package authidentity

import "encoding/base64"

const sessionTokenByteLength = 32

// SessionAuthorizationStatus classifies only AgentTeam's canonical session wire
// form. It deliberately knows nothing about routes or other credential types.
type SessionAuthorizationStatus uint8

const (
	SessionAuthorizationMissing SessionAuthorizationStatus = iota
	SessionAuthorizationMalformed
	SessionAuthorizationValid
)

// ParseSessionAuthorization validates the original Authorization field values.
// A valid value is one Bearer field containing the canonical RawURLEncoding of
// the 32 random bytes used by AgentTeam session issuance.
func ParseSessionAuthorization(values []string) (string, SessionAuthorizationStatus) {
	if len(values) == 0 {
		return "", SessionAuthorizationMissing
	}
	if len(values) != 1 {
		return "", SessionAuthorizationMalformed
	}
	value := values[0]
	const prefixLength = len("Bearer")
	if len(value) <= prefixLength+1 || !asciiEqualFoldBearer(value[:prefixLength]) || value[prefixLength] != ' ' {
		return "", SessionAuthorizationMalformed
	}
	token := value[prefixLength+1:]
	decoded, err := base64.RawURLEncoding.Strict().DecodeString(token)
	if err != nil || len(decoded) != sessionTokenByteLength || base64.RawURLEncoding.EncodeToString(decoded) != token {
		return "", SessionAuthorizationMalformed
	}
	return token, SessionAuthorizationValid
}

func asciiEqualFoldBearer(value string) bool {
	if len(value) != len("Bearer") {
		return false
	}
	for index, expected := range []byte("bearer") {
		actual := value[index]
		if actual >= 'A' && actual <= 'Z' {
			actual += 'a' - 'A'
		}
		if actual != expected {
			return false
		}
	}
	return true
}