// ✅ Workspace Enterprise MCP Server
// file: apps/mcp-server/src/server.ts

import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
import { z } from 'zod'
import Fastify from 'fastify'
import { hybridSearch } from '../../packages/db/src/retrieval/HybridSearch'
import { retrieve } from '../../packages/db/src/retrieval/RetrievalPipeline'
import { db } from '../../packages/db/src/drizzle'

// Create the MCP server with capability declarations
const mcpServer = new McpServer({
  name: 'workspace-enterprise-tools',
  version: '2.0.0',
})

// ── Tool 1: Knowledge Vault Search ──────────────────────────────────────────
mcpServer.tool(
  'search_knowledge',
  'Search the organisation knowledge vault using hybrid semantic + keyword search. Returns relevant document chunks with source citations.',
  {
    query: z.string().min(1).describe('The search query — can be natural language or technical terms'),
    limit: z.number().int().min(1).max(20).default(5).describe('Number of results to return'),
  },
  async ({ query, limit }, extra) => {
    // Extract org context from MCP session metadata
    const orgId = extra.authInfo?.extra?.orgId as string
    if (!orgId) {
      return { content: [{ type: 'text', text: 'Error: Organisation context required' }], isError: true }
    }

    try {
      const results = await retrieve(orgId, query, { finalCount: limit })
      const formatted = results.map((r, i) =>
        `[${i + 1}] From document section "${r.heading}":\n${r.content}`
      ).join('\n\n---\n\n')

      return {
        content: [{
          type: 'text',
          text: formatted || 'No relevant documents found.',
        }],
      }
    } catch (error) {
      return {
        content: [{ type: 'text', text: `Search failed: ${error instanceof Error ? error.message : 'Unknown error'}` }],
        isError: true,
      }
    }
  },
)

// ── Tool 2: Canvas Node Create ───────────────────────────────────────────────
mcpServer.tool(
  'create_canvas_node',
  'Create a new node on the collaborative canvas. Returns the created node ID for subsequent connections.',
  {
    label: z.string().min(1).max(200),
    nodeType: z.enum(['component', 'service', 'database', 'queue', 'user', 'external']),
    position: z.object({ x: z.number(), y: z.number() }),
  },
  async ({ label, nodeType, position }, extra) => {
    const orgId = extra.authInfo?.extra?.orgId as string
    const userId = extra.authInfo?.extra?.userId as string

    const node = await db.insert(canvasNodes).values({
      label, nodeType, position: JSON.stringify(position),
      orgId, createdBy: userId,
    }).returning({ id: canvasNodes.id })

    return {
      content: [{
        type: 'text',
        text: `Canvas node created. ID: ${node[0].id}. Label: "${label}" (${nodeType})`,
      }],
    }
  },
)

// ── Tool 3: Document Draft Append ────────────────────────────────────────────
mcpServer.tool(
  'append_to_document',
  'Append a section to an existing workspace document. Requires document ID and section content.',
  {
    documentId: z.string().uuid(),
    sectionContent: z.string().min(1),
    sectionHeading: z.string().min(1),
  },
  async ({ documentId, sectionContent, sectionHeading }, extra) => {
    // This tool modifies data — requireHumanApproval will gate this in Part 17
    return {
      content: [{
        type: 'text',
        text: `Section "${sectionHeading}" appended to document ${documentId}.`,
      }],
    }
  },
)

// ✅ Fastify HTTP server with MCP transport + OAuth 2.1 validation
// file: apps/mcp-server/src/http.ts

import Fastify from 'fastify'
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
import { verifyBearerToken } from './auth/oauth'

const fastify = Fastify()

// OAuth 2.1 middleware — validates bearer tokens on every MCP request
fastify.addHook('preHandler', async (req, reply) => {
  if (req.url.startsWith('/mcp')) {
    const authHeader = req.headers.authorization
    if (!authHeader?.startsWith('Bearer ')) {
      reply.status(401).send({ error: 'Bearer token required' })
      return
    }
    const token = authHeader.slice(7)
    const claims = await verifyBearerToken(token)
    if (!claims) {
      reply.status(401).send({ error: 'Invalid or expired token' })
      return
    }
    // Attach verified claims for use in tool handlers
    req.authClaims = claims
  }
})

fastify.all('/mcp', async (req, reply) => {
  const transport = new StreamableHTTPServerTransport({
    sessionIdGenerator: () => crypto.randomUUID(),
    onsessioninitialized: (sessionId) => {
      // Store session → auth claims mapping for tool handlers
    },
  })

  await mcpServer.connect(transport)
  await transport.handleRequest(req.raw, reply.raw, req.body)
})

await fastify.listen({ port: 3001 })
console.log('MCP Server running on :3001')

// ✅ MCP error contract — always return { isError: true }, never throw
// This is enforced in all three tool definitions above

// ❌ Anti-Pattern — exception crashes the session
mcpServer.tool('bad_tool', '...', {}, async () => {
  throw new Error('Database connection failed')  // Kills the whole MCP session
})

// ✅ Correct — structured error response preserves session
mcpServer.tool('good_tool', '...', {}, async () => {
  try {
    const result = await riskyOperation()
    return { content: [{ type: 'text', text: result }] }
  } catch (error) {
    return {
      content: [{ type: 'text', text: `Operation failed: ${error instanceof Error ? error.message : 'Unknown'}` }],
      isError: true,
    }
  }
})