use crate::user::{AuthUser, SessionUser};
use crate::{Session, SessionUserMut};
use uuid::Uuid;

use crate::error::SessionError;

pub const PWD_VERSION_KEY: &str = "auth:pwd_version";

pub fn session_token_key(uid: Uuid) -> String {
    format!("auth:token_hash:{uid}")
}

pub fn require_uid(session: &Session) -> Result<Uuid, SessionError> {
    session.uid().ok_or(SessionError::Unauthorized)
}

pub fn apply_login(session: &Session, user: AuthUser, passwd_version: Option<i64>) {
    session.set_store(true);
    session.login_user(user);
    session.set(PWD_VERSION_KEY, passwd_version.unwrap_or(0));
}

pub fn apply_pwd_version(session: &Session, version: i64) {
    session.set_store(true);
    session.set(PWD_VERSION_KEY, version);
}

pub fn pwd_version_matches(session: &Session, current: Option<i64>) -> bool {
    let stored = session.get::<i64>(PWD_VERSION_KEY);
    match (stored, current) {
        (Some(stored_ver), Some(curr_ver)) => stored_ver == curr_ver,
        (None, None) => true,
        _ => false,
    }
}

pub fn validate_session_pwd_version(
    session: &Session,
    current_passwd_version: Option<i64>,
) -> Result<(), SessionError> {
    if !pwd_version_matches(session, current_passwd_version) {
        if let Some(uid) = session.uid() {
            session.logout_user(uid);
        }
        return Err(SessionError::Unauthorized);
    }
    Ok(())
}