import {z} from 'zod'

export type FirewallRule = {action?: ('UNSPECIFIED_ACTION' | 'ALLOW' | 'DENY') | undefined, description?: string | undefined, priority?: number | undefined, sourceRange?: string | undefined};

export type BatchUpdateIngressRulesRequest = {ingressRules?: Array<FirewallRule> | undefined};

export type CreateApiV1AppsAppsIdFirewallIngressRulesBatchUpdateArgs = {appsId: string, body: BatchUpdateIngressRulesRequest};

export type CreateApiV1AppsAppsIdFirewallIngressRulesBatchUpdateOptions = {baseUrl?: string | undefined, Oauth2?: string | undefined, Oauth2c?: string | undefined, fetch?: typeof fetch | undefined};

export const firewallRule = z.object({action: z.enum(["UNSPECIFIED_ACTION", "ALLOW", "DENY"]).optional(), description: z.string().optional(), priority: z.number().int().optional(), sourceRange: z.string().optional()});

export const batchUpdateIngressRulesResponse = z.object({ingressRules: z.array(firewallRule).optional()});

export const validateResponse = async <Output>(
  schema: {
    readonly '~standard': {
      readonly validate: (value: unknown) => ({ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }) | Promise<{ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }>
    }
  },
  value: unknown
): Promise<Output> => {
  const result = await schema['~standard'].validate(value)

  if (result.issues !== undefined) {
    const detail = result.issues
      .map(({ message, path }) =>
        path?.length
          ? `${path.map((segment) => String(typeof segment === 'object' ? segment.key : segment)).join('.')}: ${message}`
          : message
      )
      .join('; ')

    throw new Error(`Response does not match the schema: ${detail}`, { cause: { issues: result.issues } })
  }

  return result.value
};

/**
 * Replaces the entire firewall ruleset in one bulk operation. This overrides and replaces the rules of an existing firewall with the new rules.If the final rule does not match traffic with the '*' wildcard IP range, then an "allow all" rule is explicitly added to the end of the list.
 * 
 * POST /v1/apps/{appsId}/firewall/ingressRules:batchUpdate
 */
export const createApiV1AppsAppsIdFirewallIngressRulesBatchUpdate = async (args: CreateApiV1AppsAppsIdFirewallIngressRulesBatchUpdateArgs, options?: CreateApiV1AppsAppsIdFirewallIngressRulesBatchUpdateOptions) => {
const {baseUrl = "https://appengine.googleapis.com", fetch: fetchFn = fetch, Oauth2, Oauth2c} = options ?? {}

const query = new URLSearchParams()
const headers = new Headers()
headers.set('content-type', "application/json")
headers.set('accept', "application/json")

if (Oauth2 !== undefined) headers.set('authorization', `Bearer ${Oauth2}`)
if (Oauth2c !== undefined) headers.set('authorization', `Bearer ${Oauth2c}`)

const url = `${baseUrl.replace(/\/+$/, '')}/v1/apps/${encodeURIComponent(String(args.appsId))}/firewall/ingressRules:batchUpdate${query.size > 0 ? `?${query}` : ''}`

const res = await fetchFn(url, {method: "POST", headers, body: JSON.stringify(args.body)})

if (!res.ok) throw new Error(`Request failed with status ${res.status}`, {cause: {status: res.status, body: await res.text()}})

return validateResponse(batchUpdateIngressRulesResponse, await res.json())
};