package rest

import (
	"net/http"

	"goAuth/internal/auth"
	"goAuth/internal/user"
)

type signupRequest struct {
	Login    string `json:"login"`
	Password string `json:"password"`
	Invite   string `json:"invite"`
}

type signinRequest struct {
	Login    string `json:"login"`
	Password string `json:"password"`
	Remember bool   `json:"remember"`
}

func (h *Handler) signup(w http.ResponseWriter, r *http.Request) {
	var req signupRequest
	if err := decodeJson(r, &req); err != nil {
		writeError(w, http.StatusBadRequest, "invalid request body")
		return
	}

	if !verifyLogin(req.Login) {
		writeError(w, http.StatusBadRequest, "invalid login")
		return
	}
	if !verifyPassword(req.Password) {
		writeError(w, http.StatusBadRequest, "invalid password")
		return
	}
	if req.Invite == "" {
		writeError(w, http.StatusBadRequest, "invite is required")
		return
	}

	address := clientAddress(r)
	device := h.sessions.ClassifiedUserAgent(r.UserAgent())

	u, session, err := h.sessions.RegisterUser(r.Context(), req.Login, req.Password, req.Invite, address, device)
	if err != nil {
		h.fail(w, err)
		return
	}

	auth.SigninSetup(w, h.cfg.Cookies.SessionName, session.Token, session.ExpiresAt, h.cfg.Cookies.Secure)
	h.refreshCsrf(w)
	writeJson(w, http.StatusCreated, newUserResponse(u))
}

func (h *Handler) signin(w http.ResponseWriter, r *http.Request) {
	var req signinRequest
	if err := decodeJson(r, &req); err != nil {
		writeError(w, http.StatusBadRequest, "invalid request body")
		return
	}
	if req.Login == "" || req.Password == "" {
		writeError(w, http.StatusBadRequest, "login and password are required")
		return
	}

	address := clientAddress(r)
	device := h.sessions.ClassifiedUserAgent(r.UserAgent())

	u, session, err := h.sessions.LoginUser(r.Context(), req.Login, req.Password, address, device, req.Remember)
	if err != nil {
		if err == user.ErrNotFound || err == user.ErrInvalidPassword {
			writeError(w, http.StatusUnauthorized, "invalid credentials")
			return
		}
		h.fail(w, err)
		return
	}

	auth.SigninSetup(w, h.cfg.Cookies.SessionName, session.Token, session.ExpiresAt, h.cfg.Cookies.Secure)
	h.refreshCsrf(w)
	writeJson(w, http.StatusOK, newUserResponse(u))
}

func (h *Handler) signout(w http.ResponseWriter, r *http.Request) {
	session := sessionFromRequest(r)
	if err := h.sessions.DeleteSession(r.Context(), session); err != nil {
		h.fail(w, err)
		return
	}

	auth.SignoutCleanup(w, h.cfg.Cookies.SessionName, h.cfg.Cookies.Secure)
	h.refreshCsrf(w)
	writeNoContent(w)
}