// Server only: the organization API key never reaches the browser.
import { OpenGeniClient } from "@opengeni/sdk";
import { createSessionProxyRoute } from "@opengeni/sdk/next";

const og = new OpenGeniClient({
  baseUrl: process.env.OPENGENI_API_BASE_URL!, // the deployment you target
  apiKey: process.env.OPENGENI_API_KEY!, // organization API key
});
const source = "acme-app"; // stable external-identity namespace

// 1. Onboarding, once per tenant and admitted user (persist workspace.id and operationId).
const { workspace } = await og.ensureWorkspace({
  accountId: process.env.OPENGENI_ORGANIZATION_ID!, externalSource: source,
  externalId: tenant.id, name: tenant.name,
});
await og.addExternalWorkspaceMember(workspace.id, {
  identity: { externalId: user.id, source },
  permissions: ["workspace:read", "sessions:create", "sessions:read", "sessions:control",
    "files:upload", "files:read", "mcp_servers:attach"], // attach: per-session mcpServers
  operationId,
});

// 2. The proxy, as a Next.js App Router catch-all: app/api/opengeni/[...path]/route.ts.
//    Express: toNodeMiddleware(createSessionProxyHandler(og, options)) from
//    "@opengeni/sdk/express"; Hono: toHonoHandler(...) from "@opengeni/sdk/hono".
const acme = (token: string) => ({ id: "acme", headers: { Authorization: `Bearer ${token}` } });
export const dynamic = "force-dynamic";
export const { GET, POST, PUT, PATCH, DELETE } = createSessionProxyRoute(og, {
  chats: "private", // the default: each user's chats are theirs; "shared" | "isolated"
  resolve: async (request) => {
    const me = await authenticate(request); // the product's own session check
    return me
      ? { workspaceId: me.openGeniWorkspaceId, user: me.id, source }
      : new Response("Unauthorized", { status: 401 });
  },
  authorizeMutation: verifyCsrf, // the product's existing CSRF policy
  // New chats: the browser sends only the first message; the server picks the rest.
  createSession: async ({ initialMessage, idempotencyKey }, { user }) => ({
    initialMessage,
    idempotencyKey,
    agent: {
      identity: "You are Acme's support assistant. Friendly and brief.",
      capabilities: "none", // Acme's tools, asking questions, reading Skills; nothing else
    },
    skills: productSkills, // product-owned, inline
    mcpServers: [{ ...acme(await mintUserToken(user)), url: ACME_MCP_URL, allowedTools }],
    tools: [{ kind: "mcp", id: "acme" }], // a per-session server must also be selected here
    sandboxBackend: "none", // pure chat/tool agent: no sandbox to start or shell around tools
  }),
  // Every forwarded message: fresh per-user token and server-owned page context.
  beforeForwardMessage: async (_message, { user }) => ({
    mcpCredentialUpdates: [acme(await mintUserToken(user))],
    modelContext: `Today ${new Date().toISOString().slice(0, 10)}, time zone ${tz}`,
  }),
});

// Browser: the unmodified SDK client, pointed at the mount.
import { OpenGeniClient } from "@opengeni/sdk";
import { OpenGeniChat, OpenGeniProvider } from "@opengeni/react/session-ui";
import "@opengeni/react/compiled.css";

const client = new OpenGeniClient({ baseUrl: "/api/opengeni" });
<OpenGeniProvider client={client} workspaceId={workspaceId}>
  <OpenGeniChat /> {/* the user's chats (sidebar/drawer) + conversation */}
</OpenGeniProvider>;