package worker

import (
	"context"
	"errors"
	"fmt"
	"strings"

	"google.golang.org/grpc/credentials"
	"google.golang.org/grpc/peer"

	"proxy-pool/internal/domain/workerruntime"
)

var ErrUnauthorizedIdentity = errors.New("control-plane identity is not authorized")

// AllowLoopbackIdentity is used only by the validated loopback plaintext mode.
// It deliberately does not inspect transport credentials because that mode has no TLS peer.
type AllowLoopbackIdentity struct{}

func (AllowLoopbackIdentity) Authorize(context.Context, string) error {
	return nil
}

func (AllowLoopbackIdentity) AuthorizeChecker(context.Context, string) error {
	return nil
}

type SPIFFEIdentityAuthorizer struct {
	trustDomain string
	environment string
}

func NewSPIFFEIdentityAuthorizer(trustDomain, environment string) (*SPIFFEIdentityAuthorizer, error) {
	if strings.TrimSpace(trustDomain) == "" || strings.TrimSpace(environment) == "" {
		return nil, fmt.Errorf("spiffe identity authorizer: trust domain and environment are required")
	}
	return &SPIFFEIdentityAuthorizer{trustDomain: trustDomain, environment: environment}, nil
}

func (authorizer *SPIFFEIdentityAuthorizer) Authorize(ctx context.Context, workerID string) error {
	return authorizer.authorize(ctx, "worker", workerID)
}

func (authorizer *SPIFFEIdentityAuthorizer) AuthorizeChecker(ctx context.Context, checkerID string) error {
	return authorizer.authorize(ctx, "checker", checkerID)
}

func (authorizer *SPIFFEIdentityAuthorizer) authorize(ctx context.Context, resourceType, resourceID string) error {
	if authorizer == nil || (resourceType != "worker" && resourceType != "checker") || resourceID == "" {
		return ErrUnauthorizedIdentity
	}
	peerInfo, ok := peer.FromContext(ctx)
	if !ok || peerInfo.AuthInfo == nil {
		return ErrUnauthorizedIdentity
	}
	tlsInfo, ok := peerInfo.AuthInfo.(credentials.TLSInfo)
	if !ok || len(tlsInfo.State.VerifiedChains) == 0 {
		return ErrUnauthorizedIdentity
	}

	chain := tlsInfo.State.VerifiedChains[0]
	if len(chain) == 0 || chain[0] == nil {
		return ErrUnauthorizedIdentity
	}
	identity, matches := workerruntime.SingleSPIFFEIdentity(
		chain[0].URIs, authorizer.trustDomain, authorizer.environment, resourceType,
	)
	if !matches || identity != resourceID {
		return ErrUnauthorizedIdentity
	}
	return nil
}