package app

import (
	"net/http"
	"strings"

	"github.com/gin-gonic/gin"

	"github.com/tidbcloud/AgentTeam/internal/api"
)

func ensureRuntimeRouteWorkspace(ctx *gin.Context, authenticatedWorkspaceID string) bool {
	routeWorkspaceID, ok := api.CanonicalRouteWorkspaceID(ctx)
	if !ok {
		api.Error(ctx, http.StatusBadRequest, "Invalid route workspace identity")
		return false
	}
	if routeWorkspaceID == strings.TrimSpace(authenticatedWorkspaceID) {
		return true
	}
	api.ErrorWorkspaceOwnerMismatch(ctx)
	return false
}

func bearerTokenFromRequest(ctx *gin.Context) (string, bool) {
	raw := strings.TrimSpace(ctx.GetHeader("Authorization"))
	if raw == "" {
		return "", false
	}
	parts := strings.Fields(raw)
	if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
		return "", false
	}
	token := strings.TrimSpace(parts[1])
	if token == "" {
		return "", false
	}
	return token, true
}