package authorized

import (
	"net/http"

	"git.sendico.io/tech/sxchnge/product/auth/config"
	re "git.sendico.io/tech/sxchnge/product/auth/http/endpoint"
	emodel "git.sendico.io/tech/sxchnge/product/auth/model"
	"git.sendico.io/tech/sxchnge/product/customers/store"
	"git.sendico.io/tech/sxchnge/product/sessions/metrics"
	"git.sendico.io/tech/sxchnge/product/sessions/store"
	api "git.sendico.io/tech/sxchnge/shared/http"
	"git.sendico.io/tech/sxchnge/shared/http/response"
	"git.sendico.io/tech/sxchnge/shared/logging"
	"git.sendico.io/tech/sxchnge/shared/logging/fields"
	"git.sendico.io/tech/sxchnge/shared/service"
	"github.com/go-chi/chi/v5"
	"github.com/go-chi/jwtauth/v5"
	"go.uber.org/zap"
)

type AuthorizedRouter struct {
	logger  mlogger.Logger
	db      account.DB
	rtdb    refreshtokens.DB
	imp     *re.HttpEndpointRouter
	service mservice.Type
}

func NewRouter(logger mlogger.Logger, apiEndpoint string, router chi.Router, db account.DB, rtdb refreshtokens.DB, config *middleware.TokenConfig, signature *middleware.Signature) *AuthorizedRouter {
	ja := jwtauth.New(signature.Algorithm, signature.PrivateKey, signature.PublicKey)
	router.Use(jwtauth.Verifier(ja))
	router.Use(jwtauth.Authenticator(ja))
	l := logger.Named("authorized")
	ar := AuthorizedRouter{
		logger:  l,
		db:      db,
		rtdb:    rtdb,
		imp:     re.NewHttpEndpointRouter(l, apiEndpoint, router, config, signature),
		service: mservice.Accounts,
	}
	ar.tokenHandlerWithSessionCheck(mservice.Accounts, "/logout/all", api.Post, false, ar.logoutAll)

	return &ar
}

func (ar *AuthorizedRouter) logoutAll(r *http.Request, token *emodel.AccountToken) http.HandlerFunc {
	if token.ClientID == "" || token.DeviceID == "" || token.SessionVersion == "" {
		sessionmetrics.Observe(sessionmetrics.AllLogout, sessionmetrics.MissingIdentity)
		return response.Unauthorized(ar.logger, ar.service, "session identifier is required")
	}
	if err := ar.rtdb.RevokeAll(r.Context(), token.AccountRef, ""); err != nil {
		sessionmetrics.Observe(sessionmetrics.AllLogout, sessionmetrics.StorageError)
		ar.logger.Warn("Failed to revoke all account sessions", zap.Error(err), mzap.AccRef(token.AccountRef))
		return response.Internal(ar.logger, ar.service, err)
	}
	sessionmetrics.Observe(sessionmetrics.AllLogout, sessionmetrics.Succeeded)
	ar.logger.Info("All account sessions revoked", mzap.AccRef(token.AccountRef))
	return response.Success(ar.logger)
}