package middleware

import (
	"context"
	"net/http"
	"strings"

	"apps/backend/internal/domain"
	memberDomain "apps/backend/internal/module/member/domain"
	tokenDomain "apps/backend/internal/module/token/domain"
	"apps/backend/internal/response"
)

type ctxKey int

const (
	ctxUID ctxKey = iota + 1
	ctxRoles
	ctxMember
)

func UIDFrom(ctx context.Context) (int64, bool) {
	v, ok := ctx.Value(ctxUID).(int64)
	return v, ok
}

func RolesFrom(ctx context.Context) []string {
	v, _ := ctx.Value(ctxRoles).([]string)
	return v
}

// AuthMiddleware validates Bearer access JWT.
func AuthMiddleware(issuer tokenDomain.Issuer, store memberDomain.Repository) func(http.HandlerFunc) http.HandlerFunc {
	return func(next http.HandlerFunc) http.HandlerFunc {
		return func(w http.ResponseWriter, r *http.Request) {
			h := r.Header.Get("Authorization")
			if h == "" || !strings.HasPrefix(strings.ToLower(h), "bearer ") {
				response.Fail(w, http.StatusUnauthorized, 401001, "missing authorization", nil)
				return
			}
			token := strings.TrimSpace(h[7:])
			claims, err := issuer.ParseAccess(token)
			if err != nil {
				response.Fail(w, http.StatusUnauthorized, 401002, "invalid or expired token", nil)
				return
			}
			m, err := store.FindByUID(r.Context(), claims.UID)
			if err != nil {
				response.Fail(w, http.StatusUnauthorized, 401003, "member not found", nil)
				return
			}
			if m.IsSuspended() {
				response.Fail(w, http.StatusForbidden, 403001, "account suspended", nil)
				return
			}
			ctx := context.WithValue(r.Context(), ctxUID, m.UID)
			ctx = context.WithValue(ctx, ctxRoles, m.Roles)
			ctx = context.WithValue(ctx, ctxMember, m)
			ctx = context.WithValue(ctx, domain.UIDCode, m.UID)
			next(w, r.WithContext(ctx))
		}
	}
}

// AdminMiddleware requires admin role (after AuthMiddleware).
func AdminMiddleware(next http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		for _, role := range RolesFrom(r.Context()) {
			if role == memberDomain.RoleAdmin {
				next(w, r)
				return
			}
		}
		response.Fail(w, http.StatusForbidden, 403002, "admin required", nil)
	}
}

func MemberFrom(ctx context.Context) (*memberDomain.Member, bool) {
	m, ok := ctx.Value(ctxMember).(*memberDomain.Member)
	return m, ok
}