using Tiku.Application.Auth;
using Tiku.Domain.Tenancy;

namespace Tiku.Infrastructure.Auth;

internal sealed class SelfHostedIdentityProvider(IAuthService authService) : IIdentityProvider
{
    public async Task<IdentityProviderResult> AuthenticateAsync(
        IdentityProviderRequest request,
        CancellationToken cancellationToken = default)
    {
        var provider = request.Provider.Trim().ToLowerInvariant().Replace("-", "_", StringComparison.Ordinal);
        var authenticated = provider switch
        {
            "password" => await authService.LoginWithPasswordAsync(
                new PasswordLoginRequest(
                    AuthRealm.Tenant,
                    request.TenantId,
                    request.Identifier,
                    request.Secret,
                    request.IpAddress,
                    request.UserAgent),
                cancellationToken),
            "sms" => await authService.LoginWithSmsAsync(
                new SmsLoginRequest(
                    AuthRealm.Tenant,
                    request.TenantId,
                    request.Identifier,
                    request.Secret,
                    request.IpAddress,
                    request.UserAgent),
                cancellationToken),
            "wechat_web" => await authService.LoginWithWechatWebAsync(
                new WechatLoginRequest(
                    AuthRealm.Tenant,
                    request.TenantId,
                    request.Secret,
                    request.IpAddress,
                    request.UserAgent),
                cancellationToken),
            "wechat_miniapp" => await authService.LoginWithWechatMiniAppAsync(
                new WechatLoginRequest(
                    AuthRealm.Tenant,
                    request.TenantId,
                    request.Secret,
                    request.IpAddress,
                    request.UserAgent),
                cancellationToken),
            _ => throw new AuthProviderNotConfiguredException(provider)
        };

        var user = authenticated.User ?? throw new InvalidAuthChallengeException("interactive_authentication_required");

        return new IdentityProviderResult(
            provider,
            user.UserId.ToString("N"),
            user.Phone,
            user.Email,
            user.Name);
    }
}