package signin

import (
	"errors"
	"net/http"

	"tug/internal/transport/web"
)

func (l login) proof(r *http.Request, state string) string {
	return l.rp.LoginProof(r, state)
}

func (l login) Resume(w http.ResponseWriter, r *http.Request, state string) (string, error) {
	old := l.proof(r, state)
	if old == "" {
		return l.establishClaim(w, r, state)
	}
	claim, err := l.v.Claim(r.Context(), state, old)
	if err != nil {
		if errors.Is(err, web.ErrLoginElsewhere) || errors.Is(err, web.ErrLoginExpired) {
			l.rp.ClearLogin(w, state)
		}
		return "", err
	}
	target, err := l.resume(w, r, claim)
	if claim.Silent && (errors.Is(err, web.ErrNoSession) || errors.Is(err, web.ErrLoginRequired)) {
		target, err = l.v.LoginRequired(r.Context(), state, claim.Proof)
	}
	if err == nil {
		l.rp.ClearLogin(w, state)
	}
	return target, err
}

func (l login) establishClaim(w http.ResponseWriter, r *http.Request, state string) (string, error) {
	if web.IsLoginClaim(r) {
		target, silent, err := l.v.LoginRequiredUnclaimed(r.Context(), state)
		if err != nil {
			return "", err
		}
		if !silent {
			return "", web.ErrLoginCookie
		}
		return target, nil
	}
	req, err := l.v.Unclaimed(r.Context(), state)
	if err != nil {
		return "", err
	}
	_, session := l.rp.SessionSecret(r)
	browser := ensureBrowser(w, r)
	if !l.rp.SetLogin(w, r, state, l.rp.LoginProofFor(state, browser), req.Expiry, !req.Silent && !session) {
		return "", web.ErrLoginExpired
	}
	return "", web.ErrLoginClaim
}