-module(example@middlewares).
-compile(no_auto_import).

-export([track/1, authenticate/1, must_be_admin/1]).

-spec track(
    fun((gleam@http@request:request(bitstring()), example@context:initial_context()) -> HBX)
) -> fun((gleam@http@request:request(bitstring()), example@context:initial_context()) -> HBX).
track(Handler) ->
    fun(Req, Ctx) -> Handler(Req, Ctx) end.

-spec check_token(binary()) -> {ok, boolean()} | {error, nil}.
check_token(Token) ->
    case Token =:= <<"Bearer 123"/utf8>> of
        true ->
            {ok, true};

        false ->
            {error, nil}
    end.

-spec try_authenticate(
    gleam@http@request:request(bitstring()),
    example@context:initial_context()
) -> {ok, example@context:user()} | {error, nil}.
try_authenticate(Req, _) ->
    case gleam@http@request:get_header(Req, <<"Authorization"/utf8>>) of
        {error, _try} -> {error, _try};
        {ok, Token} ->
            case check_token(Token) of
                {error, _try@1} -> {error, _try@1};
                {ok, _@1} ->
                    Role = begin
                        _pipe = gleam@http@request:get_header(
                            Req,
                            <<"User-Role"/utf8>>
                        ),
                        gleam@result:unwrap(_pipe, <<"user"/utf8>>)
                    end,
                    User = {user, <<"sam@sample.com"/utf8>>, Role},
                    {ok, User}
            end
    end.

-spec authenticate(
    fun((gleam@http@request:request(bitstring()), example@context:context_authenticated()) -> {ok,
                                                                                               gleam@http@response:response(gleam@bit_builder:bit_builder())} |
        {error, bliss:response_error()})
) -> fun((gleam@http@request:request(bitstring()), example@context:initial_context()) -> {ok,
                                                                                          gleam@http@response:response(gleam@bit_builder:bit_builder())} |
    {error, bliss:response_error()}).
authenticate(Handler) ->
    fun(Req, Ctx) -> case try_authenticate(Req, Ctx) of
            {ok, User} ->
                Context_authenticated = {context_authenticated,
                                         erlang:element(2, Ctx),
                                         User},
                Handler(Req, Context_authenticated);

            {error, _@1} ->
                {error, unauthorised}
        end end.

-spec must_be_admin(
    fun((gleam@http@request:request(bitstring()), example@context:context_authenticated()) -> {ok,
                                                                                               gleam@http@response:response(gleam@bit_builder:bit_builder())} |
        {error, bliss:response_error()})
) -> fun((gleam@http@request:request(bitstring()), example@context:context_authenticated()) -> {ok,
                                                                                                gleam@http@response:response(gleam@bit_builder:bit_builder())} |
    {error, bliss:response_error()}).
must_be_admin(Handler) ->
    fun(Req, Ctx) ->
        Is_admin = erlang:element(3, erlang:element(3, Ctx))
        =:= <<"admin"/utf8>>,
        case Is_admin of
            true ->
                Handler(Req, Ctx);

            false ->
                {error, unauthorised}
        end
    end.