// A cookie session store based on https://lucia-auth.com/ examples which is recommended from Svelte's docs
// Creates a cookie that links to a session store inside the database allowing the atproto oauth session to be loaded

import { db } from "./db";
import { atpOAuthClient } from "./atproto/client";
import { encodeBase32LowerCaseNoPadding, encodeHexLowerCase } from "@oslojs/encoding";
import { sha256 } from "@oslojs/crypto/sha2";
import { DAY } from "@atproto/common";
import { sessionStore } from "$lib/server/db/schema";
import type { RequestEvent } from "@sveltejs/kit";
import { eq } from "drizzle-orm";
import { Agent } from "@atproto/api";
import type { NodeOAuthClient } from "@atproto/oauth-client-node";
import { logger } from "$lib/server/logger";

export class SessionRestorationError extends Error {
  constructor(message: string) {
    super(message);
    this.name = "SessionRestorationError";
  }
}

// This is a sliding expiration for the cookie session. Can change it if you want it to be less or more.
// The actual atproto session goes for a while if it's a confidential client as long as it's refreshed
// https://atproto.com/specs/oauth#tokens-and-session-lifetime
const DEFAULT_EXPIRY = 30 * DAY;

const NULL_SESSION_RESPONSE = { atpAgent: null, did: null, handle: null };

export class Session {
  db: typeof db;
  atpOAuthClient: NodeOAuthClient;

  constructor(database: typeof db, oauthClient: NodeOAuthClient) {
    this.db = database;
    this.atpOAuthClient = oauthClient;
  }

  async validateSessionToken(token: string): Promise<SessionValidationResult> {
    const sessionId = encodeHexLowerCase(sha256(new TextEncoder().encode(token)));
    const result = await this.db
      .select()
      .from(sessionStore)
      .where(eq(sessionStore.id, sessionId))
      .limit(1);
    if (result.length > 1) {
      throw new Error("Multiple sessions found for token. Should not happen");
    }
    if (result.length === 0) {
      return NULL_SESSION_RESPONSE;
    }
    const session = result[0];

    if (Date.now() >= session.expiresAt.getTime()) {
      await this.invalidateSession(session.id);
      logger.warn(`Session expired for the did: ${session.did}`);
      return NULL_SESSION_RESPONSE;
    }
    if (Date.now() >= session.expiresAt.getTime() - 1000 * 60 * 60 * 24 * 15) {
      session.expiresAt = new Date(Date.now() + DEFAULT_EXPIRY);
      await this.db.update(sessionStore).set(session).where(eq(sessionStore.id, sessionId));
    }
    try {
      const oAuthSession = await this.atpOAuthClient.restore(session.did);

      const agent = new Agent(oAuthSession);
      return { atpAgent: agent, did: session.did, handle: session.handle };
    } catch (err) {
      const errorMessage = (err as Error).message;
      logger.warn(`Error restoring session for did: ${session.did}, error: ${errorMessage}`);
      //Counting any error when restoring a session as a failed session resume and deleting the users web browser session
      //You can go further and capture different types of errors
      await this.invalidateUserSessions(session.did);
      throw new SessionRestorationError(
        `Failed to restore your session: ${errorMessage}. Please log in again.`
      );
    }
  }

  private setSessionTokenCookie(event: RequestEvent, token: string, expiresAt: Date): void {
    event.cookies.set("session", token, {
      httpOnly: true,
      path: "/",
      secure: import.meta.env.PROD,
      sameSite: "lax",
      expires: expiresAt
    });
  }

  deleteSessionTokenCookie(event: RequestEvent): void {
    event.cookies.set("session", "", {
      httpOnly: true,
      path: "/",
      secure: import.meta.env.PROD,
      sameSite: "lax",
      maxAge: 0
    });
  }

  async invalidateSession(sessionId: string) {
    await this.db.delete(sessionStore).where(eq(sessionStore.id, sessionId));
  }

  async invalidateSessionByToken(token: string) {
    const sessionId = encodeHexLowerCase(sha256(new TextEncoder().encode(token)));
    await this.invalidateSession(sessionId);
  }

  async invalidateUserSessions(did: string) {
    await this.db.delete(sessionStore).where(eq(sessionStore.did, did));
  }

  private async createSession(token: string, did: string, handle: string) {
    const sessionId = encodeHexLowerCase(sha256(new TextEncoder().encode(token)));
    const expiresAt = new Date(Date.now() + DEFAULT_EXPIRY);
    const session = { id: sessionId, did, handle, expiresAt, createdAt: new Date() };
    await this.db.insert(sessionStore).values(session);
    return session;
  }

  private generateSessionToken(): string {
    const tokenBytes = new Uint8Array(20);
    crypto.getRandomValues(tokenBytes);
    return encodeBase32LowerCaseNoPadding(tokenBytes);
  }

  async createAndSetSession(event: RequestEvent, did: string, handle: string) {
    const token = this.generateSessionToken();
    const session = await this.createSession(token, did, handle);
    this.setSessionTokenCookie(event, token, session.expiresAt);
    return session;
  }

  async getSessionFromRequest(event: RequestEvent): Promise<SessionValidationResult> {
    const token = event.cookies.get("session");
    if (!token) {
      return NULL_SESSION_RESPONSE;
    }
    try {
      return await this.validateSessionToken(token);
    } catch (err) {
      //We delete the cookie on any error and pass along the error
      this.deleteSessionTokenCookie(event);
      throw err;
    }
  }
}

type SessionValidationResult =
  | { atpAgent: Agent; did: string; handle: string }
  | { atpAgent: null; did: null; handle: null };

let sessionManager: Promise<Session> | null = null;

export const getSessionManager = async (): Promise<Session> => {
  if (!sessionManager) {
    sessionManager = (async () => {
      const client = await atpOAuthClient();
      return new Session(db, client);
    })();
  }
  return sessionManager;
};