import { type Request, type Response } from "express";

import { inject } from "../infrastructure/di/index.js";
import {
    KC_SECURITY_NAME,
    KeycloakUser,
} from "../services/keycloak/user/index.js";

const keycloak = inject(KeycloakUser);

async function doKeycloakAuth(
    request: Request,
    roles?: string[],
    response?: Response,
): Promise<any> {
    if (!roles || roles.length < 1) {
        roles = ["default-roles-taekwondo"];
    }
    const allowed = await keycloak.checkRoles(
        roles,
        request,
        response ?? ({} as any),
    );
    if (allowed) {
        return Promise.resolve();
    } else {
        return Promise.reject(httpError(403, "Forbidden"));
    }
}

export async function expressAuthentication(
    request: Request,
    securityName: string,
    roles?: string[],
    response?: Response,
): Promise<any> {
    if (request.method === "OPTIONS") {
        return Promise.resolve();
    }
    switch (securityName) {
        case KC_SECURITY_NAME:
            return await doKeycloakAuth(request, roles, response);
        case undefined:
            return Promise.resolve();
        default:
            return Promise.reject(httpError(400, "Unknown security name"));
    }
}

function httpError(status: number, message: string) {
    const err: any = new Error(message);
    err.status = status;
    return err;
}