//! 内部 RPC 的 auth 域：协议转换只在这一层，业务逻辑在 `AuthService`。

use internal::Gate;
use internal::server::InternalRouter;
use proto::internal::v1::identity_service_server::{
    IdentityService as IdentityServiceTrait, IdentityServiceServer,
};
use proto::internal::v1::{
    AttestIdentityRequest, AttestIdentityResponse, CredentialKind, ResolveIdentityRequest,
    ResolveIdentityResponse,
};
use tonic::{Request, Response, Status};

use crate::errors::AuthError;
use crate::services::AuthService;

mod access_key;
mod ssh_key;

pub fn register(router: InternalRouter, service: &AuthService, gate: Gate) -> InternalRouter {
    let router = access_key::register(router, service, gate.clone());
    let router = ssh_key::register(router, service, gate.clone());
    router.add_service(IdentityServiceServer::with_interceptor(
        IdentityRpc {
            service: service.clone(),
        },
        gate,
    ))
}

#[derive(Clone)]
struct IdentityRpc {
    service: AuthService,
}

#[tonic::async_trait]
impl IdentityServiceTrait for IdentityRpc {
    async fn resolve(
        &self,
        request: Request<ResolveIdentityRequest>,
    ) -> Result<Response<ResolveIdentityResponse>, Status> {
        let meta = internal::interceptor::meta(&request)?;
        let request = request.into_inner();
        if request.kind() != CredentialKind::Session {
            return Err(Status::invalid_argument("unsupported credential kind"));
        }
        let principal = self
            .service
            .resolve_internal_session(&request.credential, meta.request_id.as_str())
            .await
            .map_err(status_of)?;
        Ok(Response::new(ResolveIdentityResponse {
            principal: Some(principal),
        }))
    }

    async fn attest(
        &self,
        request: Request<AttestIdentityRequest>,
    ) -> Result<Response<AttestIdentityResponse>, Status> {
        let meta = internal::interceptor::meta(&request)?;
        let request = request.into_inner();
        let principal = self
            .service
            .attest_internal_identity(
                request.user_id,
                request.security_version,
                meta.request_id.as_str(),
            )
            .await
            .map_err(status_of)?;
        Ok(Response::new(AttestIdentityResponse {
            active: true,
            principal: Some(principal),
        }))
    }
}

fn status_of(error: AuthError) -> Status {
    match error {
        AuthError::Unauthenticated => Status::unauthenticated("identity was rejected"),
        other => {
            tracing::warn!(%other, "internal identity rpc failed");
            Status::internal("identity lookup failed")
        }
    }
}