package scim

import (
	"context"
	"strings"

	"github.com/tidbcloud/account/commons/database"
	"github.com/tidbcloud/account/internel/dao"
	"github.com/tidbcloud/account/internel/dao/entity"
	"github.com/tidbcloud/tiinf/monitor/tilog"
	"go.uber.org/zap"
)

func checkEmailDomainForScimProvision(ctx context.Context, orgID uint64, userEmail string) (string, error) {
	authMethods, err := dao.GetDaoHub().OrgAuthMethod.ListOrgAuthMethodsByOrgID(ctx, database.DBConn.DB, orgID)
	if err != nil {
		tilog.Error(ctx, "CheckEmailDomainForScimProvision list org auth methods error", zap.Any("org_id", orgID), zap.Any("err", err))
		return "", err
	}
	var authMethod *entity.OrgAuthMethod
	for _, am := range authMethods {
		if am.Type == entity.AuthMethodTypeSAML {
			authMethod = &am
			break
		}
	}
	if authMethod == nil || authMethod.Status != entity.Enable || !authMethod.ScimProvision {
		return "scim provision is not enabled", nil
	}

	tilog.Info(ctx, "CheckEmailDomainForScimProvision get allow email list and user email", zap.Any("org_id", orgID), zap.Any("allow_email_list", authMethod.AllowEmailDomain), zap.Any("user_email", userEmail))

	if authMethod.AllowEmailDomain == "" {
		return "", nil
	}

	allowDs := strings.Split(authMethod.AllowEmailDomain, ",")
	for _, allowD := range allowDs {
		if strings.HasSuffix(userEmail, allowD) {
			return "", nil
		}
	}
	return "email is not in the allow domain", nil
}