package web

import "net/http"

// HandleAuthRequest is an nginx auth_request endpoint. It validates the
// session cookie and, on success, returns the authenticated user's identity
// as response headers that nginx forwards to the upstream application.
//
// Expected usage in nginx:
//
//	location / {
//	    auth_request /auth;
//	    auth_request_set $webauth_user $upstream_http_x_webauth_user;
//	    auth_request_set $webauth_email $upstream_http_x_webauth_email;
//	    auth_request_set $webauth_display_name $upstream_http_x_webauth_display_name;
//	    proxy_set_header X-WEBAUTH-USER $webauth_user;
//	    proxy_set_header X-WEBAUTH-EMAIL $webauth_email;
//	    proxy_set_header X-WEBAUTH-DISPLAY-NAME $webauth_display_name;
//	    proxy_pass http://backend;
//	}
//
//	location = /auth {
//	    internal;
//	    proxy_pass http://backend/auth;
//	    proxy_pass_request_body off;
//	    proxy_set_header Content-Length "";
//	    proxy_set_header X-Original-URI $request_uri;
//	}
func (s *WebService) HandleAuthRequest(w http.ResponseWriter, r *http.Request) {
	cookie, err := r.Cookie(SessionCookieName)
	if err != nil {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}

	session, err := s.auths.GetSessionByToken(r.Context(), cookie.Value)
	if err != nil {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}

	if !session.IsValid() {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}

	user, err := s.users.GetUserById(r.Context(), session.UserId)
	if err != nil {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}

	w.Header().Set("X-WEBAUTH-USER", user.Login)
	w.Header().Set("X-WEBAUTH-EMAIL", user.Login)
	w.Header().Set("X-WEBAUTH-DISPLAY-NAME", user.EffectiveDisplayName())
	w.WriteHeader(http.StatusOK)
}