// Package auth is the first party authentication and accounts module. It produces a verified
// (org_id, user_id, role) from an opaque server side session and feeds that, and only that, into the
// tenant resolver, replacing the dev X-Org-ID header. The cryptographic primitives live in
// internal/platform/security; this package wires them to the database (through the SECURITY DEFINER
// functions in migration 0009) and to HTTP.
package auth

import (
	"github.com/missionworkforce/missionmatch/internal/platform/audit"
	"github.com/missionworkforce/missionmatch/internal/platform/security"
	"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)

// Cookie names. The session cookie uses the __Host- prefix, which a browser only accepts when the
// cookie is Secure, Path=/, and has no Domain, so it cannot be planted by a sibling subdomain. The
// prefix and the Secure attribute must agree: a __Host- cookie without Secure is silently dropped by
// the browser. So the name is chosen to match the Secure flag (the secure name in production, a plain
// name only for plain http local dev). Production config requires CookieSecure true.
const (
	SessionCookie         = "__Host-mm_session"
	CSRFCookie            = "__Host-mm_csrf"
	CSRFHeader            = "X-CSRF-Token"
	sessionCookieInsecure = "mm_session"
	csrfCookieInsecure    = "mm_csrf"
)

// Deps is everything the service needs, assembled in cmd/api from config. Keys never have defaults;
// they come from the secrets file through config.
type Deps struct {
	DB              *tenant.DB
	Audit           *audit.Writer
	Hasher          *security.Hasher
	Tagger          *security.Tagger
	TOTP            security.TOTP
	TOTPKEKs        map[int][]byte // key_version to AES 256 key, for decrypt
	TOTPKEKActive   int            // version new secrets are sealed under
	TOTPIssuer      string
	IdleSeconds     int
	AbsoluteSeconds int
	PendingSeconds  int
	InviteSeconds   int
	CookieSecure    bool
	MFADisabled     bool // pilot only: when true, login and invite accept mint an active session with no TOTP step. The zero value (false) keeps MFA mandatory, so a Deps built without setting it is secure by default.
}

// LoginInput is a password login attempt.
type LoginInput struct {
	Email    string `json:"email"`
	Password string `json:"password"`
}

// LoginResult tells the SPA whether to show the enroll or the verify step. Token is set as the
// session cookie by the handler, never returned in the body. When MFARequired is false the issued
// session is already active, so the SPA skips the MFA step and goes straight to the app.
type LoginResult struct {
	Token       string `json:"-"`
	MFAEnrolled bool   `json:"mfa_enrolled"`
	MFARequired bool   `json:"mfa_required"`
}

// CodeInput carries a submitted six digit TOTP code or a recovery code.
type CodeInput struct {
	Code string `json:"code"`
}

// EnrollResult returns the provisioning material shown once during enrollment.
type EnrollResult struct {
	OTPAuthURI string `json:"otpauth_uri"`
	Secret     string `json:"secret"`
}

// ActivateResult returns the recovery codes shown exactly once on activation. Token is the new active
// session cookie.
type ActivateResult struct {
	Token         string   `json:"-"`
	RecoveryCodes []string `json:"recovery_codes"`
}

// TokenResult is a bare new session token for the handler to set as a cookie.
type TokenResult struct {
	Token string `json:"-"`
}

// InviteInput is an owner or admin inviting a user into their org.
type InviteInput struct {
	Email    string `json:"email"`
	FullName string `json:"full_name"`
	Role     string `json:"role"`
	// Tools is the product set the new account starts with. Carried on the invite so creating an account
	// and granting its access are ONE operation: entitlement fails closed, so an account created without
	// this would exist but see nothing, and the operator would have to notice and fix it in a second step.
	// Bounded by the same rule as a later change: the inviter may only confer tools they hold themselves.
	Tools []string `json:"tools"`
}

// InviteResult returns the one time activation link token for manual delivery at pilot.
type InviteResult struct {
	Token  string `json:"token"`
	UserID string `json:"user_id"`
}

// AcceptInput redeems an invite or activation link and sets the password.
type AcceptInput struct {
	Token    string `json:"token"`
	Password string `json:"password"`
}

// ChangePasswordInput changes the authenticated user's password.
type ChangePasswordInput struct {
	OldPassword string `json:"old_password"`
	NewPassword string `json:"new_password"`
}

// RoleChangeInput sets a target user's role.
type RoleChangeInput struct {
	Role string `json:"role"`
}

// StatusChangeInput enables or disables a target user.
type StatusChangeInput struct {
	Status string `json:"status"`
}

// SessionInfo is the SPA view of the current session. No secrets.
type SessionInfo struct {
	UserID      string `json:"user_id"`
	OrgID       string `json:"org_id"`
	Role        string `json:"role"`
	MFAEnrolled bool   `json:"mfa_enrolled"`
	// Capabilities is the caller's resolved permission list, computed from the same matrix the server
	// enforces. It exists so the interface stops gating on role name comparisons, which duplicate the
	// matrix in TypeScript where it drifts, and cannot express a permission that does not map cleanly
	// onto one role.
	//
	// The server remains the only authority. This list decides what is OFFERED, never what is allowed,
	// and every endpoint keeps its own gate.
	Capabilities []string `json:"capabilities"`

	// Tools is the caller's granted product set: which of missionMATCH, screenMATCH, slateMATCH, and
	// recruitMATCH exist for them at all. Separate from Capabilities because role answers what a person
	// may DO and this answers what they may SEE, and the two vary independently between clients.
	//
	// Like Capabilities this decides what is OFFERED, never what is allowed: each tool's route group
	// carries its own server side gate, so a hidden tool is refused at the API even if the interface is
	// bypassed entirely.
	Tools []string `json:"tools"`
}

// UserSummary is one row of the org user list. No secrets.
type UserSummary struct {
	ID          string `json:"id"`
	Email       string `json:"email"`
	FullName    string `json:"full_name"`
	Role        string `json:"role"`
	Status      string `json:"status"`
	MFAEnrolled bool   `json:"mfa_enrolled"`
	// Tools is this user's granted product set, so the People screen can show and edit what they SEE
	// alongside what they may do. Always present, empty rather than null, so the client can iterate.
	Tools []string `json:"tools"`
	// LastLoginAt was the other half of a two part defect. The column was never written, and it was also
	// never returned, so fixing only the write would have left the People screen still showing "never
	// signed in" for everyone and the fix would have looked like it failed.
	LastLoginAt *string `json:"last_login_at,omitempty"`
}

// ToolsChangeInput replaces a user's tool entitlement. The field is the COMPLETE intended set, not a
// delta: the result is exactly these tools, so one request can express "these and no others" and a client
// that has drifted from the server cannot re grant something it believed was already absent.
type ToolsChangeInput struct {
	Tools []string `json:"tools"`
}