ConfigUtils.ts

// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

import { readFileSync, existsSync } from 'fs'
import { Config, RawConfig, rawConfigSchema } from './Config.js'
import { Env } from '../env.js'

export class ConfigUtils {
    static loadConfigFile(filePath: string): Config {
        if (existsSync(filePath)) {
            const rawJson = JSON.parse(readFileSync(filePath, 'utf-8'))
            const normalizedJson = normalizeConfigUrls(rawJson)

            const rawConfig = rawConfigSchema.parse(normalizedJson)

            const config = resolveRawConfig(rawConfig)

            /**
             * Perform extra config validation beyond schema validation.
             * We want to enforce the following constraints:
             *
             * 1. IDP IDs are unique
             * 2. Network IDs are unique
             * 3. Each Network's identityProviderId maps to an existing IDP (in config)
             * 4. Each Network's auth method is compatible with its IDP type
             */
            const duplicateIdpId = hasDuplicateElement(
                config.bootstrap.idps.map((idp) => idp.id)
            )
            if (duplicateIdpId) {
                throw new Error(
                    `Non-unique IDP IDs found in config file: ${duplicateIdpId}`
                )
            }

            const duplicateNetworkId = hasDuplicateElement(
                config.bootstrap.networks.map((network) => network.id)
            )
            if (duplicateNetworkId) {
                throw new Error(
                    `Non-unique Network IDs found in config file: ${duplicateNetworkId}`
                )
            }

            const invalidMapping = validateNetworkToIdpMapping(config)
            if (invalidMapping) {
                throw new Error(
                    `Network ${invalidMapping.networkId} references unknown Identity Provider ID ${invalidMapping.idpId}`
                )
            }

            const invalidAuthMethod = validateNetworkAuthMethods(config)
            if (invalidAuthMethod) {
                throw new Error(
                    `Network ${invalidAuthMethod.networkId} has invalid auth method ${invalidAuthMethod.invalidAuthMethod} for its Identity Provider`
                )
            }

            return config
        } else {
            throw new Error("Supplied file path doesn't exist " + filePath)
        }
    }
}

function normalizeConfigUrls(input: unknown): unknown {
    if (!input || typeof input !== 'object') {
        return input
    }

    const candidate = input as {
        bootstrap?: {
            idps?: Array<{ issuer?: string }>
            networks?: Array<{ ledgerApi?: { baseUrl?: string } }>
        }
    }

    const idps = candidate.bootstrap?.idps
    if (Array.isArray(idps)) {
        for (const idp of idps) {
            const issuer = idp.issuer
            if (typeof issuer === 'string' && shouldNormalizeAsUrl(issuer)) {
                idp.issuer = normalizeBaseUrl(issuer)
            }
        }
    }

    const networks = candidate.bootstrap?.networks
    if (Array.isArray(networks)) {
        for (const network of networks) {
            const baseUrl = network.ledgerApi?.baseUrl
            if (typeof baseUrl === 'string') {
                network.ledgerApi!.baseUrl = normalizeBaseUrl(baseUrl)
            }
        }
    }

    return input
}

function shouldNormalizeAsUrl(value: string): boolean {
    const trimmed = value.trim()

    // Preserve non-URL issuers for self-signed setups, e.g. "unsafe-auth".
    if (
        !trimmed.includes('://') &&
        !trimmed.includes('.') &&
        !trimmed.includes(':')
    ) {
        return trimmed.toLowerCase() === 'localhost'
    }

    return true
}

function normalizeBaseUrl(baseUrl: string): string {
    const trimmed = baseUrl.trim()

    if (trimmed.length === 0) {
        return baseUrl
    }

    if (trimmed.includes('://')) {
        return normalizeUrlWithProtocol(new URL(trimmed))
    }

    const withDefaultProtocol = new URL(`http://${trimmed}`)
    const hasExplicitPort = hasPortInAuthority(trimmed)
    if (!hasExplicitPort) {
        withDefaultProtocol.port = '80'
    }

    return normalizeUrlWithProtocol(withDefaultProtocol)
}

function hasPortInAuthority(rawValue: string): boolean {
    const authority = rawValue.split(/[/?#]/)[0]

    // IPv6 literal with explicit port, e.g. [::1]:5003
    if (authority.startsWith('[')) {
        return authority.includes(']:')
    }

    return authority.includes(':')
}

function normalizeUrlWithProtocol(url: URL): string {
    const defaultPort =
        url.protocol === 'http:' ? '80' : url.protocol === 'https:' ? '443' : ''
    const port = url.port || defaultPort
    const hostname = url.hostname.includes(':')
        ? `[${url.hostname}]`
        : url.hostname
    const authority = port ? `${hostname}:${port}` : hostname
    const path =
        url.pathname === '/' && !url.search && !url.hash
            ? ''
            : `${url.pathname}${url.search}${url.hash}`

    return `${url.protocol}//${authority}${path}`
}

type RawNetworkAuth = NonNullable<
    RawConfig['bootstrap']['networks'][number]['adminAuth']
>
type NetworkAuth = NonNullable<
    Config['bootstrap']['networks'][number]['adminAuth']
>

// The Wallet Gateway can accept adminAuth secrets from environment variables.
// However, the store expects strings. This function resolves the config from env vars
function resolveRawNetworkAuth(n: RawNetworkAuth): NetworkAuth {
    if (n.method === 'authorization_code') {
        return n
    }

    if ('clientSecret' in n) {
        return n
    } else {
        const { clientSecretEnv, ...rest } = n
        const clientSecret = Env.get(clientSecretEnv, { required: true })
        return {
            ...rest,
            clientSecret,
        }
    }
}

function resolveRawConfig(rawConfig: RawConfig): Config {
    const rawNetworks = rawConfig.bootstrap.networks
    const networks: Config['bootstrap']['networks'] = rawNetworks.map((n) => {
        return {
            ...n,
            auth: resolveRawNetworkAuth(n.auth),
            adminAuth: n.adminAuth
                ? resolveRawNetworkAuth(n.adminAuth)
                : undefined,
        }
    })

    return {
        ...rawConfig,
        bootstrap: {
            ...rawConfig.bootstrap,
            networks,
        },
    }
}

function hasDuplicateElement(list: string[]): string | undefined {
    let duplicate: string | undefined
    list.forEach((item, i) => {
        if (list.indexOf(item) !== i && duplicate === undefined) {
            duplicate = item
        }
    })
    return duplicate
}

function validateNetworkToIdpMapping(
    config: Config
): { networkId: string; idpId: string } | undefined {
    for (const network of config.bootstrap.networks) {
        const idp = config.bootstrap.idps.find(
            (idp) => idp.id === network.identityProviderId
        )

        if (typeof idp === 'undefined') {
            return { networkId: network.id, idpId: network.identityProviderId }
        }
    }
}

const SUPPORTED_IDP_METHODS = {
    self_signed: ['self_signed'],
    oauth: ['authorization_code', 'client_credentials'],
}

function validateNetworkAuthMethods(
    config: Config
): { networkId: string; invalidAuthMethod: string } | undefined {
    for (const network of config.bootstrap.networks) {
        const idp = config.bootstrap.idps.find(
            (idp) => idp.id === network.identityProviderId
        )!

        if (!SUPPORTED_IDP_METHODS[idp.type].includes(network.auth.method)) {
            return {
                networkId: network.id,
                invalidAuthMethod: network.auth.method,
            }
        }
    }
}

interface Urls {
    serviceUrl: string
    publicUrl: string
    dappApiUrl: string
    userApiUrl: string
}

// Strips duplicate slashes from a URL, except for the protocol part (e.g., "http://")
function stripDuplicateSlashes(path: string): string {
    return path.replace(/(https?:\/\/)|(\/)+/g, '$1$2')
}

export const deriveUrls = (config: Config, port?: number): Urls => {
    const serviceUrl = `http://localhost:${port || config.server.port}`
    const publicUrl = config.kernel.publicUrl || serviceUrl

    const dappApiUrl = stripDuplicateSlashes(
        `${publicUrl}/${config.server.dappPath}`
    )

    const userApiUrl = stripDuplicateSlashes(
        `${publicUrl}/${config.server.userPath}`
    )

    return { dappApiUrl, userApiUrl, publicUrl, serviceUrl }
}