package auth

import (
	"context"
	"log/slog"
	"net/http"

	"github.com/yourusername/caldav-server/internal/config"
	"golang.org/x/crypto/bcrypt"
)

type contextKey string

const userContextKey contextKey = "authenticated_user"

// Middleware wraps an http.Handler with HTTP Basic Auth enforcement.
type Middleware struct {
	cfg    *config.Config
	logger *slog.Logger
}

func NewMiddleware(cfg *config.Config, logger *slog.Logger) *Middleware {
	return &Middleware{cfg: cfg, logger: logger}
}

// Wrap returns an http.Handler that requires valid Basic Auth credentials
// before delegating to next.
func (m *Middleware) Wrap(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		username, password, ok := r.BasicAuth()
		if !ok {
			m.challenge(w)
			return
		}

		user, err := m.authenticate(username, password)
		if err != nil {
			m.logger.Warn("authentication failed",
				"username", username,
				"remote_addr", r.RemoteAddr,
				"error", err)
			m.challenge(w)
			return
		}

		m.logger.Debug("authenticated request",
			"username", username,
			"method", r.Method,
			"path", r.URL.Path)

		ctx := context.WithValue(r.Context(), userContextKey, &Principal{
			Username:    username,
			DisplayName: user.DisplayName,
			Email:       user.Email,
		})
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

// challenge sends a 401 response requesting Basic Auth.
func (m *Middleware) challenge(w http.ResponseWriter) {
	w.Header().Set("WWW-Authenticate", `Basic realm="`+m.cfg.Auth.Realm+`"`)
	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
	w.WriteHeader(http.StatusUnauthorized)
	_, _ = w.Write([]byte("Unauthorized"))
}

// authenticate validates username/password against config.
func (m *Middleware) authenticate(username, password string) (*config.UserConfig, error) {
	user, ok := m.cfg.Users[username]
	if !ok {
		// constant-time comparison to avoid timing attacks
		_ = bcrypt.CompareHashAndPassword([]byte("$2b$12$invalid"), []byte(password))
		return nil, errUnauthorized
	}

	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
		return nil, errUnauthorized
	}

	return &user, nil
}

// Principal holds the authenticated user's identity.
type Principal struct {
	Username    string
	DisplayName string
	Email       string
}

// FromContext extracts the Principal from a request context.
// Returns nil if the request was not authenticated.
func FromContext(ctx context.Context) *Principal {
	p, _ := ctx.Value(userContextKey).(*Principal)
	return p
}

var errUnauthorized = &authError{msg: "invalid credentials"}

type authError struct{ msg string }

func (e *authError) Error() string { return e.msg }