package issuer

import (
	"encoding/json"
	"errors"
	"fmt"
	"golang.org/x/oauth2"
	"net/http"
	"net/url"
	"path"
	"slices"
)

// SsoConfig is the base URL for an OAUTH/OPENID/SSO login service
// The path `/.well-known/openid-configuration` should be available
type SsoConfig struct {
	Addr      string `json:"addr"`      // https://login.example.com
	Namespace string `json:"namespace"` // example.com
	Client    struct {
		ID     string   `json:"id"`
		Secret string   `json:"secret"`
		Scopes []string `json:"scopes"`
	} `json:"client"`
}

func (s SsoConfig) FetchConfig() (*WellKnownOIDC, error) {
	confUrl := path.Join(s.Addr, ".well-known", "openid-configuration")
	get, err := http.Get(confUrl)
	if err != nil {
		return nil, err
	}
	defer get.Body.Close()

	var c WellKnownOIDC
	err = json.NewDecoder(get.Body).Decode(&c)
	return &c, err
}

type WellKnownOIDC struct {
	Config                 SsoConfig `json:"-"`
	Issuer                 string    `json:"issuer"`
	AuthorizationEndpoint  string    `json:"authorization_endpoint"`
	TokenEndpoint          string    `json:"token_endpoint"`
	UserInfoEndpoint       string    `json:"userinfo_endpoint"`
	ResponseTypesSupported []string  `json:"response_types_supported"`
	ScopesSupported        []string  `json:"scopes_supported"`
	ClaimsSupported        []string  `json:"claims_supported"`
	GrantTypesSupported    []string  `json:"grant_types_supported"`
}

func (o WellKnownOIDC) Validate() error {
	if o.Issuer == "" {
		return errors.New("missing issuer")
	}

	// check URLs are valid
	if _, err := url.Parse(o.AuthorizationEndpoint); err != nil {
		return err
	}
	if _, err := url.Parse(o.TokenEndpoint); err != nil {
		return err
	}
	if _, err := url.Parse(o.UserInfoEndpoint); err != nil {
		return err
	}

	// check oidc supported values
	if !slices.Contains(o.ResponseTypesSupported, "code") {
		return errors.New("missing required response type 'code'")
	}
	if !slices.Contains(o.ScopesSupported, "openid") {
		return errors.New("missing required scope 'openid'")
	}
	requiredClaims := []string{"sub", "name", "preferred_username", "email", "email_verified"}
	for _, i := range requiredClaims {
		if !slices.Contains(o.ClaimsSupported, i) {
			return fmt.Errorf("missing required claim '%s'", i)
		}
	}

	// oidc valid
	return nil
}

func (o WellKnownOIDC) Oauth2Config() oauth2.Config {
	return oauth2.Config{
		ClientID:     o.Config.Client.ID,
		ClientSecret: o.Config.Client.Secret,
		Endpoint: oauth2.Endpoint{
			AuthURL:   o.AuthorizationEndpoint,
			TokenURL:  o.TokenEndpoint,
			AuthStyle: oauth2.AuthStyleInHeader,
		},
		Scopes: o.Config.Client.Scopes,
	}
}