package server

import (
	"context"
	"fmt"

	"github.com/coreos/go-oidc/v3/oidc"
	"github.com/danyel/go-loose/internal/password"
	"golang.org/x/oauth2"
)

func (s *Server) configureOIDC(ctx context.Context, issuer, clientID, clientSecret string) error {
	provider, err := oidc.NewProvider(ctx, issuer)
	if err != nil {
		return fmt.Errorf("discover OIDC provider: %w", err)
	}
	config := &oauth2.Config{
		ClientID: clientID, ClientSecret: clientSecret,
		Endpoint: provider.Endpoint(), RedirectURL: s.cfg.OIDCRedirectURL,
		Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
	}
	s.authMu.Lock()
	s.oauth = config
	s.verifier = provider.Verifier(&oidc.Config{ClientID: clientID})
	s.authMu.Unlock()
	return nil
}

func (s *Server) oidcConfiguration() (*oauth2.Config, *oidc.IDTokenVerifier) {
	s.authMu.RLock()
	defer s.authMu.RUnlock()
	return s.oauth, s.verifier
}

func (s *Server) hasOIDC() bool {
	config, verifier := s.oidcConfiguration()
	return config != nil && verifier != nil
}

func (s *Server) ensureLocalAdministrator(ctx context.Context) error {
	if !s.cfg.LocalLogin {
		return nil
	}
	dummyHash, err := password.Hash("not-a-real-account-password")
	if err != nil {
		return fmt.Errorf("hash password timing value: %w", err)
	}
	s.loginGuard.dummyHash = dummyHash
	if s.cfg.LocalAdminPassword == "" {
		return nil
	}
	passwordHash, err := password.Hash(s.cfg.LocalAdminPassword)
	if err != nil {
		return fmt.Errorf("hash local administrator password: %w", err)
	}
	if err := s.store.EnsurePasswordUser(
		ctx, s.cfg.LocalAdminEmail, "Local Administrator", passwordHash,
		s.cfg.BootstrapTenant, s.cfg.BootstrapApp,
	); err != nil {
		return fmt.Errorf("bootstrap local administrator: %w", err)
	}
	return nil
}