// Package auth is the first party authentication and accounts module. It produces a verified
// (org_id, user_id, role) from an opaque server side session and feeds that, and only that, into the
// tenant resolver, replacing the dev X-Org-ID header. The cryptographic primitives live in
// internal/platform/security; this package wires them to the database (through the SECURITY DEFINER
// functions in migration 0009) and to HTTP.
package auth

import (
	"github.com/missionworkforce/missionmatch/internal/platform/audit"
	"github.com/missionworkforce/missionmatch/internal/platform/security"
	"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)

// Cookie names. The session cookie uses the __Host- prefix, which a browser only accepts when the
// cookie is Secure, Path=/, and has no Domain, so it cannot be planted by a sibling subdomain. The
// prefix and the Secure attribute must agree: a __Host- cookie without Secure is silently dropped by
// the browser. So the name is chosen to match the Secure flag (the secure name in production, a plain
// name only for plain http local dev). Production config requires CookieSecure true.
const (
	SessionCookie         = "__Host-mm_session"
	CSRFCookie            = "__Host-mm_csrf"
	CSRFHeader            = "X-CSRF-Token"
	sessionCookieInsecure = "mm_session"
	csrfCookieInsecure    = "mm_csrf"
)

// Deps is everything the service needs, assembled in cmd/api from config. Keys never have defaults;
// they come from the secrets file through config.
type Deps struct {
	DB              *tenant.DB
	Audit           *audit.Writer
	Hasher          *security.Hasher
	Tagger          *security.Tagger
	TOTP            security.TOTP
	TOTPKEKs        map[int][]byte // key_version to AES 256 key, for decrypt
	TOTPKEKActive   int            // version new secrets are sealed under
	TOTPIssuer      string
	IdleSeconds     int
	AbsoluteSeconds int
	PendingSeconds  int
	InviteSeconds   int
	CookieSecure    bool
}

// LoginInput is a password login attempt.
type LoginInput struct {
	Email    string `json:"email"`
	Password string `json:"password"`
}

// LoginResult tells the SPA whether to show the enroll or the verify step. Token is set as the
// session cookie by the handler, never returned in the body.
type LoginResult struct {
	Token       string `json:"-"`
	MFAEnrolled bool   `json:"mfa_enrolled"`
}

// CodeInput carries a submitted six digit TOTP code or a recovery code.
type CodeInput struct {
	Code string `json:"code"`
}

// EnrollResult returns the provisioning material shown once during enrollment.
type EnrollResult struct {
	OTPAuthURI string `json:"otpauth_uri"`
	Secret     string `json:"secret"`
}

// ActivateResult returns the recovery codes shown exactly once on activation. Token is the new active
// session cookie.
type ActivateResult struct {
	Token         string   `json:"-"`
	RecoveryCodes []string `json:"recovery_codes"`
}

// TokenResult is a bare new session token for the handler to set as a cookie.
type TokenResult struct {
	Token string `json:"-"`
}

// InviteInput is an owner or admin inviting a user into their org.
type InviteInput struct {
	Email    string `json:"email"`
	FullName string `json:"full_name"`
	Role     string `json:"role"`
}

// InviteResult returns the one time activation link token for manual delivery at pilot.
type InviteResult struct {
	Token  string `json:"token"`
	UserID string `json:"user_id"`
}

// AcceptInput redeems an invite or activation link and sets the password.
type AcceptInput struct {
	Token    string `json:"token"`
	Password string `json:"password"`
}

// ChangePasswordInput changes the authenticated user's password.
type ChangePasswordInput struct {
	OldPassword string `json:"old_password"`
	NewPassword string `json:"new_password"`
}

// RoleChangeInput sets a target user's role.
type RoleChangeInput struct {
	Role string `json:"role"`
}

// StatusChangeInput enables or disables a target user.
type StatusChangeInput struct {
	Status string `json:"status"`
}

// SessionInfo is the SPA view of the current session. No secrets.
type SessionInfo struct {
	UserID      string `json:"user_id"`
	OrgID       string `json:"org_id"`
	Role        string `json:"role"`
	MFAEnrolled bool   `json:"mfa_enrolled"`
}

// UserSummary is one row of the org user list. No secrets.
type UserSummary struct {
	ID          string `json:"id"`
	Email       string `json:"email"`
	FullName    string `json:"full_name"`
	Role        string `json:"role"`
	Status      string `json:"status"`
	MFAEnrolled bool   `json:"mfa_enrolled"`
}