import {
  assertProductionDatabaseTransport,
  type DatabaseTransportEnvironment,
  type DatabaseTransportPolicy,
  createDatabaseTransportPolicy,
} from "../database/transport.js";

/**
 * The one place every Core-owned executable reads its database transport policy from the process
 * environment, so `pnpm doctor`, `pnpm migrations:plan`, `pnpm migrations:apply`, and
 * `pnpm authorization:bootstrap-owner` cannot drift from each other or from `apps/api`.
 *
 * Environment reading lives here, in the executable layer, deliberately: the reusable Core
 * database/migration constructors keep taking explicit typed inputs and never touch `process.env`.
 * `NODE_ENV` is interpreted exactly as `apps/api` interprets it — only the literal string
 * `"development"` relaxes anything, so an unset or misspelled value validates as production.
 */
export function readDatabaseTransportFromEnvironment(): {
  readonly environment: DatabaseTransportEnvironment;
  readonly transport: DatabaseTransportPolicy;
} {
  const environment: DatabaseTransportEnvironment =
    process.env.NODE_ENV === "development" ? "development" : "production";
  const transport = createDatabaseTransportPolicy(
    {
      ...(process.env.EKKLESIA_DATABASE_CA === undefined
        ? {}
        : { certificateAuthority: process.env.EKKLESIA_DATABASE_CA }),
      ...(process.env.EKKLESIA_DATABASE_TLS_MODE === undefined
        ? {}
        : { mode: process.env.EKKLESIA_DATABASE_TLS_MODE }),
    },
    { environment },
  );
  return { environment, transport };
}

/**
 * Resolves the policy and asserts it is safe for the given database URL before any client, pool,
 * or connection is constructed. Throws the sanitized `DatabaseTransportError` otherwise.
 */
export function resolveExecutableDatabaseTransport(databaseUrl: string): DatabaseTransportPolicy {
  const { environment, transport } = readDatabaseTransportFromEnvironment();
  assertProductionDatabaseTransport(databaseUrl, transport, environment);
  return transport;
}