package auth

import (
	"time"

	"github.com/gin-gonic/gin"

	"github.com/tidbcloud/AgentTeam/internal/api/dto"
	"github.com/tidbcloud/AgentTeam/internal/core/secrets"
	"github.com/tidbcloud/AgentTeam/internal/service/authflow"
	"github.com/tidbcloud/AgentTeam/internal/store/identity"
)

const tokenByteLength = 32

func createAuthTokensResponse(ctx *gin.Context, authFlow AuthFlow, store Store, sessionTTL time.Duration, user identity.User, workspaceOptions authflow.DefaultWorkspaceOptions) (dto.AuthTokensResponse, error) {
	if authFlow != nil {
		if err := authFlow.EnsureDefaultWorkspace(ctx.Request.Context(), user, workspaceOptions); err != nil {
			return dto.AuthTokensResponse{}, err
		}
	}

	accessToken, err := secrets.NewToken(tokenByteLength)
	if err != nil {
		return dto.AuthTokensResponse{}, err
	}
	refreshToken, err := secrets.NewToken(tokenByteLength)
	if err != nil {
		return dto.AuthTokensResponse{}, err
	}

	now := time.Now().UTC()
	if _, err := store.CreateSessionAndRefreshToken(
		ctx.Request.Context(),
		user.ID,
		secrets.HashToken(accessToken),
		now.Add(sessionTTL),
		secrets.HashToken(refreshToken),
		now.Add(sessionTTL),
	); err != nil {
		return dto.AuthTokensResponse{}, err
	}

	return dto.AuthTokensResponse{
		AccessToken:  accessToken,
		RefreshToken: refreshToken,
		User:         userResponseFromDomain(user),
	}, nil
}