package auth

import (
	"mal/internal/domain"
	"net/http"
	"strings"

	"github.com/gin-gonic/gin"
)

type publicRoute struct {
	method string
	path   string
	prefix bool
}

var publicRoutes = []publicRoute{
	// Pages.
	{method: http.MethodGet, path: "/login"},
	{method: http.MethodPost, path: "/login"},
	{method: http.MethodGet, path: "/logout"},

	// Static assets.
	{path: "/static", prefix: true},
	{path: "/dist", prefix: true},

	// Observability endpoints.
	{method: http.MethodGet, path: "/metrics"},

	// Auth API.
	{method: http.MethodPost, path: "/api/auth/login"},
}

func isPublicRequest(method string, path string) bool {
	for _, r := range publicRoutes {
		if r.method != "" && r.method != method {
			continue
		}
		if r.prefix {
			if strings.HasPrefix(path, r.path) {
				return true
			}
			continue
		}
		if path == r.path {
			return true
		}
	}
	return false
}

func authenticateAPIRequest(c *gin.Context, svc domain.AuthService) (*domain.User, string, bool, error) {
	authHeader := strings.TrimSpace(c.GetHeader("Authorization"))
	if strings.HasPrefix(strings.ToLower(authHeader), "bearer ") {
		token := strings.TrimSpace(authHeader[7:])
		user, err := svc.ValidateAPIToken(c.Request.Context(), token)
		return user, "", false, err
	}

	sessionID, err := c.Cookie("session_id")
	if err != nil {
		return nil, "", false, err
	}

	user, err := svc.ValidateSession(c.Request.Context(), sessionID)
	return user, sessionID, true, err
}

func authenticatePageRequest(c *gin.Context, svc domain.AuthService) (*domain.User, string, error) {
	sessionID, err := c.Cookie("session_id")
	if err != nil {
		return nil, "", err
	}

	user, err := svc.ValidateSession(c.Request.Context(), sessionID)
	return user, sessionID, err
}

func AuthMiddleware(svc domain.AuthService) gin.HandlerFunc {
	return func(c *gin.Context) {
		path := c.Request.URL.Path

		if isPublicRequest(c.Request.Method, path) {
			c.Next()
			return
		}

		var user *domain.User
		var err error
		var sessionID string
		var usesCookieSession bool

		// API routes can authenticate via Bearer token OR cookie session.
		if strings.HasPrefix(path, "/api/") {
			user, sessionID, usesCookieSession, err = authenticateAPIRequest(c, svc)
			if err != nil || user == nil {
				c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
				c.Abort()
				return
			}
		} else {
			// Non-API routes only use cookie sessions and redirect to /login.
			user, sessionID, err = authenticatePageRequest(c, svc)
			usesCookieSession = true
			if err != nil || user == nil {
				c.Redirect(http.StatusSeeOther, "/login")
				c.Abort()
				return
			}
		}

		if usesCookieSession {
			if refreshErr := svc.RefreshSession(c.Request.Context(), sessionID); refreshErr == nil {
				c.SetCookie("session_id", sessionID, int(domain.SessionLifetime.Seconds()), "/", "", false, true)
			}
		}

		c.Set("User", user)
		c.Next()
	}
}
