package httpapi

import (
	"encoding/hex"
	"sync"

	"evobgp/internal/authkey"
	"evobgp/internal/store"
)

type firewallAuthRow struct {
	tenantID string
	clientID string
}

type firewallTokenResolver struct {
	mu     sync.RWMutex
	byHash map[string]firewallAuthRow
}

func newFirewallTokenResolver(st store.Backend) (*firewallTokenResolver, error) {
	r := &firewallTokenResolver{byHash: make(map[string]firewallAuthRow)}
	return r, r.reloadFromStore(st)
}

func (r *firewallTokenResolver) reloadFromStore(st store.Backend) error {
	rows, err := st.ListActiveFirewallClientHashes()
	if err != nil {
		return err
	}
	byHash := make(map[string]firewallAuthRow, len(rows))
	for _, row := range rows {
		if len(row.TokenHash) != 32 {
			continue
		}
		byHash[hex.EncodeToString(row.TokenHash)] = firewallAuthRow{
			tenantID: row.TenantID,
			clientID: row.ID,
		}
	}
	r.mu.Lock()
	r.byHash = byHash
	r.mu.Unlock()
	return nil
}

func (r *firewallTokenResolver) Reload(st store.Backend) error {
	return r.reloadFromStore(st)
}

func (r *firewallTokenResolver) Lookup(raw string) (firewallAuthRow, bool) {
	hash := authkey.HashToken(raw)
	r.mu.RLock()
	defer r.mu.RUnlock()
	rec, ok := r.byHash[hex.EncodeToString(hash)]
	return rec, ok
}