TenantAtlas/apps/platform/app/Services/Providers/MicrosoftProviderHealthCheck.php

<?php

namespace App\Services\Providers;

use App\Models\ProviderConnection;
use App\Services\Graph\GraphResponse;
use App\Services\Providers\Contracts\HealthResult;
use App\Services\Providers\Contracts\ProviderHealthCheck;
use App\Support\OpsUx\RunFailureSanitizer;
use App\Support\Providers\ProviderReasonCodes;
use Throwable;

final class MicrosoftProviderHealthCheck implements ProviderHealthCheck
{
    public function __construct(private readonly ProviderGateway $gateway) {}

    public function check(ProviderConnection $connection): HealthResult
    {
        try {
            $response = $this->gateway->getOrganization($connection);
        } catch (Throwable $throwable) {
            $message = RunFailureSanitizer::sanitizeMessage($throwable->getMessage());
            $reasonCode = RunFailureSanitizer::normalizeReasonCode($throwable->getMessage());

            return HealthResult::failed(
                reasonCode: $reasonCode,
                message: $message !== '' ? $message : 'Health check failed.',
                status: $this->statusForReason($reasonCode),
                healthStatus: $this->healthForReason($reasonCode),
            );
        }

        if ($response->successful()) {
            return HealthResult::ok(
                status: 'connected',
                healthStatus: 'ok',
                meta: [
                    'organization_id' => $response->data['id'] ?? null,
                    'organization_display_name' => $response->data['displayName'] ?? null,
                ],
            );
        }

        $reasonCode = $this->reasonCodeForResponse($response);
        $message = RunFailureSanitizer::sanitizeMessage($this->messageForResponse($response));

        return HealthResult::failed(
            reasonCode: $reasonCode,
            message: $message !== '' ? $message : 'Health check failed.',
            status: $this->statusForReason($reasonCode),
            healthStatus: $this->healthForReason($reasonCode),
            meta: [
                'http_status' => $response->status,
            ],
        );
    }

    private function reasonCodeForResponse(GraphResponse $response): string
    {
        $candidate = match ((int) ($response->status ?? 0)) {
            401 => ProviderReasonCodes::ProviderAuthFailed,
            403 => ProviderReasonCodes::ProviderPermissionDenied,
            429 => ProviderReasonCodes::RateLimited,
            500, 502, 503, 504 => ProviderReasonCodes::NetworkUnreachable,
            default => ProviderReasonCodes::UnknownError,
        };

        return RunFailureSanitizer::normalizeReasonCode($candidate);
    }

    private function messageForResponse(GraphResponse $response): string
    {
        $error = $response->errors[0] ?? null;

        if (is_string($error)) {
            return $error;
        }

        if (is_array($error)) {
            $message = $error['message'] ?? null;

            if (is_string($message) && $message !== '') {
                return $message;
            }

            return json_encode($error, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE) ?: 'Health check failed.';
        }

        return 'Health check failed.';
    }

    private function statusForReason(string $reasonCode): string
    {
        return match ($reasonCode) {
            ProviderReasonCodes::ProviderAuthFailed,
            ProviderReasonCodes::ProviderPermissionDenied,
            ProviderReasonCodes::ProviderConsentMissing => 'needs_consent',
            default => 'error',
        };
    }

    private function healthForReason(string $reasonCode): string
    {
        return match ($reasonCode) {
            ProviderReasonCodes::RateLimited => 'degraded',
            ProviderReasonCodes::NetworkUnreachable,
            ProviderReasonCodes::ProviderAuthFailed,
            ProviderReasonCodes::ProviderPermissionDenied => 'down',
            default => 'down',
        };
    }
}