import * as awsNative from '@pulumi/aws-native';
import { UserPoolClientArgs } from '@pulumi/aws/cognito';

import getRetainOnDelete from '../helpers/utils/getRetainOnDelete';
import { CognitoUserPoolArgs } from '../../.sst/platform/src/components/aws';

const SAML_PROVIDER_NAME = process.env.SAML_PROVIDER_NAME || 'SingleSignOn';

const VALID_EMAIL_DOMAINS = process.env.VALID_EMAIL_DOMAINS;
const DEMO_PERMISSIONS = process.env.DEMO_PERMISSIONS || 'false';

const standardAttributes = [
  'name',
  'family_name',
  'given_name',
  'middle_name',
  'nickname',
  'preferred_username',
  'profile',
  'picture',
  'website',
  'gender',
  'birthdate',
  'zoneinfo',
  'locale',
  'updated_at',
  'address',
  'email',
  'phone_number',
  'sub',
];

const retainOnDelete = getRetainOnDelete();

const clientReadAttributes = structuredClone(standardAttributes);

const cognitoUserPoolArgs: CognitoUserPoolArgs = {
  transform: {
    userPool: (args, opts) => {
      opts.retainOnDelete = retainOnDelete;
      args.aliasAttributes = ['email'];
      args.autoVerifiedAttributes = ['email'];
      // Missing selfSignUpEnabled: true,
      args.passwordPolicy = {
        minimumLength: 8,
        requireLowercase: true,
        requireNumbers: true,
        requireSymbols: false,
        requireUppercase: true,
      };
      args.accountRecoverySetting = {
        recoveryMechanisms: [
          {
            name: 'verifiedEmail',
            priority: 1,
          },
        ],
      };
      args.emailVerificationSubject = 'Your Appointment Assistant Portal verification code';
      args.emailVerificationMessage =
        'Thanks for signing up to the Appointment Assistant Portal! Your verification code is {####}';
      // missing emailStyle: cognito.VerificationEmailStyle.CODE,
    },
  },
};

const cognitoUserPool = new aws.cognito.UserPool(`${$app.stage}-cognitoUserPool`, cognitoUserPoolArgs);

const samlProviderArgs: awsNative.cognito.UserPoolIdentityProviderArgs = {
  providerType: 'SAML',
  providerName: SAML_PROVIDER_NAME,
  userPoolId: cognitoUserPool.id,
  attributeMapping: {
    email: '<http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress>',
  },
  providerDetails: {
    IDPInit: 'true',
    IDPSignout: 'true',
    EncryptedResponses: 'true',
    MetadataURL: process.env.SAML_METADATA_URL,
    RequestSigningAlgorithm: 'rsa-sha256',
  },
};

console.log('about to create samlProvider');
const samlProvider = new awsNative.cognito.UserPoolIdentityProvider(`${$app.stage}-samlIdentityProvider`, samlProviderArgs);
console.log('created samlProvider');
let userPoolClientArgs: UserPoolClientArgs = {
  userPoolId: cognitoUserPool.id,
  name: `${$app.stage}-cognitoUserPoolClient`,
  generateSecret: false,
  readAttributes: clientReadAttributes,
  supportedIdentityProviders: ['COGNITO'],
  explicitAuthFlows: ['ALLOW_USER_SRP_AUTH', 'ALLOW_REFRESH_TOKEN_AUTH'],
};

if (process.env.SAML_METADATA_URL) {
  if (!process.env.PORTAL_URL) {
    throw new Error('PORTAL_URL environment variable is required');
  }

  userPoolClientArgs = {
    ...userPoolClientArgs,
    preventUserExistenceErrors: 'ENABLED',
    allowedOauthFlows: ['code'],
    allowedOauthScopes: ['email', 'openid', 'profile', 'aws.cognito.signin.user.admin'],
    allowedOauthFlowsUserPoolClient: true,
    defaultRedirectUri: `${process.env.PORTAL_URL}/dashboard`,
    callbackUrls: [
      process.env.PORTAL_URL,
      `${process.env.PORTAL_URL}/dashboard`,
      `${process.env.PORTAL_URL}/sso`,
      `${process.env.PORTAL_URL}/signin`,
    ],
    supportedIdentityProviders: [SAML_PROVIDER_NAME, 'COGNITO'],
  };
}

console.log('about to create cognitoUserPoolClient');
const cognitoUserPoolClient = new aws.cognito.UserPoolClient(`${$app.stage}-cognitoUserPoolClient`, userPoolClientArgs);
console.log('created cognitoUserPoolClient');

export { cognitoUserPool, cognitoUserPoolClient };

@pulumi/aws

@pulumi/aws-native

IDPInit: 'true'