Authentication

use std::sync::Arc;
use lilyrs::websocket::{AuthenticatedWebSocketIdentity, ExecutionCancellation, Extensions,
    HeaderValue, Principal, WsAppBuilder, async_trait};
use lilyrs::websocket::middleware::{MiddlewareDescriptor, MiddlewareErrorCode, MiddlewareKind,
    WebSocketIdentity, WebSocketIdentityMiddleware, WsHandshakeExchange,
    WsHandshakeRejection, WsMiddlewareInitError};

#[derive(Clone)]
pub struct TenantId(pub String);
pub struct VerifiedSession {
    pub principal: Principal,
    pub tenant: TenantId,
    pub expires_at: tokio::time::Instant,
}

// The application binds this interface to its real verifier through DI.
// This service owns signature, issuer/audience, expiry and session revocation checks.
#[async_trait]
pub trait SessionVerifier: Send + Sync {
    async fn verify(&self, authorization: &str) -> Option<VerifiedSession>;
}

pub struct SessionIdentity;
fn unauthorized() -> WsHandshakeRejection {
    WsHandshakeRejection::unauthorized(
        MiddlewareErrorCode::new("AUTH_REQUIRED").expect("sabit kod"),
        HeaderValue::from_static("Bearer"),
    ).expect("geçerli challenge")
}
fn unavailable() -> WsHandshakeRejection {
    WsHandshakeRejection::try_new(503,
        MiddlewareErrorCode::new("AUTH_UNAVAILABLE").expect("sabit kod"),
    ).expect("geçerli durum")
}

#[async_trait]
impl WebSocketIdentityMiddleware for SessionIdentity {
    async fn new(_: Arc<Extensions>) -> Result<Self, WsMiddlewareInitError> { Ok(Self) }
    fn descriptor(&self) -> MiddlewareDescriptor {
        MiddlewareDescriptor::new("session_identity", MiddlewareKind::WebSocketHandshake)
    }
    async fn identify(&self, exchange: &mut WsHandshakeExchange,
        cancellation: ExecutionCancellation) -> Result<WebSocketIdentity, WsHandshakeRejection>
    {
        let authorization = exchange.request().headers().get_custom_header("authorization")
            .ok_or_else(unauthorized)?.to_owned();
        let verifier = exchange.service::<dyn SessionVerifier>().await
            .map_err(|_| unavailable())?;
        let verified = tokio::select! {
            biased;
            _ = cancellation.cancelled() => return Err(unavailable()),
            result = verifier.verify(&authorization) => result.ok_or_else(unauthorized)?,
        };
        let authenticated = AuthenticatedWebSocketIdentity::try_new(verified.principal)
            .map_err(|_| unavailable())?.expires_at(verified.expires_at);
        let mut identity = WebSocketIdentity::authenticated(authenticated);
        identity.insert_connection_local(verified.tenant).map_err(|_| unavailable())?;
        Ok(identity)
    }
}
pub fn with_identity(builder: WsAppBuilder) -> WsAppBuilder {
    builder.identity_middleware::<SessionIdentity>()
}