package middleware

import (
	"RenewCMS/api/pkg/apperr"
	"RenewCMS/api/pkg/claims"
	"RenewCMS/internal/domain/user"
	"RenewCMS/internal/infrastructure/useCases"
	"errors"
	"net/http"
)

func JsonContentTypeMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		next.ServeHTTP(w, r)
	})
}

func resolveCurrentUser(getUser *useCases.GetUserUseCase, w http.ResponseWriter, r *http.Request) (user.User, bool) {
	userId, ok := claims.UserId(r)
	if !ok {
		http.Error(w, apperr.UnauthorizedErrorMessage, http.StatusUnauthorized)
		return user.User{}, false
	}

	currentUser, err := getUser.GetUser(userId)
	if err != nil {
		if errors.Is(err, user.ErrUserNotFound) {
			http.Error(w, apperr.UnauthorizedErrorMessage, http.StatusUnauthorized)
			return user.User{}, false
		}
		http.Error(w, "Internal server error", http.StatusInternalServerError)
		return user.User{}, false
	}

	return currentUser, true
}

func RequireCurrentToken(getUser *useCases.GetUserUseCase) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			currentUser, ok := resolveCurrentUser(getUser, w, r)
			if !ok {
				return
			}

			tokenVersion, ok := claims.TokenVersion(r)
			if !ok {
				http.Error(w, apperr.UnauthorizedErrorMessage, http.StatusUnauthorized)
				return
			}

			if tokenVersion != currentUser.TokenVersion {
				http.Error(w, apperr.UnauthorizedErrorMessage, http.StatusUnauthorized)
				return
			}

			next.ServeHTTP(w, r)
		})
	}
}

func RequireVerifiedUser(getUser *useCases.GetUserUseCase) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			currentUser, ok := resolveCurrentUser(getUser, w, r)
			if !ok {
				return
			}

			if !currentUser.IsVerified {
				http.Error(w, apperr.VerificationRequiredErrorMessage, http.StatusForbidden)
				return
			}

			next.ServeHTTP(w, r)
		})
	}
}

func RequireOwner(getUser *useCases.GetUserUseCase) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			currentUser, ok := resolveCurrentUser(getUser, w, r)
			if !ok {
				return
			}

			if currentUser.Role != user.RoleOwner {
				http.Error(w, apperr.OwnerRequiredErrorMessage, http.StatusForbidden)
				return
			}

			next.ServeHTTP(w, r)
		})
	}
}

func RequireOwnerOrAdmin(getUser *useCases.GetUserUseCase) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			currentUser, ok := resolveCurrentUser(getUser, w, r)
			if !ok {
				return
			}

			if currentUser.Role != user.RoleOwner && currentUser.Role != user.RoleAdmin {
				http.Error(w, apperr.OwnerOrAdminRequiredErrorMessage, http.StatusForbidden)
				return
			}

			next.ServeHTTP(w, r)
		})
	}
}