using PostFundManagement.Application.Abstractions.Services;
using static PostFundManagement.Application.Extensions.General;
using static PostFundManagement.Domain.Extensions.Constants;

namespace PostFundManagement.Application.Filters;

public sealed class ActiveUserFilter(IIdentityService identityService) : IEndpointFilter
{
    public async ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
    {
        var principal = context.HttpContext.User;

        if (principal.Identity is null || !principal.Identity.IsAuthenticated)
            return Results.Unauthorized();

        var (decoded, userId) = principal.GetUserId();
        var (emailDecoded, email) = principal.GetUserEmail();
        
        if (!decoded)
            return Results.Json(new { message = "Invalid user identifier in token." }, statusCode: StatusCodes.Status401Unauthorized);

        if (!emailDecoded)
            return Results.Json(new { message = "Invalid/missing user email in token." }, statusCode: StatusCodes.Status401Unauthorized);

        var path = context.HttpContext.Request.Path.Value;

        if (!string.IsNullOrWhiteSpace(path) && !path!.EndsWith("integration/sync", StringComparison.InvariantCultureIgnoreCase))
        {
            var userAuthResult = await identityService.UserIsAuthorisedAsync(userId, context.HttpContext.RequestAborted);

            if (userAuthResult.IsFailed)
                return Results.Json(new { message = "Account approval is pending or inactive." }, statusCode: StatusCodes.Status403Forbidden);
        }

        context.HttpContext.Items[UserIdItemKey] = userId;
        context.HttpContext.Items[EmailtemKey] = email;
        
        return await next(context);
    }
}