package profile

import (
	"context"
	"encoding/json"
	"log/slog"
	"net/http"

	"proxui/backend/internal/auth"
)

type Ensurer interface {
	Ensure(ctx context.Context, id string, email string) error
}

type Middleware struct {
	ensurer Ensurer
	logger  *slog.Logger
}

func NewMiddleware(ensurer Ensurer, logger *slog.Logger) Middleware {
	return Middleware{
		ensurer: ensurer,
		logger:  logger,
	}
}

func (m Middleware) EnsureProfile(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		principal, ok := auth.PrincipalFromRequest(r)
		if !ok {
			writeError(w, http.StatusUnauthorized, "unauthorized")
			return
		}

		if err := m.ensurer.Ensure(r.Context(), principal.Subject, principal.Email); err != nil {
			m.logger.Error("profile sync failed", "error", err)
			writeError(w, http.StatusInternalServerError, "profile_sync_failed")
			return
		}

		next.ServeHTTP(w, r)
	})
}

func writeError(w http.ResponseWriter, status int, message string) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
}