package user

import (
	"context"
	"time"

	"git.golem15.com/golem15/summercms/modules/backpack"
	"git.golem15.com/golem15/summercms/modules/bouncer"
)

var _ bouncer.BlacklistStore = (*appBlacklist)(nil)

// appBlacklist is the blacklist store the jwt guard is built with. The guard
// is built in Boot, which under summer serve runs before the database is
// published, so the store the plugin publishes on lagoon.Publish is resolved
// on every call. While none is published, no token counts as blacklisted and
// Add and Sweep do nothing. An appBlacklist must never be published as the
// app's bouncer.BlacklistStore: the lookup would then find itself.
type appBlacklist struct {
	app *backpack.App
}

// store returns the published blacklist store, or nil when there is none
// (or the published value is an appBlacklist).
func (b *appBlacklist) store() bouncer.BlacklistStore {
	if b == nil || b.app == nil {
		return nil
	}
	s, ok := b.app.Lookup[bouncer.BlacklistStore]()
	if !ok || s == nil {
		return nil
	}
	if _, self := s.(*appBlacklist); self {
		return nil
	}
	return s
}

func (b *appBlacklist) Add(ctx context.Context, jti string, expiresAt, validUntil time.Time) error {
	s := b.store()
	if s == nil {
		return nil
	}
	return s.Add(ctx, jti, expiresAt, validUntil)
}

func (b *appBlacklist) IsBlacklisted(ctx context.Context, jti string) (bool, error) {
	s := b.store()
	if s == nil {
		return false, nil
	}
	return s.IsBlacklisted(ctx, jti)
}

func (b *appBlacklist) Sweep(ctx context.Context, now time.Time) error {
	s := b.store()
	if s == nil {
		return nil
	}
	return s.Sweep(ctx, now)
}