// ❌ DANGEROUS - Bypasses all authentication
// Anyone with access to this file can call startScrape with arbitrary URLs
import { components } from "./_generated/api";
export const scrape = components.firecrawlScrape.lib.startScrape;

// ✅ SAFE - Auth enforced, API key controlled
import { exposeApi } from "convex-firecrawl-scrape";
export const { scrape } = exposeApi(components.firecrawlScrape, {
  auth: async (ctx) => {
    const identity = await ctx.auth.getUserIdentity();
    if (!identity) throw new Error("Unauthorized");
    return process.env.FIRECRAWL_API_KEY!;
  },
});

import { exposeApi } from "convex-firecrawl-scrape";
import { mutation } from "./_generated/server";
import { v } from "convex/values";

// Private: the actual scrape function with auth
const { scrape: internalScrape } = exposeApi(components.firecrawlScrape, {
  auth: async (ctx) => {
    const identity = await ctx.auth.getUserIdentity();
    if (!identity) throw new Error("Unauthorized");
    return process.env.FIRECRAWL_API_KEY!;
  },
});

// Configuration
const ALLOWED_DOMAINS = ["example.com", "docs.example.com", "blog.example.com"];

// Public: wrapped function with domain validation
export const scrapeAllowlisted = mutation({
  args: { url: v.string() },
  handler: async (ctx, args) => {
    const url = new URL(args.url);
    const isAllowed = ALLOWED_DOMAINS.some(
      (d) => url.hostname === d || url.hostname.endsWith(`.${d}`),
    );
    if (!isAllowed) {
      throw new Error(`Domain not in allowlist: ${url.hostname}`);
    }
    return await internalScrape(ctx, { url: args.url });
  },
});

export const { scrape, getStatus, getContent, getCached, invalidate } =
  exposeApi(components.firecrawlScrape, {
    auth: async (ctx, operation) => {
      const identity = await ctx.auth.getUserIdentity();
      if (!identity) throw new Error("Unauthorized");

      // Require admin role for write operations
      if (operation === "scrape" || operation === "invalidate") {
        const user = await ctx.db
          .query("users")
          .withIndex("by_token", (q) =>
            q.eq("tokenIdentifier", identity.tokenIdentifier),
          )
          .unique();

        if (user?.role !== "admin") {
          throw new Error("Admin role required for this operation");
        }
      }

      return process.env.FIRECRAWL_API_KEY!;
    },
  });

import { RateLimiter } from "@convex-dev/ratelimiter";

const rateLimiter = new RateLimiter(components.rateLimiter, {
  scrapePerUser: {
    kind: "token bucket",
    rate: 10, // 10 requests
    period: 60000, // per minute
    capacity: 20, // burst capacity
  },
});

export const scrapeWithRateLimit = mutation({
  args: { url: v.string() },
  handler: async (ctx, args) => {
    const identity = await ctx.auth.getUserIdentity();
    if (!identity) throw new Error("Unauthorized");

    const { ok, retryAfter } = await rateLimiter.limit(ctx, "scrapePerUser", {
      key: identity.tokenIdentifier,
    });

    if (!ok) {
      throw new Error(`Rate limited. Retry after ${retryAfter}ms`);
    }

    return await scrape(ctx, { url: args.url });
  },
});

export const scrapeWithAudit = mutation({
  args: { url: v.string() },
  handler: async (ctx, args) => {
    const identity = await ctx.auth.getUserIdentity();
    if (!identity) throw new Error("Unauthorized");

    // Log the request
    await ctx.db.insert("auditLog", {
      action: "scrape",
      userId: identity.tokenIdentifier,
      url: args.url,
      timestamp: Date.now(),
      ip: ctx.request?.ip, // if available
    });

    return await scrape(ctx, { url: args.url });
  },
});