package idp

import (
	"context"
	"encoding/json"
	"errors"
	"log/slog"
	"time"

	"tug/internal/service/identity"
	"tug/internal/service/refusalcap"
	"tug/internal/storage"
)

const (
	ActionLoginSuccess = "login.success"
	ActionLoginRefused = "login.refused"
)

type clientDetail struct {
	Client string `json:"client"`
}

func loginSuccess(userID, clientID string) storage.AppendAuditInput {
	detail, _ := json.Marshal(clientDetail{Client: clientID})
	return storage.AppendAuditInput{Actor: userID, Action: ActionLoginSuccess, Subject: userID, Detail: string(detail)}
}

func refusalsOrOwn(c *refusalcap.Cap, store *storage.Store, now func() time.Time, logger *slog.Logger) *refusalcap.Cap {
	if c != nil {
		return c
	}
	return refusalcap.New(store, now, logger)
}

func (v *Verifier) loginRefused(ctx context.Context, clientID string, err error) {
	var wrong *identity.WrongPassword
	if !errors.As(err, &wrong) {
		return
	}
	detail, _ := json.Marshal(clientDetail{Client: clientID})
	v.deps.refusals.Refused(ctx, storage.AppendAuditInput{Actor: "system", Action: ActionLoginRefused, Subject: wrong.UserID, Detail: string(detail)})
}