"""Verify caller identity for /api/pipeline/* — Bearer JWTs and/or pipeline client headers."""

from __future__ import annotations

from typing import Optional, Tuple

import jwt

from flask import request

from ..config import Config
from .mirofish_jwt import verify_mirofish_session_jwt


def verify_supabase_user_jwt(token: str) -> Tuple[Optional[str], Optional[str]]:
    """
    Returns (user_id, error_message). user_id is None on failure.
    """
    if not token or not Config.SUPABASE_JWT_SECRET:
        return None, "JWT verification not configured"
    try:
        payload = jwt.decode(
            token,
            Config.SUPABASE_JWT_SECRET,
            algorithms=["HS256"],
            audience="authenticated",
            options={"verify_exp": True},
        )
        sub = payload.get("sub")
        if not sub:
            return None, "Invalid token: missing sub"
        return str(sub), None
    except jwt.ExpiredSignatureError:
        return None, "Token expired"
    except jwt.InvalidTokenError as e:
        return None, f"Invalid token: {e}"


def extract_bearer_token() -> Optional[str]:
    h = request.headers.get("Authorization", "")
    if h.lower().startswith("bearer "):
        return h[7:].strip()
    return None


def resolve_pipeline_user_id() -> Tuple[Optional[str], Optional[str]]:
    """
    When Supabase sync is on:

    1) Authorization: Bearer <MiroFish session JWT> (optional / legacy).
    2) Authorization: Bearer <Supabase Auth JWT> if SUPABASE_JWT_SECRET is set.
    3) X-Mirofish-User-Id + X-Pipeline-Client-Secret matching PIPELINE_CLIENT_SECRET
       (Supabase public.User in browser + VITE_PIPELINE_CLIENT_SECRET).

    Returns (user_id_str, error_message).
    """
    token = extract_bearer_token()
    if token:
        m_uid, m_hint = verify_mirofish_session_jwt(token)
        if m_uid:
            return m_uid, None
        if m_hint == "expired":
            return None, "Token expired"
        if Config.SUPABASE_JWT_SECRET:
            s_uid, s_err = verify_supabase_user_jwt(token)
            if s_uid:
                return s_uid, None
            return None, s_err or "Invalid token"
        return None, "Invalid token"

    uid = (request.headers.get("X-Mirofish-User-Id") or "").strip()
    key = (request.headers.get("X-Pipeline-Client-Secret") or "").strip()
    secret = (Config.PIPELINE_CLIENT_SECRET or "").strip()
    if uid and secret and key == secret:
        return uid, None
    if uid or key:
        return None, "Invalid pipeline client credentials"
    if not secret:
        return None, "Server PIPELINE_CLIENT_SECRET is not configured"
    return None, "Missing credentials"