package authcommon

import (
	"context"
	"crypto/subtle"
	"encoding/base64"
	"strings"

	"cmroubao/backend-api/internal/domain"
)

const (
	AdminSessionCookieName = "cmroubao_admin_session"
	CSRFCookieName         = "cmroubao_admin_csrf"
	CSRFFormField          = "csrf_token"
	CSRFHeader             = "X-CSRF-Token"
)

type principalContextKey struct{}

func WithPrincipal(
	ctx context.Context,
	principal domain.AuthPrincipal,
) context.Context {
	return context.WithValue(ctx, principalContextKey{}, principal)
}

func Principal(ctx context.Context) (domain.AuthPrincipal, bool) {
	principal, ok := ctx.Value(principalContextKey{}).(domain.AuthPrincipal)
	return principal, ok
}

func ValidCSRFPair(cookieValue, presentedValue string) bool {
	cookieValue = strings.TrimSpace(cookieValue)
	presentedValue = strings.TrimSpace(presentedValue)
	if !ValidOpaqueValue(cookieValue) ||
		len(cookieValue) != len(presentedValue) {
		return false
	}
	return subtle.ConstantTimeCompare(
		[]byte(cookieValue),
		[]byte(presentedValue),
	) == 1
}

func ValidOpaqueValue(value string) bool {
	decoded, err := base64.RawURLEncoding.DecodeString(value)
	return err == nil && len(decoded) == 32
}