package com.airlock.iam.oauth2.domain.model.authentication;

import com.airlock.iam.base.api.domain.model.plugin.LogicForConfig;
import com.airlock.iam.elog.api.ELogger;
import com.airlock.iam.elog.api.ELoggerFactory;
import com.airlock.iam.flow.api.domain.model.flow.FlowResult;
import com.airlock.iam.flow.api.domain.model.step.GenericStepError;
import com.airlock.iam.oauth2.application.configuration.OpenIdConnectUsernameLoginHintFlowConfig;
import jakarta.inject.Inject;

@LogicForConfig(OpenIdConnectUsernameLoginHintFlowConfig.class)
public final class OpenIdConnectUsernameLoginHintFlowHandler implements OpenIdConnectLoginHintFlowHandler {
   private static final ELogger LOG = ELoggerFactory.getLogger(OpenIdConnectUsernameLoginHintFlowHandler.class);
   private static final String USERNAME_HINT_ADDITIONAL_ATTR_KEY = "usernameHint";
   private final OpenIdConnectUsernameLoginHintFlowConfig config;

   @Inject
   public OpenIdConnectUsernameLoginHintFlowHandler(OpenIdConnectUsernameLoginHintFlowConfig config) {
      this.config = config;
   }

   @Override
   public void beforeAccess(OpenIdConnectLoginHint loginHint) {
   }

   @Override
   public void afterAccess(FlowResult flowResult, OpenIdConnectLoginHint loginHint) {
      if (flowResult.error().filter(e -> e.equals(GenericStepError.NOT_AUTHORIZED)).isPresent()) {
         if (this.config.getUsernamePattern().matcher(loginHint.getLoginHint()).matches()) {
            flowResult.additionalAttributes().put("usernameHint", loginHint.getLoginHint());
         } else {
            LOG.debug("The requested OIDC login_hint does not match the allowed username pattern and is therefore ignored.");
         }
      }
   }
}