import { createCsrfMiddleware, createMiddleware, createStart } from "@tanstack/react-start";

const health = createMiddleware().server(({ request, next }) => {
  if (request.method === "GET" && new URL(request.url).pathname === "/health") {
    return Response.json({ status: "ok" }, { headers: { "Cache-Control": "no-store" } });
  }
  return next();
});

// Private MCP clients do not carry a browser session or Tailscale identity.
// Keep this exact endpoint ahead of browser-only access checks.
const mcp = createMiddleware().server(async ({ request, next }) => {
  const path = new URL(request.url).pathname;
  // Explicitly report that this private endpoint does not advertise OAuth.
  if (
    ["/.well-known/oauth-protected-resource", "/.well-known/oauth-protected-resource/mcp"].includes(
      path,
    )
  )
    return new Response(null, { status: 404 });
  if (path !== "/mcp") return next();
  const { handleMcpRequest } = await import("./features/mcp/http.server");
  return handleMcpRequest(request);
});

const ownerAccess = createMiddleware().server(async ({ request, next }) => {
  const { checkAccess, readAccessConfig } = await import("./features/access/policy.server");
  return checkAccess(request, readAccessConfig()) ?? next();
});

const csrf = createCsrfMiddleware({
  filter: (context) => context.handlerType === "serverFn",
});

const appSession = createMiddleware().server(async ({ request, next }) => {
  const { checkSessionAccess } = await import("./features/auth/gate.server");
  const { setResponseHeader } = await import("@tanstack/react-start/server");
  setResponseHeader("Cache-Control", "no-store");
  return checkSessionAccess(request) ?? next();
});

const storage = createMiddleware().server(async ({ next }) => {
  const { getDatabase } = await import("./features/storage/database.server");
  getDatabase();
  return next();
});

export const startInstance = createStart(() => ({
  requestMiddleware: [health, mcp, ownerAccess, csrf, storage, appSession],
}));