/**
 * ICE servers for a browser about to watch a printer camera.
 *
 * ## Why the browser needs these at all
 *
 * A viewer's browser cannot reach a gateway directly. The gateway is behind a
 * workshop NAT, and go2rtc will not talk to a browser cross-origin anyway -
 * measured against 1.9.14, it sends no CORS headers and checks its API
 * password before CORS, so a browser's unauthenticated preflight gets a 401.
 * The SDP exchange is therefore relayed through this backend, and the media
 * itself goes over a TURN relay.
 *
 * ## Why only the browser gets credentials
 *
 * The browser is pinned to `iceTransportPolicy: "relay"`, so it gathers a
 * relay candidate and go2rtc simply sends to it from its own candidate. Only
 * one side of a WebRTC session has to hold a relay for media to traverse one.
 *
 * That asymmetry is load-bearing rather than tidy: go2rtc reads its config
 * exactly once at startup, so TURN credentials on the gateway would have to
 * be rotated by restarting go2rtc and dropping every viewer on a timer.
 * Browser-side, rotation lands on a request that is already per-viewer.
 *
 * ## What this buys over proxying the video
 *
 * WebRTC media is DTLS-SRTP encrypted between the browser and the gateway, so
 * the relay forwards packets it cannot decrypt. The alternative considered -
 * tunnelling fMP4 up the gateway's uplink and streaming it from this process -
 * would have put plaintext video through the API, and `<video>` cannot send
 * an `Authorization` header, so it would have needed a credential in the URL.
 * That is the pattern `/ws/telemetry` deliberately rejected.
 *
 * ## Unconfigured is a supported state
 *
 * No Cloudflare credentials means no TURN, and that is not a boot failure the
 * way R2 is: a farm with no cameras, or one whose operator is on the same LAN
 * as the gateway, works without it. The endpoint says so rather than
 * pretending, because "no iceServers" and "TURN is broken" need different
 * answers from whoever is looking.
 */

const KEY_ID = process.env.CLOUDFLARE_TURN_KEY_ID;
const API_TOKEN = process.env.CLOUDFLARE_TURN_API_TOKEN;

/**
 * Short on purpose. These are handed to a browser, so the window in which a
 * leaked one is useful is the window this sets. An hour outlasts setting up a
 * session comfortably; a viewer watching longer than that has their relay
 * drop and the player renegotiates, which costs a reconnect and gets fresh
 * credentials - the right trade against a credential that stays good all day.
 */
const TTL_SECONDS = 3600;

/** Whether TURN is configured at all. */
export function turnConfigured(): boolean {
  return Boolean(KEY_ID && API_TOKEN);
}

export type IceServer = {
  urls: string | string[];
  username?: string;
  credential?: string;
};

/**
 * Mints a short-lived set of ICE servers, or returns null when TURN is not
 * configured.
 *
 * Throws only when TURN *is* configured and Cloudflare refused: that is a
 * real fault and must not be reported as "no TURN here", which would send a
 * viewer into a session that cannot carry media.
 */
export async function mintIceServers(): Promise<IceServer[] | null> {
  if (!KEY_ID || !API_TOKEN) return null;

  const response = await fetch(
    `https://rtc.live.cloudflare.com/v1/turn/keys/${encodeURIComponent(KEY_ID)}/credentials/generate-ice-servers`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${API_TOKEN}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ ttl: TTL_SECONDS }),
    },
  );

  // 201 on success, per Cloudflare's own docs, so this checks the class.
  if (!response.ok) {
    // The body carries the reason - a wrong key id, a revoked token - and a
    // bare status would send whoever reads this at the network instead.
    const detail = await response.text().catch(() => "");
    throw new Error(
      `Cloudflare TURN refused to mint credentials (HTTP ${response.status})` +
        (detail.trim() ? `: ${detail.trim().slice(0, 300)}` : ""),
    );
  }

  const body = (await response.json()) as { iceServers?: IceServer | IceServer[] };
  if (!body.iceServers) {
    throw new Error("Cloudflare TURN returned no iceServers");
  }
  // Cloudflare returns a single object; the browser's RTCPeerConnection wants
  // a list. Normalised here so every caller does not have to know that.
  return Array.isArray(body.iceServers) ? body.iceServers : [body.iceServers];
}