OPTIONS",
		"PATCH"
	],
	allowHeaders: ["*"],
	exposeHeaders: ["Content-Length"],
	maxAge: 86400,
	credentials: true
};
/**
* CORS configuration for SigNoz proxy routes
*/
const signozCorsConfig = {
	origin: originHandler,
	allowHeaders: [
		"content-type",
		"Content-Type",
		"authorization",
		"Authorization",
		"User-Agent",
		"Cookie",
		"X-Forwarded-Cookie"
	],
	allowMethods: [
		"GET",
		"POST",
		"OPTIONS"
	],
	exposeHeaders: ["Content-Length", "Set-Cookie"],
	maxAge: 600,
	credentials: true
};

//#endregion
export { authCorsConfig, defaultCorsConfig, getBaseDomain, getRootDomain, isOriginAllowed, playgroundCorsConfig, runCorsConfig, signozCorsConfig };