package httpserver

import (
	"errors"
	"fmt"
	"strings"

	"github.com/SamuelTariku/FortuneBet-Backend/internal/domain"
	jwtutil "github.com/SamuelTariku/FortuneBet-Backend/internal/web_server/jwt"
	"github.com/gofiber/fiber/v2"
)

func (a *App) authMiddleware(c *fiber.Ctx) error {

	authHeader := c.Get("Authorization")
	if authHeader == "" {
		fmt.Println("Auth Header Missing")
		return fiber.NewError(fiber.StatusUnauthorized, "Authorization header missing")
	}

	if !strings.HasPrefix(authHeader, "Bearer ") {
		fmt.Println("Invalid authorization header format")
		return fiber.NewError(fiber.StatusUnauthorized, "Invalid authorization header format")
	}

	accessToken := strings.TrimPrefix(authHeader, "Bearer ")
	c.Locals("access_token", accessToken)
	claim, err := jwtutil.ParseJwt(accessToken, a.JwtConfig.JwtAccessKey)
	if err != nil {
		if errors.Is(err, jwtutil.ErrExpiredToken) {
			fmt.Println("Token Expired")
			return fiber.NewError(fiber.StatusUnauthorized, "Access token expired")
		}
		fmt.Println("Invalid Token")
		return fiber.NewError(fiber.StatusUnauthorized, "Invalid access token")
	}

	refreshToken := c.Get("Refresh-Token")
	if refreshToken == "" {

		// refreshToken = c.Cookies("refresh_token", "")

		// return fiber.NewError(fiber.StatusUnauthorized, "Refresh token missing")
	}
	c.Locals("user_id", claim.UserId)
	c.Locals("role", claim.Role)
	c.Locals("branch_id", claim.BranchId)
	c.Locals("refresh_token", refreshToken)

	return c.Next()
}

func (a *App) SuperAdminOnly(c *fiber.Ctx) error {
	userRole := c.Locals("role").(domain.Role)
	if userRole != domain.RoleSuperAdmin {
		return fiber.NewError(fiber.StatusUnauthorized, "Invalid access token")
	}
	return c.Next()
}