package web

import (
	"net/http"

	"vibetree/internal/auth"
)

type loginPageData struct {
	Error string
	Next  string
}

func (a *App) handleLoginForm(w http.ResponseWriter, r *http.Request) {
	if _, ok := auth.UserFromContext(r.Context()); ok {
		http.Redirect(w, r, "/inventory", http.StatusSeeOther)
		return
	}
	a.Render(w, http.StatusOK, "login", loginPageData{Next: r.URL.Query().Get("next")})
}

func (a *App) handleLoginSubmit(w http.ResponseWriter, r *http.Request) {
	if err := r.ParseForm(); err != nil {
		a.Render(w, http.StatusBadRequest, "login", loginPageData{Error: "Invalid form submission."})
		return
	}
	username := r.FormValue("username")
	password := r.FormValue("password")
	next := r.FormValue("next")

	u, err := a.Users.Authenticate(r.Context(), username, password)
	if err != nil {
		a.Render(w, http.StatusUnauthorized, "login", loginPageData{Error: "Invalid username or password.", Next: next})
		return
	}

	token, expires, err := a.Auth.CreateSession(r.Context(), u.ID)
	if err != nil {
		a.Render(w, http.StatusInternalServerError, "login", loginPageData{Error: "Could not start a session. Please try again."})
		return
	}
	auth.SetCookie(w, token, expires, a.SecureCookies)

	dest := "/inventory"
	if next != "" {
		dest = next
	}
	http.Redirect(w, r, dest, http.StatusSeeOther)
}

func (a *App) handleLogout(w http.ResponseWriter, r *http.Request) {
	if cookie, err := r.Cookie(auth.CookieName); err == nil {
		_ = a.Auth.DestroySession(r.Context(), cookie.Value)
	}
	auth.ClearCookie(w, a.SecureCookies)
	http.Redirect(w, r, "/login", http.StatusSeeOther)
}