package httpapi

import (
	"errors"
	"net/http"

	"data-terminal-cloud/internal/deviceauth"
)

type DeviceRequestVerifier interface {
	Verify(*http.Request) (deviceauth.Identity, error)
}

func DeviceAuth(verifier DeviceRequestVerifier, next http.Handler) http.Handler {
	return http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
		identity, err := verifier.Verify(request)
		if err != nil {
			if errors.Is(err, deviceauth.ErrCredentialsMissing) ||
				errors.Is(err, deviceauth.ErrCredentialInvalid) ||
				errors.Is(err, deviceauth.ErrDeviceInactive) ||
				errors.Is(err, deviceauth.ErrRequestExpired) ||
				errors.Is(err, deviceauth.ErrReplayDetected) {
				WriteError(writer, request, http.StatusUnauthorized, "DEVICE_AUTHENTICATION_FAILED", "设备身份验证失败")
				return
			}
			WriteAPIError(writer, request, http.StatusServiceUnavailable, Error{
				Code: "DEVICE_AUTHENTICATION_UNAVAILABLE", Message: "设备身份服务暂时不可用", Retryable: true,
			})
			return
		}
		next.ServeHTTP(writer, request.WithContext(deviceauth.WithIdentity(request.Context(), identity)))
	})
}