package web

import (
	"context"
	"errors"
	"fmt"
	"net/http"

	"gardomatic.kleiax.de/lib/client"
	"github.com/justinas/nosurf"
)

func secureHeaders(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Security-Policy", "default-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; script-src 'self'; img-src 'self' data: blob:; media-src 'self' blob:; manifest-src 'self'; connect-src 'self'")
		w.Header().Set("Permissions-Policy", "camera=(self), microphone=(self)")
		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
		w.Header().Set("X-Content-Type-Options", "nosniff")
		w.Header().Set("X-Frame-Options", "deny")
		next.ServeHTTP(w, r)
	})
}

func (app *application) logRequest(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		app.logger.Info("request", "remote_addr", r.RemoteAddr, "proto", r.Proto, "method", r.Method, "uri", r.URL.RequestURI())
		next.ServeHTTP(w, r)
	})
}

func (app *application) recoverPanic(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		defer func() {
			if recovered := recover(); recovered != nil {
				w.Header().Set("Connection", "close")
				app.serverError(w, fmt.Errorf("panic: %v", recovered))
			}
		}()
		next.ServeHTTP(w, r)
	})
}

func (app *application) requireAuthentication(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if !app.isAuthenticated(r) {
			http.Redirect(w, r, loginPathForRequest(r), http.StatusSeeOther)
			return
		}
		w.Header().Set("Cache-Control", "no-store")
		next.ServeHTTP(w, r)
	})
}

func loginPathForRequest(r *http.Request) string {
	loginPath := webPath("login")
	if r.Method != http.MethodGet {
		return loginPath
	}
	returnTo := safeReturnPath(r.URL.RequestURI())
	if returnTo == "" {
		return loginPath
	}
	return pathWithQuery(loginPath, "return_to", returnTo)
}

func (app *application) requireActivatedUser(next http.Handler) http.Handler {
	return app.requireAuthentication(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		user, ok := userFromContext(r.Context())
		if !ok || !user.Activated {
			http.Redirect(w, r, webPath("activate"), http.StatusSeeOther)
			return
		}
		next.ServeHTTP(w, r)
	}))
}

func (app *application) noSurf(next http.Handler) http.Handler {
	csrfHandler := nosurf.New(next)
	csrfHandler.SetIsTLSFunc(func(r *http.Request) bool {
		return r.TLS != nil || app.config.CookieSecure
	})
	csrfHandler.SetBaseCookie(http.Cookie{
		Name:     "gardomatic_csrf",
		HttpOnly: true,
		Path:     "/",
		SameSite: http.SameSiteLaxMode,
		Secure:   app.config.CookieSecure,
	})
	return csrfHandler
}

func (app *application) withAPIClient(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		requestClient, err := app.apiClient.ForRequest(r)
		if err != nil {
			app.serverError(w, err)
			return
		}
		ctx := client.NewContext(r.Context(), requestClient)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

func (app *application) authenticate(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		apiClient := client.FromContext(r.Context())
		if apiClient == nil {
			app.serverError(w, errors.New("API client missing from request context"))
			return
		}
		user, response, err := apiClient.Session(r.Context())
		if err != nil {
			var apiError *client.APIError
			if errors.As(err, &apiError) && apiError.StatusCode == http.StatusUnauthorized {
				next.ServeHTTP(w, r)
				return
			}
			app.serverError(w, err)
			return
		}
		client.ForwardCookies(w, response)
		ctx := context.WithValue(r.Context(), isAuthenticatedContextKey, true)
		ctx = context.WithValue(ctx, userContextKey, user)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}