import type {
  IiosPlatformPorts,
  PlatformPrincipal,
  ContextDecisionBundle,
  SourceHandleResolution,
} from '@insignia/iios-contracts';
import { DevOpaPort } from './dev-opa.port';

/** DI token for the platform ports (Session/OPA/CMP/MDM/CRRE/SAS/Capability). */
export const PLATFORM_PORTS = Symbol('PLATFORM_PORTS');

/**
 * P1 default binding: a permissive, in-service implementation so `nest start`
 * runs without the real platform fabric (which other teams own) and without a
 * runtime dependency on the testkit. Tests inject @insignia/iios-testkit fakes
 * to exercise deny / timeout / ambiguous paths. Real adapters replace this from
 * P5 onward.
 */
export class LocalDevPorts implements IiosPlatformPorts {
  session = {
    async verify(_token: string): Promise<PlatformPrincipal> {
      return { principalRef: 'local-dev', orgId: 'org_demo', appId: 'portal-demo', assurance: 'service' };
    },
  };
  // Dev policy plane: default-allow + the membership rules (real OPA swaps in here).
  opa = new DevOpaPort();
  cmp = {
    async checkPurpose(_input: unknown): Promise<{ receiptRef?: string; status: 'ALLOW' | 'DENY' | 'NOT_REQUIRED' }> {
      return { status: 'NOT_REQUIRED' };
    },
  };
  mdm = {
    async resolveSourceHandle(_input: unknown): Promise<SourceHandleResolution> {
      return { confidence: 0, status: 'UNRESOLVED' };
    },
  };
  crre = {
    async resolve(_input: unknown): Promise<ContextDecisionBundle> {
      return { bundleRef: 'local', scopeHash: 'local', resourceSet: [], constraints: [] };
    },
  };
  sas = {
    async tokenizeParts(parts: unknown[]): Promise<unknown[]> {
      return parts;
    },
  };
  capability = {
    async invoke(_input: unknown): Promise<{ providerRef: string; outcome: string }> {
      return { providerRef: 'local', outcome: 'SENT' };
    },
  };
}
