auth_connections.go

package cmd

import (
	"context"
	"fmt"
	"strings"
	"time"

	"github.com/kernel/cli/pkg/util"
	"github.com/kernel/kernel-go-sdk"
	"github.com/kernel/kernel-go-sdk/option"
	"github.com/kernel/kernel-go-sdk/packages/pagination"
	"github.com/kernel/kernel-go-sdk/packages/ssestream"
	"github.com/pterm/pterm"
	"github.com/spf13/cobra"
)

// AuthConnectionService defines the subset of the Kernel SDK auth connection client that we use.
type AuthConnectionService interface {
	New(ctx context.Context, body kernel.AuthConnectionNewParams, opts ...option.RequestOption) (res *kernel.ManagedAuth, err error)
	Get(ctx context.Context, id string, opts ...option.RequestOption) (res *kernel.ManagedAuth, err error)
	Update(ctx context.Context, id string, body kernel.AuthConnectionUpdateParams, opts ...option.RequestOption) (res *kernel.ManagedAuth, err error)
	List(ctx context.Context, query kernel.AuthConnectionListParams, opts ...option.RequestOption) (res *pagination.OffsetPagination[kernel.ManagedAuth], err error)
	Delete(ctx context.Context, id string, opts ...option.RequestOption) (err error)
	Login(ctx context.Context, id string, body kernel.AuthConnectionLoginParams, opts ...option.RequestOption) (res *kernel.LoginResponse, err error)
	Submit(ctx context.Context, id string, body kernel.AuthConnectionSubmitParams, opts ...option.RequestOption) (res *kernel.SubmitFieldsResponse, err error)
	FollowStreaming(ctx context.Context, id string, opts ...option.RequestOption) (stream *ssestream.Stream[kernel.AuthConnectionFollowResponseUnion])
}

// AuthConnectionCmd handles auth connection operations independent of cobra.
type AuthConnectionCmd struct {
	svc AuthConnectionService
}

type AuthConnectionCreateInput struct {
	Domain              string
	ProfileName         string
	LoginURL            string
	AllowedDomains      []string
	CredentialName      string
	CredentialProvider  string
	CredentialPath      string
	CredentialAuto      bool
	ProxyID             string
	ProxyName           string
	SaveCredentials     bool
	NoSaveCredentials   bool
	HealthCheckInterval int
	NoHealthChecks      bool
	NoAutoReauth        bool
	RecordSession       bool
	Output              string
}

type AuthConnectionGetInput struct {
	ID     string
	Output string
}

type AuthConnectionUpdateInput struct {
	ID                     string
	LoginURL               string
	LoginURLSet            bool
	AllowedDomains         []string
	AllowedDomainsSet      bool
	CredentialName         string
	CredentialNameSet      bool
	CredentialProvider     string
	CredentialProviderSet  bool
	CredentialPath         string
	CredentialPathSet      bool
	CredentialAuto         BoolFlag
	ProxyID                string
	ProxyIDSet             bool
	ProxyName              string
	ProxyNameSet           bool
	SaveCredentials        BoolFlag
	HealthCheckInterval    int
	HealthCheckIntervalSet bool
	HealthChecks           BoolFlag
	AutoReauth             BoolFlag
	RecordSession          BoolFlag
	Output                 string
}

type AuthConnectionListInput struct {
	Domain      string
	ProfileName string
	Limit       int
	Offset      int
	Output      string
}

type AuthConnectionDeleteInput struct {
	ID          string
	SkipConfirm bool
}

type AuthConnectionLoginInput struct {
	ID        string
	ProxyID   string
	ProxyName string
	Output    string
}

type AuthConnectionSubmitInput struct {
	ID                string
	FieldValues       map[string]string
	MfaOptionID       string
	SignInOptionID    string
	SSOButtonSelector string
	SSOProvider       string
	Output            string
}

type AuthConnectionFollowInput struct {
	ID     string
	Output string
}

func (c AuthConnectionCmd) Create(ctx context.Context, in AuthConnectionCreateInput) error {
	if in.Output != "" && in.Output != "json" {
		return fmt.Errorf("unsupported --output value: use 'json'")
	}

	if in.Domain == "" {
		return fmt.Errorf("--domain is required")
	}
	if in.ProfileName == "" {
		return fmt.Errorf("--profile-name is required")
	}

	params := kernel.AuthConnectionNewParams{
		ManagedAuthCreateRequest: kernel.ManagedAuthCreateRequestParam{
			Domain:      in.Domain,
			ProfileName: in.ProfileName,
		},
	}
	if in.LoginURL != "" {
		params.ManagedAuthCreateRequest.LoginURL = kernel.Opt(in.LoginURL)
	}
	if len(in.AllowedDomains) > 0 {
		params.ManagedAuthCreateRequest.AllowedDomains = in.AllowedDomains
	}
	if in.HealthCheckInterval > 0 {
		params.ManagedAuthCreateRequest.HealthCheckInterval = kernel.Opt(int64(in.HealthCheckInterval))
	}

	// Handle credential reference
	if in.CredentialName != "" {
		params.ManagedAuthCreateRequest.Credential = kernel.ManagedAuthCreateRequestCredentialParam{
			Name: kernel.Opt(in.CredentialName),
		}
	} else if in.CredentialProvider != "" {
		params.ManagedAuthCreateRequest.Credential = kernel.ManagedAuthCreateRequestCredentialParam{
			Provider: kernel.Opt(in.CredentialProvider),
		}
		if in.CredentialPath != "" {
			params.ManagedAuthCreateRequest.Credential.Path = kernel.Opt(in.CredentialPath)
		} else {
			// Default to domain auto-lookup when no explicit --credential-path is
			// given. This matches the dashboard's UX, where picking a provider
			// without a specific item always means "look up by domain". Without
			// this default, the server receives { provider } with no path or
			// auto flag, which is a valid-but-inert credential reference that
			// causes the managed auth session to never fetch credentials.
			params.ManagedAuthCreateRequest.Credential.Auto = kernel.Opt(true)
		}
		if in.CredentialAuto {
			params.ManagedAuthCreateRequest.Credential.Auto = kernel.Opt(true)
		}
	}

	if in.ProxyID != "" || in.ProxyName != "" {
		params.ManagedAuthCreateRequest.Proxy = kernel.ManagedAuthCreateRequestProxyParam{}
		if in.ProxyID != "" {
			params.ManagedAuthCreateRequest.Proxy.ID = kernel.Opt(in.ProxyID)
		}
		if in.ProxyName != "" {
			params.ManagedAuthCreateRequest.Proxy.Name = kernel.Opt(in.ProxyName)
		}
	}

	if in.NoSaveCredentials {
		params.ManagedAuthCreateRequest.SaveCredentials = kernel.Opt(false)
	}

	if in.NoHealthChecks {
		params.ManagedAuthCreateRequest.HealthChecks = kernel.Opt(false)
	}

	if in.NoAutoReauth {
		params.ManagedAuthCreateRequest.AutoReauth = kernel.Opt(false)
	}

	if in.RecordSession {
		params.ManagedAuthCreateRequest.RecordSession = kernel.Opt(true)
	}

	if in.Output != "json" {
		pterm.Info.Printf("Creating managed auth for %s...\n", in.Domain)
	}

	auth, err := c.svc.New(ctx, params)
	if err != nil {
		return util.CleanedUpSdkError{Err: err}
	}

	if in.Output == "json" {
		return util.PrintPrettyJSON(auth)
	}

	pterm.Success.Printf("Created managed auth: %s\n", auth.ID)
	printManagedAuthSummary(auth)
	return nil
}

func printManagedAuthSummary(auth *kernel.ManagedAuth) {
	tableData := pterm.TableData{
		{"Property", "Value"},
		{"ID", auth.ID},
		{"Domain", auth.Domain},
		{"Profile Name", auth.ProfileName},
		{"Status", string(auth.Status)},
		{"Can Reauth", fmt.Sprintf("%t", auth.CanReauth)},
	}
	if auth.CanReauthReason != "" {
		tableData = append(tableData, []string{"Can Reauth Reason", auth.CanReauthReason})
	}
	if auth.Credential.Name != "" {
		tableData = append(tableData, []string{"Credential Name", auth.Credential.Name})
	}
	if auth.Credential.Provider != "" {
		tableData = append(tableData, []string{"Credential Provider", auth.Credential.Provider})
	}
	if auth.ProxyID != "" {
		tableData = append(tableData, []string{"Proxy ID", auth.ProxyID})
	}
	tableData = append(tableData, []string{"Health Checks", fmt.Sprintf("%t", auth.HealthChecks)})
	tableData = append(tableData, []string{"Auto Reauth", fmt.Sprintf("%t", auth.AutoReauth)})
	tableData = append(tableData, []string{"Record Session", fmt.Sprintf("%t", auth.RecordSession)})
	PrintTableNoPad(tableData, true)
}

func (c AuthConnectionCmd) Update(ctx context.Context, in AuthConnectionUpdateInput) error {
	if in.Output != "" && in.Output != "json" {
		return fmt.Errorf("unsupported --output value: use 'json'")
	}

	params := kernel.AuthConnectionUpdateParams{
		ManagedAuthUpdateRequest: kernel.ManagedAuthUpdateRequestParam{},
	}
	hasChanges := false

	if in.HealthCheckIntervalSet {
		params.ManagedAuthUpdateRequest.HealthCheckInterval = kernel.Opt(int64(in.HealthCheckInterval))
		hasChanges = true
	}
	if in.LoginURLSet {
		params.ManagedAuthUpdateRequest.LoginURL = kernel.Opt(in.LoginURL)
		hasChanges = true
	}
	if in.SaveCredentials.Set {
		params.ManagedAuthUpdateRequest.SaveCredentials = kernel.Opt(in.SaveCredentials.Value)
		hasChanges = true
	}
	if in.HealthChecks.Set {
		params.ManagedAuthUpdateRequest.HealthChecks = kernel.Opt(in.HealthChecks.Value)
		hasChanges = true
	}
	if in.AutoReauth.Set {
		params.ManagedAuthUpdateRequest.AutoReauth = kernel.Opt(in.AutoReauth.Value)
		hasChanges = true
	}
	if in.RecordSession.Set {
		params.ManagedAuthUpdateRequest.RecordSession = kernel.Opt(in.RecordSession.Value)
		hasChanges = true
	}
	if in.AllowedDomainsSet {
		params.ManagedAuthUpdateRequest.AllowedDomains = in.AllowedDomains
		hasChanges = true
	}

	credentialChanged := in.CredentialNameSet || in.CredentialProviderSet || in.CredentialPathSet || in.CredentialAuto.Set
	if credentialChanged {
		if strings.TrimSpace(in.CredentialName) != "" && strings.TrimSpace(in.CredentialProvider) != "" {
			return fmt.Errorf("credential reference must use either --credential-name or --credential-provider")
		}
		params.ManagedAuthUpdateRequest.Credential = kernel.ManagedAuthUpdateRequestCredentialParam{}
		if in.CredentialNameSet {
			params.ManagedAuthUpdateRequest.Credential.Name = kernel.Opt(in.CredentialName)
		}
		if in.CredentialProviderSet {
			params.ManagedAuthUpdateRequest.Credential.Provider = kernel.Opt(in.CredentialProvider)
		}
		if in.CredentialPathSet {
			params.ManagedAuthUpdateRequest.Credential.Path = kernel.Opt(in.CredentialPath)
		}
		if in.CredentialAuto.Set {
			params.ManagedAuthUpdateRequest.Credential.Auto = kernel.Opt(in.CredentialAuto.Value)
		}
		hasChanges = true
	}

	proxyChanged := in.ProxyIDSet || in.ProxyNameSet
	if proxyChanged {
		params.ManagedAuthUpdateRequest.Proxy = kernel.ManagedAuthUpdateRequestProxyParam{}
		if in.ProxyIDSet {
			params.ManagedAuthUpdateRequest.Proxy.ID = kernel.Opt(in.ProxyID)
		}
		if in.ProxyNameSet {
			params.ManagedAuthUpdateRequest.Proxy.Name = kernel.Opt(in.ProxyName)
		}
		hasChanges = true
	}

	if !hasChanges {
		return fmt.Errorf("must provide at least one field to update")
	}

	if in.Output != "json" {
		pterm.Info.Printf("Updating managed auth %s...\n", in.ID)
	}

	auth, err := c.svc.Update(ctx, in.ID, params)
	if err != nil {
		return util.CleanedUpSdkError{Err: err}
	}

	if in.Output == "json" {
		return util.PrintPrettyJSON(auth)
	}

	pterm.Success.Printf("Updated managed auth: %s\n", auth.ID)
	printManagedAuthSummary(auth)
	return nil
}

func (c AuthConnectionCmd) Get(ctx context.Context, in AuthConnectionGetInput) error {
	if in.Output != "" && in.Output != "json" {
		return fmt.Errorf("unsupported --output value: use 'json'")
	}

	auth, err := c.svc.Get(ctx, in.ID)
	if err != nil {
		return util.CleanedUpSdkError{Err: err}
	}

	if in.Output == "json" {
		return util.PrintPrettyJSON(auth)
	}

	tableData := pterm.TableData{
		{"Property", "Value"},
		{"ID", auth.ID},
		{"Domain", auth.Domain},
		{"Profile Name", auth.ProfileName},
		{"Status", string(auth.Status)},
		{"Can Reauth", fmt.Sprintf("%t", auth.CanReauth)},
	}
	if auth.CanReauthReason != "" {
		tableData = append(tableData, []string{"Can Reauth Reason", auth.CanReauthReason})
	}
	if auth.Credential.Name != "" {
		tableData = append(tableData, []string{"Credential Name", auth.Credential.Name})
	}
	if auth.Credential.Provider != "" {
		tableData = append(tableData, []string{"Credential Provider", auth.Credential.Provider})
	}
	if auth.FlowStatus != "" {
		tableData = append(tableData, []string{"Flow Status", string(auth.FlowStatus)})
	}
	if auth.FlowStep != "" {
		tableData = append(tableData, []string{"Flow Step", string(auth.FlowStep)})
	}
	if len(auth.DiscoveredFields) > 0 {
		discoveredFields := make([]string, 0, len(auth.DiscoveredFields))
		for _, field := range auth.DiscoveredFields {
			fieldName := field.Name
			if fieldName == "" {
				fieldName = field.Label
			} else if field.Label != "" && field.Label != field.Name {
				fieldName = fmt.Sprintf("%s (%s)", field.Name, field.Label)
			}

			fieldMeta := make([]string, 0, 2)
			if field.Type != "" {
				fieldMeta = append(fieldMeta, field.Type)
			}
			if field.Required {
				fieldMeta = append(fieldMeta, "required")
			}
			if len(fieldMeta) > 0 {
				fieldName = fmt.Sprintf("%s [%s]", fieldName, strings.Join(fieldMeta, ", "))
			}
			discoveredFields = append(discoveredFields, fieldName)
		}
		tableData = append(tableData, []string{"Discovered Fields", strings.Join(discoveredFields, "; ")})
	}
	if len(auth.MfaOptions) > 0 {
		mfaOptions := make([]string, 0, len(auth.MfaOptions))
		for _, option := range auth.MfaOptions {
			optionName := option.Label
			if optionName == "" {
				optionName = option.Type
			} else if option.Type != "" {
				optionName = fmt.Sprintf("%s (%s)", option.Label, option.Type)
			}
			mfaOptions = append(mfaOptions, optionName)
		}
		tableData = append(tableData, []string{"MFA Options", strings.Join(mfaOptions, "; ")})
	}
	if len(auth.PendingSSOButtons) > 0 {
		pendingSSOButtons := make([]string, 0, len(auth.PendingSSOButtons))
		for _, button := range auth.PendingSSOButtons {
			buttonLabel := button.Label
			if buttonLabel == "" {
				buttonLabel = button.Provider
			} else if button.Provider != "" {
				buttonLabel = fmt.Sprintf("%s (%s)", button.Label, button.Provider)
			}
			pendingSSOButtons = append(pendingSSOButtons, buttonLabel)
		}
		tableData = append(tableData, []string{"Pending SSO Buttons", strings.Join(pendingSSOButtons, "; ")})
	}
	if auth.ExternalActionMessage != "" {
		tableData = append(tableData, []string{"External Action", auth.ExternalActionMessage})
	}
	if auth.HostedURL != "" {
		tableData = append(tableData, []string{"Hosted URL", auth.HostedURL})
	}
	if auth.LiveViewURL != "" {
		tableData = append(tableData, []string{"Live View URL", auth.LiveViewURL})
	}
	if auth.WebsiteError != "" {
		tableData = append(tableData, []string{"Website Error", auth.WebsiteError})
	}
	if !auth.FlowExpiresAt.IsZero() {
		tableData = append(tableData, []string{"Flow Expires At", util.FormatLocal(auth.FlowExpiresAt)})
	}
	if auth.ErrorCode != "" {
		tableData = append(tableData, []string{"Error Code", auth.ErrorCode})
	}
	if auth.ErrorMessage != "" {
		tableData = append(tableData, []string{"Error Message", auth.ErrorMessage})
	}
	if !auth.LastAuthAt.IsZero() {
		tableData = append(tableData, []string{"Last Auth At", util.FormatLocal(auth.LastAuthAt)})
	}
	if len(auth.AllowedDomains) > 0 {
		tableData = append(tableData, []string{"Allowed Domains", strings.Join(auth.AllowedDomains, ", ")})
	}
	if auth.HealthCheckInterval > 0 {
		tableData = append(tableData, []string{"Health Check Interval", fmt.Sprintf("%d seconds", auth.HealthCheckInterval)})
	}

	PrintTableNoPad(tableData, true)
	return nil
}

func (c AuthConnectionCmd) List(ctx context.Context, in AuthConnectionListInput) error {
	if in.Output != "" && in.Output != "json" {
		return fmt.Errorf("unsupported --output value: use 'json'")
	}

	params := kernel.AuthConnectionListParams{}
	if in.Domain != "" {
		params.Domain = kernel.Opt(in.Domain)
	}
	if in.ProfileName != "" {
		params.ProfileName = kernel.Opt(in.ProfileName)
	}
	if in.Limit > 0 {
		params.Limit = kernel.Opt(int64(in.Limit))
	}
	if in.Offset > 0 {
		params.Offset = kernel.Opt(int64(in.Offset))
	}

	page, err := c.svc.List(ctx, params)
	if err != nil {
		return util.CleanedUpSdkError{Err: err}
	}

	var auths []kernel.ManagedAuth
	if page != nil {
		auths = page.Items
	}

	if in.Output == "json" {
		if page == nil {
			fmt.Println("[]")
			return nil
		}
		if page.RawJSON() != "" {
			return util.PrintPrettyJSON(page)
		}
		if len(auths) == 0 {
			fmt.Println("[]")
			return nil
		}
		return util.PrintPrettyJSONSlice(auths)
	}

	if len(auths) == 0 {
		pterm.Info.Println("No managed auths found")
		return nil
	}

	tableData := pterm.TableData{{"ID", "Domain", "Profile Name", "Status", "Can Reauth"}}
	for _, auth := range auths {
		tableData = append(tableData, []string{
			auth.ID,
			auth.Domain,
			auth.ProfileName,
			string(auth.Status),
			fmt.Sprintf("%t", auth.CanReauth),
		})
	}

	PrintTableNoPad(tableData, true)
	return nil
}

func (c AuthConnectionCmd) Delete(ctx context.Context, in AuthConnectionDeleteInput) error {
	if !in.SkipConfirm {
		msg := fmt.Sprintf("Are you sure you want to delete managed auth '%s'?", in.ID)
		pterm.DefaultInteractiveConfirm.DefaultText = msg
		ok, _ := pterm.DefaultInteractiveConfirm.Show()
		if !ok {
			pterm.Info.Println("Deletion cancelled")
			return nil
		}
	}

	if err := c.svc.Delete(ctx, in.ID); err != nil {
		if util.IsNotFound(err) {
			pterm.Info.Printf("Managed auth '%s' not found\n", in.ID)
			return nil
		}
		return util.CleanedUpSdkError{Err: err}
	}
	pterm.Success.Printf("Deleted managed auth: %s\n", in.ID)
	return nil
}

func (c AuthConnectionCmd) Login(ctx context.Context, in AuthConnectionLoginInput) error {
	if in.Output != "" && in.Output != "json" {
		return fmt.Errorf("unsupported --output value: use 'json'")
	}

	params := kernel.AuthConnectionLoginParams{}
	if in.ProxyID != "" || in.ProxyName != "" {
		params.Proxy = kernel.AuthConnectionLoginParamsProxy{}
		if in.ProxyID != "" {
			params.Proxy.ID = kernel.Opt(in.ProxyID)
		}
		if in.ProxyName != "" {
			params.Proxy.Name = kernel.Opt(in.ProxyName)
		}
	}

	if in.Output != "json" {
		pterm.Info.Println("Starting login flow...")
	}

	resp, err := c.svc.Login(ctx, in.ID, params)
	if err != nil {
		return util.CleanedUpSdkError{Err: err}
	}

	if in.Output == "json" {
		return util.PrintPrettyJSON(resp)
	}

	pterm.Success.Printf("Login flow started: %s\n", resp.FlowType)

	tableData := pterm.TableData{
		{"Property", "Value"},
		{"ID", resp.ID},
		{"Flow Type", string(resp.FlowType)},
		{"Hosted URL", resp.HostedURL},
		{"Flow Expires At", util.FormatLocal(resp.FlowExpiresAt)},
	}
	if resp.LiveViewURL != "" {
		tableData = append(tableData, []string{"Live View URL", resp.LiveViewURL})
	}

	PrintTableNoPad(tableData, true)
	return nil
}

func (c AuthConnectionCmd) Submit(ctx context.Context, in AuthConnectionSubmitInput) error {
	if in.Output != "" && in.Output != "json" {
		return fmt.Errorf("unsupported --output value: use 'json'")
	}

	// Validate that we have some input to submit
	hasFields := len(in.FieldValues) > 0
	hasMfaOption := in.MfaOptionID != ""
	hasSignInOption := in.SignInOptionID != ""
	hasSSOButton := in.SSOButtonSelector != ""
	hasSSOProvider := in.SSOProvider != ""
	submitModes := 0
	for _, active := range []bool{hasFields, hasMfaOption, hasSignInOption, hasSSOButton, hasSSOProvider} {
		if active {
			submitModes++
		}
	}

	if submitModes == 0 {
		return fmt.Errorf("must provide exactly one of: --field, --mfa-option-id, --sign-in-option-id, --sso-button-selector, or --sso-provider")
	}
	if submitModes > 1 {
		return fmt.Errorf("provide exactly one of: --field, --mfa-option-id, --sign-in-option-id, --sso-button-selector, or --sso-provider")
	}

	// Resolve MFA option: the user may pass the label (e.g. "Get a text"), the
	// type (e.g. "sms"), or the display string ("Get a text (sms)"). The API
	// expects the type, so look up the connection's available options and map
	// whatever the user provided to the correct type value.
	if hasMfaOption {
		conn, err := c.svc.Get(ctx, in.ID)
		if err != nil {
			return util.CleanedUpSdkError{Err: fmt.Errorf("failed to fetch connection for MFA option resolution: %w", err)}
		}
		if len(conn.MfaOptions) > 0 {
			resolved := false
			for _, opt := range conn.MfaOptions {
				displayName := fmt.Sprintf("%s (%s)", opt.Label, opt.Type)
				if strings.EqualFold(in.MfaOptionID, opt.Type) ||
					strings.EqualFold(in.MfaOptionID, opt.Label) ||
					strings.EqualFold(in.MfaOptionID, displayName) {
					in.MfaOptionID = opt.Type
					resolved = true
					break
				}
			}
			if !resolved {
				available := make([]string, 0, len(conn.MfaOptions))
				for _, opt := range conn.MfaOptions {
					available = append(available, fmt.Sprintf("%s (%s)", opt.Label, opt.Type))
				}
				return fmt.Errorf("unknown MFA option %q; available: %s", in.MfaOptionID, strings.Join(available, ", "))
			}
		}
	}

	params := kernel.AuthConnectionSubmitParams{
		SubmitFieldsRequest: kernel.SubmitFieldsRequestParam{
			Fields: in.FieldValues,
		},
	}
	if hasMfaOption {
		params.SubmitFieldsRequest.MfaOptionID = kernel.Opt(in.MfaOptionID)
	}
	if hasSignInOption {
		params.SubmitFieldsRequest.SignInOptionID = kernel.Opt(in.SignInOptionID)
	}
	if hasSSOButton {
		params.SubmitFieldsRequest.SSOButtonSelector = kernel.Opt(in.SSOButtonSelector)
	}
	if hasSSOProvider {
		params.SubmitFieldsRequest.SSOProvider = kernel.Opt(in.SSOProvider)
	}

	if in.Output != "json" {
		pterm.Info.Println("Submitting to managed auth...")
	}

	resp, err := c.svc.Submit(ctx, in.ID, params)
	if err != nil {
		return util.CleanedUpSdkError{Err: err}
	}

	if in.Output == "json" {
		return util.PrintPrettyJSON(resp)
	}

	if resp.Accepted {
		pterm.Success.Println("Submission accepted")
	} else {
		pterm.Warning.Println("Submission not accepted")
	}
	return nil
}

func (c AuthConnectionCmd) Follow(ctx context.Context, in AuthConnectionFollowInput) error {
	if in.Output != "" && in.Output != "json" {
		return fmt.Errorf("unsupported --output value: use 'json'")
	}

	stream := c.svc.FollowStreaming(ctx, in.ID)
	if stream == nil {
		return fmt.Errorf("failed to establish SSE stream")
	}
	defer stream.Close()

	if in.Output != "json" {
		pterm.Info.Println("Following managed auth events (Ctrl+C to stop)...")
	}

	for stream.Next() {
		event := stream.Current()

		if in.Output == "json" {
			if err := util.PrintPrettyJSON(event); err != nil {
				return err
			}
			continue
		}

		// Human-readable output
		switch event.Event {
		case "managed_auth_state":
			state := event.AsManagedAuthState()
			pterm.Info.Printf("[%s] Status: %s, Step: %s\n",
				state.Timestamp.Local().Format(time.RFC3339),
				state.FlowStatus,
				state.FlowStep)
			if len(state.DiscoveredFields) > 0 {
				var fieldNames []string
				for _, f := range state.DiscoveredFields {
					fieldNames = append(fieldNames, f.Name)
				}
				pterm.Info.Printf("  Discovered fields: %s\n", strings.Join(fieldNames, ", "))
			}
			if state.ErrorMessage != "" {
				pterm.Error.Printf("  Error: %s\n", state.ErrorMessage)
			}
			if state.WebsiteError != "" {
				pterm.Warning.Printf("  Website error: %s\n", state.WebsiteError)
			}
		case "error":
			errEvent := event.AsError()
			pterm.Error.Printf("Error: %s\n", errEvent.Error.Message)
		case "sse_heartbeat":
			// Silently ignore heartbeats for human-readable output
		}
	}

	if err := stream.Err(); err != nil {
		return util.CleanedUpSdkError{Err: err}
	}

	if in.Output != "json" {
		pterm.Success.Println("Stream ended")
	}
	return nil
}

// --- Cobra wiring ---

var authConnectionsCmd = &cobra.Command{
	Use:   "connections",
	Short: "Manage auth connections (managed auth)",
	Long:  "Commands for managing authentication connections that keep profiles logged into domains",
}

var authConnectionsCreateCmd = &cobra.Command{
	Use:   "create",
	Short: "Create a managed auth connection",
	Long:  "Create managed authentication for a profile and domain combination",
	Args:  cobra.NoArgs,
	RunE:  runAuthConnectionsCreate,
}

var authConnectionsUpdateCmd = &cobra.Command{
	Use:   "update <id>",
	Short: "Update a managed auth connection",
	Long:  "Update managed authentication settings like login URL, health checks, credential source, and proxy.",
	Args:  cobra.ExactArgs(1),
	RunE:  runAuthConnectionsUpdate,
}

var authConnectionsGetCmd = &cobra.Command{
	Use:   "get <id>",
	Short: "Get a managed auth by ID",
	Args:  cobra.ExactArgs(1),
	RunE:  runAuthConnectionsGet,
}

var authConnectionsListCmd = &cobra.Command{
	Use:   "list",
	Short: "List managed auths",
	Args:  cobra.NoArgs,
	RunE:  runAuthConnectionsList,
}

var authConnectionsDeleteCmd = &cobra.Command{
	Use:   "delete <id>",
	Short: "Delete a managed auth",
	Args:  cobra.ExactArgs(1),
	RunE:  runAuthConnectionsDelete,
}

var authConnectionsLoginCmd = &cobra.Command{
	Use:   "login <id>",
	Short: "Start a login flow",
	Long:  "Start a login flow for the managed auth, returns a hosted URL for authentication",
	Args:  cobra.ExactArgs(1),
	RunE:  runAuthConnectionsLogin,
}

var authConnectionsSubmitCmd = &cobra.Command{
	Use:   "submit <id>",
	Short: "Submit field values to a login flow",
	Long: `Submit field values for the login form. Poll the managed auth to track progress.

Examples:
  # Submit field values
  kernel auth connections submit <id> --field username=myuser --field password=mypass

  # Select an MFA option
  kernel auth connections submit <id> --mfa-option-id <id>

  # Click an SSO button
  kernel auth connections submit <id> --sso-button-selector "//button[@id='google-sso']"`,
	Args: cobra.ExactArgs(1),
	RunE: runAuthConnectionsSubmit,
}

var authConnectionsFollowCmd = &cobra.Command{
	Use:   "follow <id>",
	Short: "Follow login flow events",
	Long:  "Establish an SSE stream to receive real-time login flow state updates",
	Args:  cobra.ExactArgs(1),
	RunE:  runAuthConnectionsFollow,
}

func init() {
	// Create flags
	authConnectionsCreateCmd.Flags().StringP("output", "o", "", "Output format: json for raw API response")
	authConnectionsCreateCmd.Flags().String("domain", "", "Target domain for authentication (required)")
	authConnectionsCreateCmd.Flags().String("profile-name", "", "Name of the profile to manage (required)")
	authConnectionsCreateCmd.Flags().String("login-url", "", "Optional login page URL to skip discovery")
	authConnectionsCreateCmd.Flags().StringSlice("allowed-domain", []string{}, "Additional allowed domains (repeatable)")
	authConnectionsCreateCmd.Flags().String("credential-name", "", "Kernel credential name to use")
	authConnectionsCreateCmd.Flags().String("credential-provider", "", "External credential provider name")
	authConnectionsCreateCmd.Flags().String("credential-path", "", "Provider-specific path (e.g., VaultName/ItemName)")
	authConnectionsCreateCmd.Flags().Bool("credential-auto", false, "Lookup by domain from the specified provider (defaults to true when --credential-provider is set without --credential-path)")
	authConnectionsCreateCmd.Flags().String("proxy-id", "", "Proxy ID to use")
	authConnectionsCreateCmd.Flags().String("proxy-name", "", "Proxy name to use")
	authConnectionsCreateCmd.Flags().Bool("no-save-credentials", false, "Disable saving credentials after successful login")
	authConnectionsCreateCmd.Flags().Int("health-check-interval", 0, "Interval in seconds between health checks (300-86400)")
	authConnectionsCreateCmd.Flags().Bool("no-health-checks", false, "Disable periodic health checks (also prevents automatic re-auth)")
	authConnectionsCreateCmd.Flags().Bool("no-auto-reauth", false, "Disable automatic re-authentication when a health check detects an expired session")
	authConnectionsCreateCmd.Flags().Bool("record-session", false, "Record browser sessions for this connection by default")
	_ = authConnectionsCreateCmd.MarkFlagRequired("domain")
	_ = authConnectionsCreateCmd.MarkFlagRequired("profile-name")
	authConnectionsCreateCmd.MarkFlagsMutuallyExclusive("credential-name", "credential-provider")

	// Get flags
	authConnectionsGetCmd.Flags().StringP("output", "o", "", "Output format: json for raw API response")

	// Update flags
	authConnectionsUpdateCmd.Flags().StringP("output", "o", "", "Output format: json for raw API response")
	authConnectionsUpdateCmd.Flags().String("login-url", "", "Login page URL (set to empty string to clear)")
	authConnectionsUpdateCmd.Flags().StringSlice("allowed-domain", []string{}, "Additional allowed domains (replaces existing list)")
	authConnectionsUpdateCmd.Flags().String("credential-name", "", "Kernel credential name to use")
	authConnectionsUpdateCmd.Flags().String("credential-provider", "", "External credential provider name")
	authConnectionsUpdateCmd.Flags().String("credential-path", "", "Provider-specific path (e.g., VaultName/ItemName)")
	authConnectionsUpdateCmd.Flags().Bool("credential-auto", false, "Lookup by domain from the specified provider")
	authConnectionsUpdateCmd.Flags().String("proxy-id", "", "Proxy ID to use")
	authConnectionsUpdateCmd.Flags().String("proxy-name", "", "Proxy name to use")
	authConnectionsUpdateCmd.Flags().Bool("save-credentials", false, "Enable saving credentials after successful login")
	authConnectionsUpdateCmd.Flags().Bool("no-save-credentials", false, "Disable saving credentials after successful login")
	authConnectionsUpdateCmd.Flags().Int("health-check-interval", 0, "Interval in seconds between health checks")
	authConnectionsUpdateCmd.Flags().Bool("health-checks", false, "Enable periodic health checks")
	authConnectionsUpdateCmd.Flags().Bool("no-health-checks", false, "Disable periodic health checks (also prevents automatic re-auth)")
	authConnectionsUpdateCmd.Flags().Bool("auto-reauth", false, "Enable automatic re-authentication on health check failure")
	authConnectionsUpdateCmd.Flags().Bool("no-auto-reauth", false, "Disable automatic re-authentication")
	authConnectionsUpdateCmd.Flags().Bool("record-session", false, "Record browser sessions for this connection by default")
	authConnectionsUpdateCmd.Flags().Bool("no-record-session", false, "Do not record browser sessions by default")
	authConnectionsUpdateCmd.MarkFlagsMutuallyExclusive("credential-name", "credential-provider")
	authConnectionsUpdateCmd.MarkFlagsMutuallyExclusive("save-credentials", "no-save-credentials")
	authConnectionsUpdateCmd.MarkFlagsMutuallyExclusive("health-checks", "no-health-checks")
	authConnectionsUpdateCmd.MarkFlagsMutuallyExclusive("auto-reauth", "no-auto-reauth")
	authConnectionsUpdateCmd.MarkFlagsMutuallyExclusive("record-session", "no-record-session")

	// List flags
	authConnectionsListCmd.Flags().StringP("output", "o", "", "Output format: json for raw API response")
	authConnectionsListCmd.Flags().String("domain", "", "Filter by domain")
	authConnectionsListCmd.Flags().String("profile-name", "", "Filter by profile name")
	authConnectionsListCmd.Flags().Int("limit", 0, "Maximum number of results to return")
	authConnectionsListCmd.Flags().Int("offset", 0, "Number of results to skip")

	// Delete flags
	authConnectionsDeleteCmd.Flags().BoolP("yes", "y", false, "Skip confirmation prompt")

	// Login flags
	authConnectionsLoginCmd.Flags().StringP("output", "o", "", "Output format: json for raw API response")
	authConnectionsLoginCmd.Flags().String("proxy-id", "", "Proxy ID to use for this login")
	authConnectionsLoginCmd.Flags().String("proxy-name", "", "Proxy name to use for this login")

	// Submit flags
	authConnectionsSubmitCmd.Flags().StringP("output", "o", "", "Output format: json for raw API response")
	authConnectionsSubmitCmd.Flags().StringArray("field", []string{}, "Field name=value pair (repeatable)")
	authConnectionsSubmitCmd.Flags().String("mfa-option-id", "", "MFA option ID if user selected an MFA method")
	authConnectionsSubmitCmd.Flags().String("sign-in-option-id", "", "Sign-in option ID if the flow returned non-MFA choices")
	authConnectionsSubmitCmd.Flags().String("sso-button-selector", "", "XPath selector if user chose an SSO button")
	authConnectionsSubmitCmd.Flags().String("sso-provider", "", "SSO provider if user chose an SSO button by provider (e.g. google, github)")

	// Follow flags
	authConnectionsFollowCmd.Flags().StringP("output", "o", "", "Output format: json for raw API response")

	// Wire up commands
	authConnectionsCmd.AddCommand(authConnectionsCreateCmd)
	authConnectionsCmd.AddCommand(authConnectionsUpdateCmd)
	authConnectionsCmd.AddCommand(authConnectionsGetCmd)
	authConnectionsCmd.AddCommand(authConnectionsListCmd)
	authConnectionsCmd.AddCommand(authConnectionsDeleteCmd)
	authConnectionsCmd.AddCommand(authConnectionsLoginCmd)
	authConnectionsCmd.AddCommand(authConnectionsSubmitCmd)
	authConnectionsCmd.AddCommand(authConnectionsFollowCmd)

	authCmd.AddCommand(authConnectionsCmd)
}

func runAuthConnectionsCreate(cmd *cobra.Command, args []string) error {
	client := getKernelClient(cmd)
	output, _ := cmd.Flags().GetString("output")
	domain, _ := cmd.Flags().GetString("domain")
	profileName, _ := cmd.Flags().GetString("profile-name")
	loginURL, _ := cmd.Flags().GetString("login-url")
	allowedDomains, _ := cmd.Flags().GetStringSlice("allowed-domain")
	credentialName, _ := cmd.Flags().GetString("credential-name")
	credentialProvider, _ := cmd.Flags().GetString("credential-provider")
	credentialPath, _ := cmd.Flags().GetString("credential-path")
	credentialAuto, _ := cmd.Flags().GetBool("credential-auto")
	proxyID, _ := cmd.Flags().GetString("proxy-id")
	proxyName, _ := cmd.Flags().GetString("proxy-name")
	noSaveCredentials, _ := cmd.Flags().GetBool("no-save-credentials")
	healthCheckInterval, _ := cmd.Flags().GetInt("health-check-interval")
	noHealthChecks, _ := cmd.Flags().GetBool("no-health-checks")
	noAutoReauth, _ := cmd.Flags().GetBool("no-auto-reauth")
	recordSession, _ := cmd.Flags().GetBool("record-session")

	svc := client.Auth.Connections
	c := AuthConnectionCmd{svc: &svc}
	return c.Create(cmd.Context(), AuthConnectionCreateInput{
		Domain:              domain,
		ProfileName:         profileName,
		LoginURL:            loginURL,
		AllowedDomains:      allowedDomains,
		CredentialName:      credentialName,
		CredentialProvider:  credentialProvider,
		CredentialPath:      credentialPath,
		CredentialAuto:      credentialAuto,
		ProxyID:             proxyID,
		ProxyName:           proxyName,
		NoSaveCredentials:   noSaveCredentials,
		HealthCheckInterval: healthCheckInterval,
		NoHealthChecks:      noHealthChecks,
		NoAutoReauth:        noAutoReauth,
		RecordSession:       recordSession,
		Output:              output,
	})
}

func runAuthConnectionsGet(cmd *cobra.Command, args []string) error {
	client := getKernelClient(cmd)
	output, _ := cmd.Flags().GetString("output")

	svc := client.Auth.Connections
	c := AuthConnectionCmd{svc: &svc}
	return c.Get(cmd.Context(), AuthConnectionGetInput{
		ID:     args[0],
		Output: output,
	})
}

func runAuthConnectionsUpdate(cmd *cobra.Command, args []string) error {
	client := getKernelClient(cmd)
	output, _ := cmd.Flags().GetString("output")
	loginURL, _ := cmd.Flags().GetString("login-url")
	allowedDomains, _ := cmd.Flags().GetStringSlice("allowed-domain")
	credentialName, _ := cmd.Flags().GetString("credential-name")
	credentialProvider, _ := cmd.Flags().GetString("credential-provider")
	credentialPath, _ := cmd.Flags().GetString("credential-path")
	credentialAuto, _ := cmd.Flags().GetBool("credential-auto")
	proxyID, _ := cmd.Flags().GetString("proxy-id")
	proxyName, _ := cmd.Flags().GetString("proxy-name")
	saveCredentials, _ := cmd.Flags().GetBool("save-credentials")
	noSaveCredentials, _ := cmd.Flags().GetBool("no-save-credentials")
	healthCheckInterval, _ := cmd.Flags().GetInt("health-check-interval")

	saveCredentialsFlag := BoolFlag{}
	if cmd.Flags().Changed("save-credentials") {
		saveCredentialsFlag = BoolFlag{Set: true, Value: saveCredentials}
	}
	if cmd.Flags().Changed("no-save-credentials") {
		saveCredentialsFlag = BoolFlag{Set: true, Value: !noSaveCredentials}
	}

	healthChecksFlag := BoolFlag{}
	if cmd.Flags().Changed("health-checks") {
		v, _ := cmd.Flags().GetBool("health-checks")
		healthChecksFlag = BoolFlag{Set: true, Value: v}
	}
	if cmd.Flags().Changed("no-health-checks") {
		v, _ := cmd.Flags().GetBool("no-health-checks")
		healthChecksFlag = BoolFlag{Set: true, Value: !v}
	}

	autoReauthFlag := BoolFlag{}
	if cmd.Flags().Changed("auto-reauth") {
		v, _ := cmd.Flags().GetBool("auto-reauth")
		autoReauthFlag = BoolFlag{Set: true, Value: v}
	}
	if cmd.Flags().Changed("no-auto-reauth") {
		v, _ := cmd.Flags().GetBool("no-auto-reauth")
		autoReauthFlag = BoolFlag{Set: true, Value: !v}
	}

	recordSessionFlag := BoolFlag{}
	if cmd.Flags().Changed("record-session") {
		v, _ := cmd.Flags().GetBool("record-session")
		recordSessionFlag = BoolFlag{Set: true, Value: v}
	}
	if cmd.Flags().Changed("no-record-session") {
		v, _ := cmd.Flags().GetBool("no-record-session")
		recordSessionFlag = BoolFlag{Set: true, Value: !v}
	}

	svc := client.Auth.Connections
	c := AuthConnectionCmd{svc: &svc}
	return c.Update(cmd.Context(), AuthConnectionUpdateInput{
		ID:                     args[0],
		LoginURL:               loginURL,
		LoginURLSet:            cmd.Flags().Changed("login-url"),
		AllowedDomains:         allowedDomains,
		AllowedDomainsSet:      cmd.Flags().Changed("allowed-domain"),
		CredentialName:         credentialName,
		CredentialNameSet:      cmd.Flags().Changed("credential-name"),
		CredentialProvider:     credentialProvider,
		CredentialProviderSet:  cmd.Flags().Changed("credential-provider"),
		CredentialPath:         credentialPath,
		CredentialPathSet:      cmd.Flags().Changed("credential-path"),
		CredentialAuto:         BoolFlag{Set: cmd.Flags().Changed("credential-auto"), Value: credentialAuto},
		ProxyID:                proxyID,
		ProxyIDSet:             cmd.Flags().Changed("proxy-id"),
		ProxyName:              proxyName,
		ProxyNameSet:           cmd.Flags().Changed("proxy-name"),
		SaveCredentials:        saveCredentialsFlag,
		HealthCheckInterval:    healthCheckInterval,
		HealthCheckIntervalSet: cmd.Flags().Changed("health-check-interval"),
		HealthChecks:           healthChecksFlag,
		AutoReauth:             autoReauthFlag,
		RecordSession:          recordSessionFlag,
		Output:                 output,
	})
}

func runAuthConnectionsList(cmd *cobra.Command, args []string) error {
	client := getKernelClient(cmd)
	output, _ := cmd.Flags().GetString("output")
	domain, _ := cmd.Flags().GetString("domain")
	profileName, _ := cmd.Flags().GetString("profile-name")
	limit, _ := cmd.Flags().GetInt("limit")
	offset, _ := cmd.Flags().GetInt("offset")

	svc := client.Auth.Connections
	c := AuthConnectionCmd{svc: &svc}
	return c.List(cmd.Context(), AuthConnectionListInput{
		Domain:      domain,
		ProfileName: profileName,
		Limit:       limit,
		Offset:      offset,
		Output:      output,
	})
}

func runAuthConnectionsDelete(cmd *cobra.Command, args []string) error {
	client := getKernelClient(cmd)
	skip, _ := cmd.Flags().GetBool("yes")

	svc := client.Auth.Connections
	c := AuthConnectionCmd{svc: &svc}
	return c.Delete(cmd.Context(), AuthConnectionDeleteInput{
		ID:          args[0],
		SkipConfirm: skip,
	})
}

func runAuthConnectionsLogin(cmd *cobra.Command, args []string) error {
	client := getKernelClient(cmd)
	output, _ := cmd.Flags().GetString("output")
	proxyID, _ := cmd.Flags().GetString("proxy-id")
	proxyName, _ := cmd.Flags().GetString("proxy-name")

	svc := client.Auth.Connections
	c := AuthConnectionCmd{svc: &svc}
	return c.Login(cmd.Context(), AuthConnectionLoginInput{
		ID:        args[0],
		ProxyID:   proxyID,
		ProxyName: proxyName,
		Output:    output,
	})
}

func runAuthConnectionsSubmit(cmd *cobra.Command, args []string) error {
	client := getKernelClient(cmd)
	output, _ := cmd.Flags().GetString("output")
	fieldPairs, _ := cmd.Flags().GetStringArray("field")
	mfaOptionID, _ := cmd.Flags().GetString("mfa-option-id")
	signInOptionID, _ := cmd.Flags().GetString("sign-in-option-id")
	ssoButtonSelector, _ := cmd.Flags().GetString("sso-button-selector")
	ssoProvider, _ := cmd.Flags().GetString("sso-provider")

	// Parse field pairs into map
	fieldValues := make(map[string]string)
	for _, pair := range fieldPairs {
		parts := strings.SplitN(pair, "=", 2)
		if len(parts) != 2 {
			return fmt.Errorf("invalid field format: %s (expected key=value)", pair)
		}
		fieldValues[parts[0]] = parts[1]
	}

	svc := client.Auth.Connections
	c := AuthConnectionCmd{svc: &svc}
	return c.Submit(cmd.Context(), AuthConnectionSubmitInput{
		ID:                args[0],
		FieldValues:       fieldValues,
		MfaOptionID:       mfaOptionID,
		SignInOptionID:    signInOptionID,
		SSOButtonSelector: ssoButtonSelector,
		SSOProvider:       ssoProvider,
		Output:            output,
	})
}

func runAuthConnectionsFollow(cmd *cobra.Command, args []string) error {
	client := getKernelClient(cmd)
	output, _ := cmd.Flags().GetString("output")

	svc := client.Auth.Connections
	c := AuthConnectionCmd{svc: &svc}
	return c.Follow(cmd.Context(), AuthConnectionFollowInput{
		ID:     args[0],
		Output: output,
	})
}