use proto::auth as proto;
use tonic::Status;

#[derive(Debug, thiserror::Error)]
pub enum KenAuthError {
    #[error("kenoauth is unavailable: {0}")]
    Unavailable(String),
    #[error("kenoauth rejected the request: {0}")]
    Rejected(String),
    #[error("kenoauth could not find the requested object")]
    NotFound,
    #[error("kenoauth rejected the credential")]
    Unauthenticated,
    #[error("kenoauth configuration is invalid: {0}")]
    Config(String),
    #[error("kenoauth request failed: {0}")]
    Internal(String),
}

impl KenAuthError {
    pub fn from_status(status: Status) -> Self {
        match status.code() {
            tonic::Code::Unavailable | tonic::Code::DeadlineExceeded => {
                Self::Unavailable(status.message().to_string())
            }
            tonic::Code::Unauthenticated => Self::Unauthenticated,
            tonic::Code::NotFound => Self::NotFound,
            tonic::Code::PermissionDenied
            | tonic::Code::InvalidArgument
            | tonic::Code::FailedPrecondition
            | tonic::Code::AlreadyExists
            | tonic::Code::ResourceExhausted
            | tonic::Code::Aborted => Self::Rejected(status.message().to_string()),
            _ => Self::Internal(status.message().to_string()),
        }
    }

    pub fn is_not_found(&self) -> bool {
        matches!(self, Self::NotFound)
    }

    pub fn is_unauthenticated(&self) -> bool {
        matches!(self, Self::Unauthenticated)
    }
}

#[async_trait::async_trait]
pub trait AuthApi: Send + Sync {
    async fn check_health(&self) -> Result<(), KenAuthError>;
    async fn change_password(
        &self,
        user_id: i64,
        old_password_hash: &str,
        new_password_hash: &str,
        keep_session_id: &str,
        client_ip: &str,
    ) -> Result<proto::v1::ChangePasswordResponse, KenAuthError>;
    async fn get_mfa_status(
        &self,
        user_id: i64,
    ) -> Result<proto::v1::GetMfaStatusResponse, KenAuthError>;
    async fn configure_totp(
        &self,
        user_id: i64,
        name: &str,
        client_ip: &str,
    ) -> Result<proto::v1::ConfigureTotpResponse, KenAuthError>;
    async fn enable_totp(
        &self,
        user_id: i64,
        code: &str,
        password_hash: &str,
        client_ip: &str,
    ) -> Result<proto::v1::EnableTotpResponse, KenAuthError>;
    async fn disable_totp(
        &self,
        user_id: i64,
        code: &str,
        client_ip: &str,
    ) -> Result<proto::v1::DisableTotpResponse, KenAuthError>;
    async fn regenerate_recovery_codes(
        &self,
        user_id: i64,
        password_hash: &str,
        client_ip: &str,
    ) -> Result<proto::v1::RegenerateRecoveryCodesResponse, KenAuthError>;
    async fn list_user_ssh_keys(
        &self,
        user_id: i64,
        include_revoked: bool,
        page: proto::common::v1::PageRequest,
    ) -> Result<proto::v1::ListUserSshKeysResponse, KenAuthError>;
    async fn add_ssh_key(
        &self,
        user_id: i64,
        name: &str,
        public_key: &str,
        description: &str,
        client_ip: &str,
    ) -> Result<proto::v1::AddSshKeyResponse, KenAuthError>;
    async fn revoke_ssh_key(
        &self,
        user_id: i64,
        key_id: &str,
        reason: &str,
        bump_security_version: bool,
    ) -> Result<proto::v1::RevokeSshKeyResponse, KenAuthError>;
    async fn list_user_sessions(
        &self,
        user_id: i64,
        include_revoked: bool,
        include_expired: bool,
        page: proto::common::v1::PageRequest,
    ) -> Result<proto::v1::ListUserSessionsResponse, KenAuthError>;
    async fn revoke_user_sessions(
        &self,
        user_id: i64,
        except_session_id: &str,
        reason: &str,
        bump_security_version: bool,
    ) -> Result<proto::v1::RevokeUserSessionsResponse, KenAuthError>;
    async fn get_session(
        &self,
        user_id: i64,
        version: i32,
        session_id: &str,
    ) -> Result<proto::internal::v1::AuthorityAccess, KenAuthError>;
    async fn delete_account(&self, user_id: i64, reason: &str) -> Result<(), KenAuthError>;
    async fn cancel_account_deletion(&self, user_id: i64) -> Result<(), KenAuthError>;
    async fn purge_account(&self, user_id: i64) -> Result<(), KenAuthError>;
    async fn batch_get_authority_users(
        &self,
        user_ids: Vec<i64>,
    ) -> Result<Vec<proto::internal::v1::AuthorityUser>, KenAuthError>;
    async fn get_user_status(
        &self,
        user_id: i64,
    ) -> Result<proto::common::v1::UserStatus, KenAuthError>;
    async fn get_user_public_by_ref(
        &self,
        key: proto::common::v1::user_ref::Key,
    ) -> Result<proto::common::v1::UserPublic, KenAuthError>;
    async fn get_authority_user(
        &self,
        user_id: i64,
    ) -> Result<proto::internal::v1::AuthorityUser, KenAuthError>;
    async fn update_authority_user(
        &self,
        user_id: i64,
        username: Option<String>,
        displayname: Option<String>,
        clear_displayname: bool,
        public_show_email: Option<bool>,
        version: i32,
    ) -> Result<proto::internal::v1::AuthorityUser, KenAuthError>;
    async fn batch_get_user_public(
        &self,
        user_ids: Vec<i64>,
    ) -> Result<Vec<proto::common::v1::UserPublic>, KenAuthError>;
    async fn get_user_public(
        &self,
        user_id: i64,
    ) -> Result<proto::common::v1::UserPublic, KenAuthError>;
    async fn revoke_session(
        &self,
        user_id: i64,
        session_id: &str,
        reason: &str,
    ) -> Result<(), KenAuthError>;
    async fn lookup_ssh_key(
        &self,
        public_key: &str,
    ) -> Result<Option<proto::common::v1::Principal>, KenAuthError>;
    async fn ensure_bot_user(
        &self,
        username: &str,
        displayname: &str,
        system: bool,
    ) -> Result<proto::common::v1::UserPublic, KenAuthError>;
}