package api

import (
	"net/http"
	"strings"
	"time"

	"browser.local/platform/domain"
	"browser.local/platform/dto"
)

const platformSessionCookieName = "platform_session"

func (h *coreHandlers) writeAuthSession(w http.ResponseWriter, r *http.Request, session domain.AuthSession) {
	response := dto.AuthSessionFromDomain(session)
	if h.enforceAuthorization && strings.TrimSpace(session.SessionID) != "" {
		h.setSessionCookie(w, r, session.SessionID, session.ExpiresAt)
		if r.Header.Get("X-Auth-Token-Response") != "bearer" {
			response.SessionID = ""
		}
	}
	writeJSON(w, http.StatusOK, response)
}

func (h *coreHandlers) setSessionCookie(w http.ResponseWriter, r *http.Request, token string, expiresAt time.Time) {
	http.SetCookie(w, &http.Cookie{
		Name:     platformSessionCookieName,
		Value:    token,
		Path:     "/api/v1",
		Expires:  expiresAt,
		MaxAge:   int(time.Until(expiresAt).Seconds()),
		HttpOnly: true,
		Secure:   r.TLS != nil,
		SameSite: http.SameSiteStrictMode,
	})
}

func (h *coreHandlers) clearSessionCookie(w http.ResponseWriter, r *http.Request) {
	http.SetCookie(w, &http.Cookie{
		Name:     platformSessionCookieName,
		Value:    "",
		Path:     "/api/v1",
		MaxAge:   -1,
		HttpOnly: true,
		Secure:   r.TLS != nil,
		SameSite: http.SameSiteStrictMode,
	})
}