package sessionapi

import (
	"encoding/json"
	"net/http"

	"github.com/itworx/pulse/internal/auth"
	"github.com/itworx/pulse/internal/problem"
)

type Permissions struct {
	View    bool `json:"view"`
	Operate bool `json:"operate"`
	Edit    bool `json:"edit"`
	Admin   bool `json:"admin"`
}

type Response struct {
	Subject     string      `json:"subject"`
	Role        auth.Role   `json:"role"`
	Environment string      `json:"environment"`
	Permissions Permissions `json:"permissions"`
}

type Handler struct {
	Environment string
}

func (handler Handler) ServeHTTP(response http.ResponseWriter, request *http.Request) {
	response.Header().Set("Cache-Control", "private, no-store")
	if request.Method != http.MethodGet {
		problem.Write(response, request, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "Method not allowed", "Only GET is supported for the session capability view.", nil)
		return
	}
	principal, ok := auth.PrincipalFromContext(request.Context())
	if !ok {
		problem.Write(response, request, http.StatusUnauthorized, "UNAUTHORIZED", "Authentication required", "An authenticated Pulse session is required.", nil)
		return
	}
	payload := Response{
		Subject:     principal.Subject,
		Role:        principal.Role,
		Environment: handler.Environment,
		Permissions: Permissions{
			View:    auth.Allows(principal.Role, auth.PermissionView),
			Operate: auth.Allows(principal.Role, auth.PermissionOperate),
			Edit:    auth.Allows(principal.Role, auth.PermissionEdit),
			Admin:   auth.Allows(principal.Role, auth.PermissionAdmin),
		},
	}
	response.Header().Set("Content-Type", "application/json")
	_ = json.NewEncoder(response).Encode(payload)
}