// redis's provisioner — the adapter that makes redis a provider of the mesh `redis-cache`
// interface. The watching, sealing and grant-file handling are the sdk harness's; this writes only
// the per-service half: how redis creates and removes a per-consumer cache (novox/hq ADR 0044/0045).
//
// The `redis-cache` interface: a consumer receives `{ host, port, username, password,
// keyspacePrefix }` and stores its keys under `<keyspacePrefix>:*`, isolated from every other
// consumer by an ACL user scoped to exactly that prefix.
//
// Identity (the ACL username and keyspace) is derived from `grant.consumer` alone — never from
// `grant.values` — because on removal the harness hands the adapter a grant carrying only the
// consumer. Deriving from the consumer keeps create and remove naming the same resource.

import { runProvisioner, type Grant, type Credential } from "@novox/mesh-sdk/provisioner";
import { emit } from "@novox/mesh-sdk/events";
import { RedisClient, generatePassword } from "../client.js";

const redis = RedisClient.fromEnv();

/** A stable, ACL-safe identity for a consumer: only [A-Za-z0-9_.-], never empty. */
function identity(consumer: string): string {
  const safe = consumer.replace(/[^A-Za-z0-9_.-]/g, "_").replace(/^_+|_+$/g, "");
  return safe || "consumer";
}

/** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
async function announce(type: string, body: Record<string, string>): Promise<void> {
  try {
    await emit(type, body);
  } catch (err) {
    console.error(`[provisioner:redis-cache] emit ${type} failed: ${err}`);
  }
}

runProvisioner("redis-cache", {
  async create(grant: Grant): Promise<Credential> {
    const username = identity(grant.consumer);
    const keyspacePrefix = username;
    const password = generatePassword();
    await redis.createAclUser(username, password, keyspacePrefix);
    await announce("module.redis.cache.provisioned", { consumer: grant.consumer, username, keyspacePrefix });
    return {
      fields: {
        host: redis.host,
        port: String(redis.port),
        username,
        password,
        keyspacePrefix,
      },
    };
  },

  async remove(grant: Grant): Promise<void> {
    const username = identity(grant.consumer);
    await redis.deleteAclUser(username);
    await announce("module.redis.cache.deprovisioned", { consumer: grant.consumer, username });
  },
});