/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

package org.apache.texera.auth

import com.typesafe.scalalogging.LazyLogging
import jakarta.ws.rs.container.{ContainerRequestContext, ContainerRequestFilter, ResourceInfo}
import jakarta.ws.rs.core.{Context, HttpHeaders, SecurityContext}
import jakarta.ws.rs.ext.Provider
import org.apache.texera.dao.SqlServer
import org.apache.texera.dao.jooq.generated.Tables.USER_LAST_ACTIVE_TIME
import org.apache.texera.dao.jooq.generated.enums.UserRoleEnum

import java.security.Principal
import java.time.OffsetDateTime

@Provider
class JwtAuthFilter extends ContainerRequestFilter with LazyLogging {

  @Context
  private var resourceInfo: ResourceInfo = _
  private def ctx = SqlServer.getInstance().createDSLContext()

  override def filter(requestContext: ContainerRequestContext): Unit = {
    val authHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION)

    if (authHeader != null && authHeader.startsWith("Bearer ")) {
      val token = authHeader.substring(7) // Remove "Bearer " prefix
      val userOpt = JwtParser.parseToken(token)

      if (userOpt.isPresent) {
        val user = userOpt.get()

        ctx
          .insertInto(USER_LAST_ACTIVE_TIME)
          .set(USER_LAST_ACTIVE_TIME.UID, user.getUid)
          .set(USER_LAST_ACTIVE_TIME.LAST_ACTIVE_TIME, OffsetDateTime.now())
          .onConflict(USER_LAST_ACTIVE_TIME.UID) // conflict on primary key uid
          .doUpdate()
          .set(USER_LAST_ACTIVE_TIME.LAST_ACTIVE_TIME, OffsetDateTime.now())
          .execute()

        requestContext.setSecurityContext(new SecurityContext {
          override def getUserPrincipal: Principal = user
          override def isUserInRole(role: String): Boolean =
            user.isRoleOf(UserRoleEnum.valueOf(role))
          override def isSecure: Boolean = false
          override def getAuthenticationScheme: String = "Bearer"
        })
      } else {
        logger.warn("Invalid JWT: Unable to parse token")
      }
    }
  }
}
