package logins

import (
	"encoding/base64"
	"encoding/hex"
	"errors"
	"time"

	"github.com/biscuit-auth/biscuit-go/v2"
	"github.com/biscuit-auth/biscuit-go/v2/parser"
	"gitlab.g3e.fr/h6n/users/lib"
	login_lib "gitlab.g3e.fr/h6n/users/lib/login"
	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
)

func CheckPasswordHash(password, hash string) bool {
	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
	return err == nil
}

func CreateLogin(db *gorm.DB, request login_lib.RequestLogin) (login_lib.ResponseLogin, error) {
	var response login_lib.ResponseLogin

	var user = Users{Email: request.Username}
	if err := db.First(&user); err.Error != nil {
		return response, err.Error
	}
	if !CheckPasswordHash(request.Password, user.Password) {
		return response, errors.ErrUnsupported
	}
	now := time.Now()
	ValidateTime := 14
	expire := now.AddDate(0, 0, ValidateTime)

	user_id := string(user.Username)

	auth := `user("` + user_id + `");
	check if time($time), $time <= ` + expire.Format("2006-01-02T15:04:05Z") + `;
	`

	authority, err := parser.FromStringBlockWithParams(auth, map[string]biscuit.Term{"read": biscuit.String("read"), "write": biscuit.String("write")})

	if err != nil {
		return response, err
	}

	builder := biscuit.NewBuilder(lib.PrivateKey)
	if err = builder.AddBlock(authority); err != nil {
		return response, err
	}

	b, err := builder.Build()
	if err != nil {
		return response, err
	}

	token, err := b.Serialize()
	if err != nil {
		return response, err
	}

	response.Token = base64.URLEncoding.EncodeToString(token)
	response.PublicKey = hex.EncodeToString(lib.PublicKey)

	return response, nil
}