"""Core's authoritative project identity policy for the provider broker."""

from urllib.parse import urlsplit

from src.config import get_settings
from src.core.exceptions import ValidationError
from src.domain.deployments.repository import DomainRepository
from src.domain.hosting.hostnames import canonical_live_url, canonical_preview_url
from src.domain.project_auth.repository import ProjectAuthConfigRepository
from src.domain.projects.repository import ProjectRepository


async def google_identity_project(db, project_id):
    project = await ProjectRepository(db).get_by_id(project_id)
    cfg = await ProjectAuthConfigRepository(db).get_by_project(project_id)
    if (
        not project
        or project.deleted_at
        or not cfg
        or not cfg.enabled
        or "google" not in cfg.providers
        or cfg.google_oauth_mode == "custom"
    ):
        raise ValidationError("Platform Google identity is not enabled")
    origins = set()
    candidates = [project.live_hostname, project.preview_hostname]
    if project.project_ref:
        for apex in {get_settings().hosting_public_apex, "p2hsapp.com"}:
            candidates.extend(
                [
                    canonical_live_url(project.project_ref, apex),
                    canonical_preview_url(project.project_ref, apex),
                ]
            )
        candidates.append(f"https://preview.p2hs-{project.project_ref}.pages.dev")
    candidates.extend(
        row.domain
        for row in await DomainRepository(db).list_for_project(project_id)
        if row.verified_at
    )
    for candidate in candidates:
        if candidate:
            url = urlsplit(candidate if "://" in candidate else "https://" + candidate)
            if url.scheme == "https":
                origins.add(f"https://{url.netloc}")
    return project, origins