use std::sync::Arc;

use axum::Extension;
use axum::extract::State;
use axum::http::HeaderMap;
use axum::response::{IntoResponse, Redirect, Response};

use crate::errors::ApiError;
use crate::oauth::{append_cookie, read_cookie_header};
use crate::services::AuthService;

pub async fn logout(
    State(service): State<AuthService>,
    Extension(verifier): Extension<Arc<jwt::JwtVerifier>>,
    headers: HeaderMap,
) -> Result<Response, ApiError> {
    let config = service.config();
    let token = read_cookie_header(&headers, &config.oauth.session_cookie).map(str::to_owned);
    if let Some(token) = token
        && let Ok(claims) = verifier.verify_access(&token).await
        && let Some(session_id) = claims.sid.as_deref()
        && let Some(kenauth) = service.state.kenauth.as_ref()
    {
        let _ = kenauth
            .revoke_session(claims.sub, session_id, "user_logout")
            .await;
    }

    let mut response = Redirect::to("/").into_response();
    append_cookie(&mut response, &jwt::clear_session_cookie(&config.oauth));
    append_cookie(&mut response, &jwt::clear_refresh_cookie(&config.oauth));
    Ok(response)
}