"""Existing integration.execute enqueue seam.

Capability invoke and dashboard execute share this path. Callers must already
have a concrete connection + action; this module does not resolve capabilities.
"""
from __future__ import annotations

from typing import Any, Optional
from uuid import UUID

from src.domain.cloud.schemas import (
    AuthorizeRequest,
    AuthorizeRequestMeta,
    AuthorizeResponseDenied,
)
from src.domain.cloud.service import CloudInternalService, _expected_client_id
from src.domain.connectors.idempotency import execute_idempotency_key
from src.integrations.cloud_control_client import CloudControlClient


async def enqueue_authorized_integration_execute(
    *,
    cloud_svc: CloudInternalService,
    cloud_client: CloudControlClient,
    project: Any,
    workspace_id: UUID,
    connection_id: UUID,
    action: str,
    input: dict[str, Any],
    provider_hint: str,
    idempotency_key: Optional[str] = None,
    approval_token: Optional[str] = None,
    handshake_id: str = "core_dashboard",
) -> dict[str, Any]:
    """Authorize + enqueue the same job the dashboard execute route uses."""
    idem = execute_idempotency_key(idempotency_key)
    auth = await cloud_svc.authorize(
        AuthorizeRequest(
            workspace_id=str(workspace_id),
            project_id=str(project.id),
            client_id=_expected_client_id(project),
            handshake_id=handshake_id,
            request_type="integration.execute",
            idempotency_key=idem,
            connection_id=str(connection_id),
            action=action,
            approval_token=approval_token,
            request_meta=AuthorizeRequestMeta(
                origin="",
                payload_hash="",
                estimated_units=1,
                provider_hint=provider_hint,
            ),
        )
    )
    if isinstance(auth, AuthorizeResponseDenied):
        return {
            "ok": False,
            "reason_code": auth.reason_code or "connector_action_denied",
            "message": auth.message or auth.reason_code,
        }

    result = await cloud_client.enqueue_control_job(
        project_id=str(project.id),
        workspace_id=str(workspace_id),
        client_id=_expected_client_id(project),
        request_type="integration.execute",
        idempotency_key=idem,
        payload={
            "connection_id": str(connection_id),
            "action": action,
            "input": input,
        },
        authorization_id=auth.authorization_id,
        grant_jwt=auth.grant.jwt,
        grant_expires_at=auth.grant.expires_at,
        policy_snapshot=auth.policy_snapshot.model_dump(mode="json"),
    )
    if not result.get("ok"):
        cloud_error = result.get("error") or "cloud_enqueue_failed"
        return {
            "ok": False,
            "reason_code": "provider_unavailable",
            "message": f"Failed to queue connector job: {cloud_error}",
        }
    return {
        "ok": True,
        "job_id": str(result.get("job_id") or ""),
        "status": str(result.get("status") or "queued"),
    }