package api

import (
	"net/http"
	"strings"

	"browser.local/platform/domain"
	"browser.local/platform/service"
)

func (h *coreHandlers) requireAuthorizedAPI(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if !strings.HasPrefix(r.URL.Path, "/api/v1/") || publicAPIRequest(r) || runServiceRequest(r) {
			next.ServeHTTP(w, r)
			return
		}
		user, err := h.core.GetCurrentUser(bearerToken(r))
		if err != nil {
			writeServiceError(w, err)
			return
		}
		if platformAdminRequest(r) && !apiPlatformAdmin(user) {
			writeServiceError(w, service.ErrForbidden)
			return
		}
		next.ServeHTTP(w, r)
	})
}

func publicAPIRequest(r *http.Request) bool {
	path := r.URL.Path
	if path == "/api/v1/auth/login" || path == "/api/v1/auth/register" {
		return true
	}
	if r.Method != http.MethodGet {
		return false
	}
	return path == "/api/v1/game-plugins" || strings.HasPrefix(path, "/api/v1/game-plugins/") ||
		path == "/api/v1/plugin-marketplace/plugins" || strings.HasPrefix(path, "/api/v1/plugin-marketplace/plugins/")
}

func runServiceRequest(r *http.Request) bool {
	return strings.HasPrefix(r.URL.Path, "/api/v1/run/control/") ||
		strings.HasPrefix(r.URL.Path, "/api/v1/run/lifecycle/") ||
		strings.HasPrefix(r.URL.Path, "/api/v1/run/jobs/") ||
		strings.HasPrefix(r.URL.Path, "/api/v1/run/logs/") ||
		strings.HasPrefix(r.URL.Path, "/api/v1/run/artifacts/") ||
		strings.HasPrefix(r.URL.Path, "/api/v1/run/metrics/")
}

func platformAdminRequest(r *http.Request) bool {
	path := r.URL.Path
	if path == "/api/v1/users/current" || strings.HasPrefix(path, "/api/v1/users/current/") {
		return false
	}
	if path == "/api/v1/users" || strings.HasPrefix(path, "/api/v1/users/") ||
		path == "/api/v1/ai-providers" || strings.HasPrefix(path, "/api/v1/ai-providers/") ||
		path == "/api/v1/metrics/platform" ||
		path == "/api/v1/run/endpoints" || strings.HasPrefix(path, "/api/v1/run/endpoints/") {
		return true
	}
	if r.Method != http.MethodGet && (path == "/api/v1/game-plugins" || strings.HasPrefix(path, "/api/v1/game-plugins/") || strings.Contains(path, "/plugin-marketplace/plugins/")) {
		return true
	}
	return r.Method == http.MethodPost && (path == "/api/v1/jobs" || path == "/api/v1/artifacts" || path == "/api/v1/log-streams")
}

func apiPlatformAdmin(user domain.User) bool {
	for _, role := range user.Roles {
		if role == "platform-admin" || role == "admin" || role == "platformadmin" {
			return true
		}
	}
	return false
}