import { bearerToken, DEVICE_TOKEN_HEADER } from "./device-token";

export type StorageAccessState = "none" | "inactive" | "active";

export function storageAccessState(request: Request): StorageAccessState | null {
  const raw = (request.headers.get("Sec-Fetch-Storage-Access") ?? "").trim().toLowerCase();
  if (raw === "none" || raw === "inactive" || raw === "active") return raw;
  return null;
}

export function embedderOrigin(request: Request): string | null {
  const origin = request.headers.get("Origin");
  if (origin && origin !== "null") return origin;
  const referer = request.headers.get("Referer");
  if (!referer) return null;
  try {
    return new URL(referer).origin;
  } catch {
    return null;
  }
}

export function shouldAttachSessionCookie(request: Request): boolean {
  // A native caller authenticates with its token; minting a cookie for it would
  // orphan a Durable Object nobody can reach again.
  if (bearerToken(request.headers.get(DEVICE_TOKEN_HEADER)) !== null) return false;
  const access = storageAccessState(request);
  if (access === "none" || access === "inactive") return false;
  if (access === "active") return true;
  const site = request.headers.get("Sec-Fetch-Site");
  if (site === "cross-site") return false;
  return true;
}

export function activateRetryHeaders(allowedOrigin: string): Headers {
  const headers = new Headers();
  headers.set("Activate-Storage-Access", `retry; allowed-origin="${allowedOrigin}"`);
  headers.set("Vary", "Sec-Fetch-Storage-Access");
  headers.set("cache-control", "no-store");
  return headers;
}

export function activateLoadHeaders(): Headers {
  const headers = new Headers();
  headers.set("Activate-Storage-Access", "load");
  headers.set("Vary", "Sec-Fetch-Storage-Access");
  return headers;
}

export function storageAccessRetryResponse(allowedOrigin: string): Response {
  return new Response(null, {
    status: 401,
    headers: activateRetryHeaders(allowedOrigin),
  });
}

export function withStorageAccessHeaders(request: Request, response: Response): Response {
  const access = storageAccessState(request);
  const headers = new Headers(response.headers);
  if (!headers.has("Vary")) headers.set("Vary", "Sec-Fetch-Storage-Access");
  else if (!headers.get("Vary")?.includes("Sec-Fetch-Storage-Access")) {
    headers.append("Vary", "Sec-Fetch-Storage-Access");
  }
  if (access === "active") {
    headers.set("Activate-Storage-Access", "load");
  }
  return new Response(response.body, {
    status: response.status,
    headers,
  });
}