using Microsoft.AspNetCore.Authorization;

namespace Microsoft.SelfService.Portal.Core.API.Authorization
{
    public static class AuthorizationServiceCollectionExtensions
    {
        public static IServiceCollection AddSelfServicePortalAuthorization(this IServiceCollection services)
        {
            services.AddAuthorization(options =>
            {
                options.FallbackPolicy = options.DefaultPolicy;

                AddScopePolicy(options, ApiPolicies.ConfigurationRead, ApiScopes.ConfigurationRead, ApiScopes.ConfigurationWrite);
                AddScopePolicy(options, ApiPolicies.ConfigurationWrite, ApiScopes.ConfigurationWrite);
                AddScopePolicy(options, ApiPolicies.CredentialRead, ApiScopes.CredentialRead, ApiScopes.CredentialWrite, ApiScopes.CredentialResolve);
                AddScopePolicy(options, ApiPolicies.CredentialWrite, ApiScopes.CredentialWrite);
                AddScopePolicy(options, ApiPolicies.CredentialResolve, ApiScopes.CredentialResolve);
                AddScopePolicy(options, ApiPolicies.DeploymentRead, ApiScopes.DeploymentRead, ApiScopes.DeploymentWrite);
                AddScopePolicy(options, ApiPolicies.DeploymentWrite, ApiScopes.DeploymentWrite);
                AddScopePolicy(options, ApiPolicies.QueueRead, ApiScopes.QueueRead, ApiScopes.QueueProcess);
                AddScopePolicy(options, ApiPolicies.QueueProcess, ApiScopes.QueueProcess);
                AddScopePolicy(options, ApiPolicies.TemplateRead, ApiScopes.TemplateRead, ApiScopes.TemplateWrite);
                AddScopePolicy(options, ApiPolicies.TemplateWrite, ApiScopes.TemplateWrite);
                AddScopePolicy(options, ApiPolicies.TokenManage, ApiScopes.TokenManage, ApiScopes.TokenAdmin);
                AddScopePolicy(options, ApiPolicies.TokenAdmin, ApiScopes.TokenAdmin);
            });

            return services;
        }

        private static void AddScopePolicy(AuthorizationOptions options, string policyName, params string[] acceptedScopes)
        {
            options.AddPolicy(policyName, policy => policy.RequireAssertion(context =>
            {
                if (context.User.Identity?.IsAuthenticated != true)
                {
                    return false;
                }

                var tokenScopes = context.User.FindAll("scope").Select(claim => claim.Value).ToList();
                if (tokenScopes.Count == 0)
                {
                    return true;
                }

                return acceptedScopes.Any(scope => tokenScopes.Contains(scope, StringComparer.OrdinalIgnoreCase));
            }));
        }
    }
}