package signin

import (
	"errors"
	"fmt"
	"net/http"

	"tug/internal/service/session"
	transporthttp "tug/internal/transport/http"
	"tug/internal/transport/oidcrp"
	"tug/internal/transport/web"
)

func (l login) openAccount(w http.ResponseWriter, r *http.Request, userID, via, client string, epoch int64, browser string) error {
	ctx := r.Context()
	if secret, ok := l.rp.SessionSecret(r); ok {
		old, err := l.s.Resolve(ctx, secret, l.host)
		if err == nil {
			err = l.s.Revoke(ctx, old)
		}
		if err != nil && !errors.Is(err, session.ErrNoSession) {
			return fmt.Errorf("%w: replace the account session: %w", web.ErrLoginBusy, err)
		}
	}
	c := transporthttp.ClientOf(ctx)
	secret, p, err := l.s.Open(ctx, session.OpenInput{UserID: userID, Host: l.host, Via: via, ClientID: client, Epoch: &epoch, Browser: browser, Address: c.Addr, UserAgent: c.UserAgent})
	if errors.Is(err, session.ErrNoSession) {
		return fmt.Errorf("%w: open the account session: %w", web.ErrLoginStale, err)
	}
	if err != nil {
		return fmt.Errorf("%w: open the account session: %w", web.ErrLoginBusy, err)
	}
	l.rp.SetSession(w, secret, oidcrp.Session{UserID: p.UserID, Expires: p.ExpiresAt})
	return nil
}