package ldap

import (
	"context"
	"log/slog"
	"net/netip"
	"time"

	"tug/internal/service/refusalcap"
	"tug/internal/storage"
)

const (
	ActionBindRefused = "ldap.bind_refused"
	bindAuditTimeout  = 5 * time.Second
)

func (s *Server) auditBind(addr netip.Addr, result, userID string) {
	if userID == "" {
		return
	}
	ctx, cancel := context.WithTimeout(s.ctx, bindAuditTimeout)
	defer cancel()
	switch {
	case result == bindRejected:
		s.refusal.Refused(ctx, storage.AppendAuditInput{Actor: "system", Action: ActionBindRefused, Subject: userID, Address: addr})
	case result == bindAccepted && s.binds.first(userID, addr):
		s.refusal.Succeeded(ctx, storage.AppendAuditInput{Actor: userID, Action: ActionBind, Subject: userID, Address: addr})
	}
}

func refusalsOrOwn(c *refusalcap.Cap, store *storage.Store, logger *slog.Logger) *refusalcap.Cap {
	if c != nil {
		return c
	}
	return refusalcap.New(store, time.Now, logger)
}