use session::{AuthUser, Session, SessionUser, SessionUserMut};
use uuid::Uuid;

use crate::errors::{ApiError, AuthError};

pub const PWD_VERSION_KEY: &str = "auth:pwd_version";

pub fn session_token_key(uid: Uuid) -> String {
    format!("auth:token_hash:{uid}")
}

pub fn require_uid(session: &Session) -> Result<Uuid, Box<ApiError>> {
    match session.uid() {
        Some(uid) => Ok(uid),
        None => Err(Box::new(ApiError::from(AuthError::Unauthorized))),
    }
}

pub fn apply_login(session: &Session, user: AuthUser, passwd_version: Option<i64>) {
    session.login_user(user);
    session.set(PWD_VERSION_KEY, passwd_version.unwrap_or(0));
}

pub fn pwd_version_matches(session: &Session, current: Option<i64>) -> bool {
    let stored = session.get::<i64>(PWD_VERSION_KEY);
    match (stored, current) {
        (Some(stored_ver), Some(curr_ver)) => stored_ver == curr_ver,
        (None, None) => true,
        _ => false,
    }
}

pub fn validate_session_pwd_version(session: &Session, current_passwd_version: Option<i64>) -> Result<(), AuthError> {
    if !pwd_version_matches(session, current_passwd_version) {
        if let Some(uid) = session.uid() {
            session.logout_user(uid);
        }
        return Err(AuthError::Unauthorized);
    }
    Ok(())
}