const PING = 'TB/PING';
const BRIDGE_PING = 'APP/PING';
const BRIDGE_READY = 'TB/BRIDGE_READY';
const OIDC_USER = 'TB/OIDC_USER';
const OIDC_TOKEN = 'TB/OIDC_TOKEN';
const SIGN_IN_COMPLETE = 'SIGN_IN_COMPLETE';
const SIGN_OUT = 'SIGN_OUT';
const SEND_MESSAGE_TO_BRIDGE = 'SEND_MESSAGE_TO_BRIDGE';
const GET_LOGIN_STATE = 'GET_LOGIN_STATE';
const LOGIN_STATE_RESPONSE = 'LOGIN_STATE_RESPONSE';
const SIGN_IN = 'SIGN_IN';
const FORCE_CLOSE_WINDOW = 'FORCE_CLOSE_WINDOW';
const OPEN_MANAGEMENT_PAGE = 'OPEN_MANAGEMENT_PAGE';
// Add-On to Web — request/response pair for fetching the staged OIDC token set.
// The web page cannot call browser.storage.local directly, so it asks the
// background script to read it on its behalf via these two message types:
//   GET_PENDING_ADDON_TOKEN  : web page → bridge → background  ("give me the token")
//   PENDING_ADDON_TOKEN_RESPONSE : background → bridge → web page ("here it is")
const GET_PENDING_ADDON_TOKEN = 'TB/GET_PENDING_ADDON_TOKEN';
const PENDING_ADDON_TOKEN_RESPONSE = 'TB/PENDING_ADDON_TOKEN_RESPONSE';
// Telemetry pref bridge (issue #952). The hosted Send dashboard cannot call the
// browser.thundermailTelemetry experiment API, so it asks the background for the pref:
//   GET_TELEMETRY_STATE      : web page → bridge → background
//   TELEMETRY_STATE_RESPONSE : background → bridge → web page
//   TELEMETRY_STATE_CHANGED  : background → bridge → web page (runtime change)
const GET_TELEMETRY_STATE = 'TB/GET_TELEMETRY_STATE';
const TELEMETRY_STATE_RESPONSE = 'TB/TELEMETRY_STATE_RESPONSE';
const TELEMETRY_STATE_CHANGED = 'TB/TELEMETRY_STATE_CHANGED';

window.postMessage({ type: BRIDGE_READY }, window.location.origin);
console.log(`[🌉 token-bridge] the token bridge has loaded.`);

// Initial message to the background
browser.runtime.sendMessage({
  type: PING,
  text: 'This got sent from the bridge to the background.',
});

window.addEventListener('message', (e) => {
  // Security: this bridge forwards messages straight to the privileged add-on
  // background (OIDC tokens, the encryption passphrase, sign-in/out). Only trust
  // messages the app page posted to itself:
  //   • e.source !== window  → came from an embedded/cross-origin frame or
  //     another window, not the top app page. Reject.
  //   • e.origin !== window.location.origin → not same-origin. Reject.
  // Combined with the scoped content_scripts `matches` in the manifest (the
  // bridge is only injected on the Send app's own origins), this keeps a
  // third-party page or frame from driving the add-on.
  if (e.source !== window) return;
  if (e.origin !== window.location.origin) return;

  // ----- Web to add-on: Step 6b — refresh token → background (Thundermail) -----
  // handleOIDCCallback() posts OIDC_TOKEN with the refresh_token so that
  // background.ts can create/update the Thundermail mail account.
  if (e?.data?.type === OIDC_TOKEN) {
    browser.runtime.sendMessage({
      type: OIDC_TOKEN,
      token: String(e.data.token ?? ''),
      email: String(e.data.email ?? ''),
      name: String(e.data.name ?? ''),
    });
  }

  // ----- Web to add-on: Step 6c — full User object → background (auth storage) -----
  // handleOIDCCallback() posts OIDC_USER with the full oidc-client-ts User so
  // background.ts can persist it in browser.storage.local[STORAGE_KEY_AUTH].
  // This is what loadUser() reads back later to re-hydrate the OIDC session
  // in the extension popup without requiring a new login.
  if (e?.data?.type === OIDC_USER) {
    const userData = e.data.user;

    if (userData && typeof userData === 'object') {
      browser.runtime.sendMessage({
        type: OIDC_USER,
        user: userData,
      });
    }
  }

  if (e?.data?.type === SIGN_IN) {
    browser.runtime.sendMessage({
      type: SIGN_IN,
    });
  }

  if (e?.data?.type === SIGN_IN_COMPLETE) {
    browser.runtime.sendMessage({
      type: SIGN_IN_COMPLETE,
    });
  }

  if (e?.data?.type === BRIDGE_PING) {
    browser.runtime.sendMessage({
      type: PING,
      text: String(e.data.text ?? ''),
    });
  }

  if (e?.data?.type === SEND_MESSAGE_TO_BRIDGE) {
    browser.runtime.sendMessage({
      type: SEND_MESSAGE_TO_BRIDGE,
      value: e.data.value,
    });
  }

  if (e?.data?.type === GET_LOGIN_STATE) {
    browser.runtime.sendMessage({
      type: GET_LOGIN_STATE,
    });
  }

  if (e?.data?.type === FORCE_CLOSE_WINDOW) {
    browser.runtime.sendMessage({
      type: FORCE_CLOSE_WINDOW,
    });
  }

  if (e?.data?.type === OPEN_MANAGEMENT_PAGE) {
    browser.runtime.sendMessage({
      type: OPEN_MANAGEMENT_PAGE,
    });
  }

  if (e?.data?.type === SIGN_OUT) {
    browser.runtime.sendMessage({
      type: SIGN_OUT,
    });
  }

  // ----- Add-On to Web: fetch staged token from background -----
  // Step 4 of the Add-On to Web flow.
  // The /addon-auth web page posts this to ask the background script to read
  // PENDING_ADDON_TOKEN out of browser.storage.local on its behalf.
  // The background will respond with PENDING_ADDON_TOKEN_RESPONSE (see below).
  if (e?.data?.type === GET_PENDING_ADDON_TOKEN) {
    browser.runtime.sendMessage({
      type: GET_PENDING_ADDON_TOKEN,
    });
  }

  // ----- Web to add-on: hosted dashboard asks for the telemetry pref -----
  // The background returns the state as the sendMessage response (scoped to
  // this tab), which we relay back to the page. It answers only for our own
  // Send tabs, so a non-Send page gets no response and the page fails closed.
  if (e?.data?.type === GET_TELEMETRY_STATE) {
    browser.runtime
      .sendMessage({ type: GET_TELEMETRY_STATE })
      .then((response) => {
        if (response?.type === TELEMETRY_STATE_RESPONSE) {
          window.postMessage(
            { type: TELEMETRY_STATE_RESPONSE, enabled: response.enabled },
            window.location.origin
          );
        }
      })
      .catch(() => {
        // No handler / not our tab — the page-side timeout fails closed.
      });
  }
});

// Listen for responses from background script and forward to web app
browser.runtime.onMessage.addListener((message) => {
  if (message.type === LOGIN_STATE_RESPONSE) {
    window.postMessage(
      {
        type: LOGIN_STATE_RESPONSE,
        isLoggedIn: message.isLoggedIn,
        username: message.username,
      },
      window.location.origin
    );
  }

  // Forward an OIDC token obtained by the background (e.g. from the Accounts Hub)
  // to the web app so it can log the user in automatically.
  if (message.type === OIDC_TOKEN) {
    window.postMessage(
      {
        type: OIDC_TOKEN,
        token: message.token,
        email: message.email,
        name: message.name,
      },
      window.location.origin
    );
  }

  // ----- Add-On to Web: return staged token to the web page -----
  // Step 5 of the Add-On to Web flow.
  // The background has read PENDING_ADDON_TOKEN from storage and sends it here.
  // We forward it to the /addon-auth page so authenticateWithAddonToken()
  // can resolve its Promise and proceed with authentication.
  if (message.type === PENDING_ADDON_TOKEN_RESPONSE) {
    window.postMessage(
      {
        type: PENDING_ADDON_TOKEN_RESPONSE,
        tokenSet: message.tokenSet,
      },
      window.location.origin
    );
  }

  // ----- Add-on to Web: telemetry runtime change (issue #952) -----
  // The GET_TELEMETRY_STATE reply is handled inline as the sendMessage
  // response above; here we only forward unsolicited runtime changes the
  // background broadcasts to our Send tabs.
  if (message.type === TELEMETRY_STATE_CHANGED) {
    window.postMessage(
      {
        type: TELEMETRY_STATE_CHANGED,
        enabled: message.enabled,
      },
      window.location.origin
    );
  }
});