steipete--codexbar/Sources/CodexBarCore/ManagedCodexAccountStore.swift

import Foundation

public enum FileManagedCodexAccountStoreError: Error, Equatable, Sendable {
    case unsupportedVersion(Int)
}

public protocol ManagedCodexAccountStoring: Sendable {
    func loadAccounts() throws -> ManagedCodexAccountSet
    func storeAccounts(_ accounts: ManagedCodexAccountSet) throws
    func ensureFileExists() throws -> URL
}

public struct FileManagedCodexAccountStore: ManagedCodexAccountStoring, @unchecked Sendable {
    public static let currentVersion = 3

    private let fileURL: URL
    private let fileManager: FileManager

    public init(fileURL: URL = Self.defaultURL(), fileManager: FileManager = .default) {
        self.fileURL = fileURL
        self.fileManager = fileManager
    }

    public func loadAccounts() throws -> ManagedCodexAccountSet {
        guard self.fileManager.fileExists(atPath: self.fileURL.path) else {
            return Self.emptyAccountSet()
        }

        let data = try Data(contentsOf: self.fileURL)
        let decoder = JSONDecoder()
        let accounts = try decoder.decode(ManagedCodexAccountSet.self, from: data)
        guard (1...Self.currentVersion).contains(accounts.version) else {
            throw FileManagedCodexAccountStoreError.unsupportedVersion(accounts.version)
        }
        if accounts.version == Self.currentVersion {
            return ManagedCodexAccountSet(version: Self.currentVersion, accounts: accounts.accounts)
        }
        return self.migrateLegacyAccounts(accounts)
    }

    public func storeAccounts(_ accounts: ManagedCodexAccountSet) throws {
        let normalizedAccounts = ManagedCodexAccountSet(
            version: Self.currentVersion,
            accounts: accounts.accounts)
        let encoder = JSONEncoder()
        encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
        let data = try encoder.encode(normalizedAccounts)
        let directory = self.fileURL.deletingLastPathComponent()
        if !self.fileManager.fileExists(atPath: directory.path) {
            try self.fileManager.createDirectory(at: directory, withIntermediateDirectories: true)
        }
        try data.write(to: self.fileURL, options: [.atomic])
        try self.applySecurePermissionsIfNeeded()
    }

    public func ensureFileExists() throws -> URL {
        if self.fileManager.fileExists(atPath: self.fileURL.path) { return self.fileURL }
        try self.storeAccounts(Self.emptyAccountSet())
        return self.fileURL
    }

    private func applySecurePermissionsIfNeeded() throws {
        #if os(macOS)
        try self.fileManager.setAttributes([
            .posixPermissions: NSNumber(value: Int16(0o600)),
        ], ofItemAtPath: self.fileURL.path)
        #endif
    }

    private static func emptyAccountSet() -> ManagedCodexAccountSet {
        ManagedCodexAccountSet(version: self.currentVersion, accounts: [])
    }

    private func migrateLegacyAccounts(_ accounts: ManagedCodexAccountSet) -> ManagedCodexAccountSet {
        let migratedAccounts = accounts.accounts.map { account in
            let hydratedProviderAccountID = account.providerAccountID ?? self.hydrateProviderAccountID(for: account)
            return ManagedCodexAccount(
                id: account.id,
                email: account.email,
                providerAccountID: hydratedProviderAccountID,
                workspaceLabel: account.workspaceLabel,
                workspaceAccountID: account.workspaceAccountID,
                authFingerprint: account.authFingerprint ?? CodexAuthFingerprint.fingerprint(
                    homePath: account.managedHomePath,
                    fileManager: self.fileManager),
                managedHomePath: account.managedHomePath,
                createdAt: account.createdAt,
                updatedAt: account.updatedAt,
                lastAuthenticatedAt: account.lastAuthenticatedAt)
        }
        return ManagedCodexAccountSet(version: Self.currentVersion, accounts: migratedAccounts)
    }

    private func hydrateProviderAccountID(for account: ManagedCodexAccount) -> String? {
        guard let credentials = try? CodexOAuthCredentialsStore.load(
            env: ["CODEX_HOME": account.managedHomePath])
        else {
            return nil
        }
        let payload = credentials.idToken.flatMap(UsageFetcher.parseJWT)
        let authDict = payload?["https://api.openai.com/auth"] as? [String: Any]
        let providerAccountID = credentials.accountId
            ?? (authDict?["chatgpt_account_id"] as? String)
            ?? (payload?["chatgpt_account_id"] as? String)
        return ManagedCodexAccount.normalizeProviderAccountID(providerAccountID)
    }

    public static func defaultURL() -> URL {
        let base = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask).first
            ?? FileManager.default.homeDirectoryForCurrentUser
        return base
            .appendingPathComponent("CodexBar", isDirectory: true)
            .appendingPathComponent("managed-codex-accounts.json")
    }
}