auth.go

package authula

import (
	"context"
	"fmt"
	"net/http"
	"sync"

	"github.com/uptrace/bun"

	"github.com/Authula/authula/internal"
	"github.com/Authula/authula/internal/migrationmanager"
	"github.com/Authula/authula/internal/plugins"
	"github.com/Authula/authula/internal/util"
	"github.com/Authula/authula/migrations"
	"github.com/Authula/authula/models"
	coreservices "github.com/Authula/authula/services"
)

type AuthConfig struct {
	Config  *models.Config
	Plugins []models.Plugin
	DB      bun.IDB
}

// Auth is a composition root and entry point for the authentication framework.
type Auth struct {
	config           *models.Config
	logger           models.Logger
	db               bun.IDB
	migrator         *migrations.Migrator
	migrationManager *migrationmanager.Manager
	router           *Router
	ServiceRegistry  models.ServiceRegistry
	PluginRegistry   models.PluginRegistry
	handlerOnce      sync.Once
	coreServices     *coreservices.CoreServices
	systems          []models.CoreSystem
	Api              internal.CoreAPI
}

// New creates a new Auth instance using the provided config and plugins.
// Handles plugin registration, migrations, and initialization in unified way.
// Works identically whether plugins are manually instantiated or built from config.
func New(authConfig *AuthConfig) *Auth {
	if authConfig == nil || authConfig.Config == nil {
		panic("auth config and auth config config must not be nil")
	}

	util.InitValidator()

	logger := InitLogger(authConfig.Config)

	db := authConfig.DB
	if db == nil {
		initializedDB, err := InitDatabase(authConfig.Config, logger, authConfig.Config.Logger.Level)
		if err != nil {
			panic(fmt.Errorf("failed to initialize database: %w", err))
		}
		db = initializedDB
	}

	migrator, err := migrations.NewMigrator(db, logger)
	if err != nil {
		panic(fmt.Errorf("failed to create migrator: %w", err))
	}

	migrationManager := migrationmanager.NewManager(migrator)

	if err := migrationManager.RunCore(context.Background(), authConfig.Config.Database.Provider); err != nil {
		panic(fmt.Errorf("failed to run core migrations: %w", err))
	}

	eventBus, err := InitEventBus(authConfig.Config)
	if err != nil {
		panic(fmt.Errorf("failed to initialize event bus: %w", err))
	}

	serviceRegistry := plugins.NewServiceRegistry()

	coreServices := InitCoreServices(authConfig.Config, db, serviceRegistry)

	pluginRegistry := plugins.NewPluginRegistry(
		authConfig.Config,
		logger,
		db,
		migrationManager,
		serviceRegistry,
		eventBus,
	)

	// Initialize PreParsedConfigs if not already done
	if authConfig.Config.PreParsedConfigs == nil {
		authConfig.Config.PreParsedConfigs = make(map[string]any)
	}

	// Initialize Plugins map if not already done
	if authConfig.Config.Plugins == nil {
		authConfig.Config.Plugins = make(models.PluginsConfig)
	}

	for _, plugin := range authConfig.Plugins {
		pluginID := plugin.Metadata().ID
		// Cache type-safe configs for all plugins
		authConfig.Config.PreParsedConfigs[pluginID] = plugin.Config()
		if !util.IsPluginEnabled(authConfig.Config, pluginID) {
			continue
		}
		if err := pluginRegistry.Register(plugin); err != nil {
			panic(fmt.Errorf("failed to register plugin: %w", err))
		}
	}

	if err := pluginRegistry.RunMigrations(context.Background()); err != nil {
		logger.Error("failed to run plugin migrations", "error", err)
		panic(fmt.Errorf("failed to run plugin migrations: %w", err))
	}

	if err := pluginRegistry.InitAll(); err != nil {
		logger.Error("failed to initialize plugins", "error", err)
		panic(fmt.Errorf("failed to initialize plugins: %w", err))
	}

	api := internal.NewCoreAPI(logger, coreServices.UserService, coreServices.SessionService)

	systems := InitCoreSystems(logger, authConfig.Config, coreServices)
	for _, system := range systems {
		if err := system.Init(context.Background()); err != nil {
			logger.Error("failed to initialize core system", "system", system.Name(), "error", err)
			panic(err)
		}
	}

	router := NewRouter(authConfig.Config, logger, nil)

	auth := &Auth{
		config:           authConfig.Config,
		logger:           logger,
		db:               db,
		migrator:         migrator,
		migrationManager: migrationManager,
		router:           router,
		ServiceRegistry:  serviceRegistry,
		PluginRegistry:   pluginRegistry,
		coreServices:     coreServices,
		systems:          systems,
		Api:              api,
	}

	// Register middleware NOW (before any routes are registered)
	// This ensures Chi's requirement that all middleware is defined before routes
	auth.registerMiddleware()

	return auth
}

func (auth *Auth) RunCoreMigrations(ctx context.Context) error {
	if auth.migrationManager == nil {
		return fmt.Errorf("migrator not initialized")
	}
	return auth.migrationManager.RunCore(ctx, auth.config.Database.Provider)
}

func (auth *Auth) DropCoreMigrations(ctx context.Context) error {
	if auth.migrationManager == nil {
		return fmt.Errorf("migrator not initialized")
	}
	return auth.migrationManager.DropCore(ctx, auth.config.Database.Provider)
}

// registerMiddleware registers all middleware from hooks and plugins
func (auth *Auth) registerMiddleware() {
	currentConfig := auth.PluginRegistry.GetConfig()

	// Register Plugin Global Middleware
	for _, plugin := range auth.PluginRegistry.Plugins() {
		pluginID := plugin.Metadata().ID

		if !util.IsPluginEnabled(currentConfig, pluginID) {
			auth.logger.Debug("skipping disabled plugin", "plugin", pluginID)
			continue
		}

		if middlewareProvider, ok := plugin.(models.PluginWithMiddleware); ok {
			middleware := middlewareProvider.Middleware()
			if len(middleware) == 0 {
				auth.logger.Debug("no middleware functions returned", "plugin", pluginID)
				continue
			}
			auth.router.RegisterMiddleware(middleware...)
		}
	}
}

// RegisterMiddleware registers middleware to the chi router.
// Middleware should be registered before calling Handler().
func (auth *Auth) RegisterMiddleware(middleware ...func(http.Handler) http.Handler) {
	auth.router.RegisterMiddleware(middleware...)
}

// RegisterRoute registers a single route with the basePath prefix
func (auth *Auth) RegisterRoute(route models.Route) {
	auth.router.RegisterRoute(route)
}

// RegisterRoutes registers multiple routes with the basePath prefix
func (auth *Auth) RegisterRoutes(routes []models.Route) {
	auth.router.RegisterRoutes(routes)
}

// RegisterCustomRoute registers a single custom route without the basePath prefix
// This is useful for application routes that should not be under the auth basePath
func (auth *Auth) RegisterCustomRoute(route models.Route) {
	auth.router.RegisterCustomRoute(route)
}

// RegisterCustomRouteGroup registers a route group that can have a prefix path and metadata that applies to all routes
// This is useful if many routes should share paths and or metadata
func (auth *Auth) RegisterCustomRouteGroup(group models.RouteGroup) {
	auth.router.RegisterCustomRouteGroup(group)
}

// RegisterCustomRoutes registers multiple custom routes without the basePath prefix
// This is useful for application routes that should not be under the auth basePath
func (auth *Auth) RegisterCustomRoutes(routes []models.Route) {
	auth.router.RegisterCustomRoutes(routes)
}

// RegisterHook registers a single hook to the router.
// Hooks allow developers to intercept and modify requests/responses at various stages
// of the request lifecycle (OnRequest, Before, After, OnResponse).
func (auth *Auth) RegisterHook(hook models.Hook) {
	auth.router.RegisterHook(hook)
}

// RegisterHooks registers multiple hooks to the router.
// Hooks allow developers to intercept and modify requests/responses at various stages
// of the request lifecycle (OnRequest, Before, After, OnResponse).
func (auth *Auth) RegisterHooks(hooks []models.Hook) {
	auth.router.RegisterHooks(hooks)
}

// GetUserIDFromContext retrieves the user ID from a context.
// Returns the user ID and a boolean indicating whether it was found.
// This is a convenience wrapper around models.GetUserIDFromContext to avoid
// requiring application code to import the models package.
func (auth *Auth) GetUserIDFromContext(ctx context.Context) (string, bool) {
	return models.GetUserIDFromContext(ctx)
}

// GetUserIDFromRequest retrieves the user ID from an HTTP request's context.
// Returns the user ID and a boolean indicating whether it was found.
// This is a convenience wrapper around models.GetUserIDFromRequest to avoid
// requiring application code to import the models package.
func (auth *Auth) GetUserIDFromRequest(req *http.Request) (string, bool) {
	return models.GetUserIDFromRequest(req)
}

// Handler returns the HTTP handler that serves all authentication routes and hooks.
// It registers routes and hooks from all plugins with the router.
// This is the entry point for HTTP traffic.
func (auth *Auth) Handler() http.Handler {
	auth.handlerOnce.Do(func() {
		auth.router.RegisterRoutes(
			internal.CoreRoutes(
				auth.logger,
				auth.coreServices.UserService,
				auth.coreServices.SessionService,
			),
		)

		currentConfig := auth.config

		// Convert route mappings to metadata format for plugin routing
		// This works identically whether RouteMappings come from config file or library mode
		if len(currentConfig.RouteMappings) > 0 {
			routeMetadata, err := util.ConvertRouteMetadata(currentConfig.RouteMappings)
			if err != nil {
				auth.logger.Error("failed to convert route metadata", "error", err)
			} else {
				adjustedMetadata := make(map[string]map[string]any)
				for key, metadata := range routeMetadata {
					adjustedKey := util.ApplyBasePathToMetadataKey(key, auth.router.basePath)
					adjustedMetadata[adjustedKey] = metadata
				}
				auth.router.SetRouteMetadataFromConfig(adjustedMetadata)
			}
		}

		// Register Plugin Routes
		for _, plugin := range auth.PluginRegistry.Plugins() {
			if !util.IsPluginEnabled(currentConfig, plugin.Metadata().ID) {
				continue
			}
			if routeProvider, ok := plugin.(models.PluginWithRoutes); ok {
				pluginRoutes := routeProvider.Routes()
				if len(pluginRoutes) == 0 {
					continue
				}
				auth.router.RegisterRoutes(pluginRoutes)
			}
		}

		// Register Plugin Hooks
		for _, plugin := range auth.PluginRegistry.Plugins() {
			if !util.IsPluginEnabled(currentConfig, plugin.Metadata().ID) {
				continue
			}
			if hookProvider, ok := plugin.(models.PluginWithHooks); ok {
				hooks := hookProvider.Hooks()
				if len(hooks) > 0 {
					auth.router.RegisterHooks(hooks)
				}
			}
		}
	})

	return auth.router.Handler()
}

// ClosePlugins calls Close for all registered plugins
func (auth *Auth) ClosePlugins() error {
	if auth.PluginRegistry == nil {
		return nil
	}

	auth.PluginRegistry.CloseAll()
	return nil
}

func (auth *Auth) CloseSystems() error {
	for _, system := range auth.systems {
		if err := system.Close(); err != nil {
			auth.logger.Error("failed to close core system", "system", system.Name(), "error", err)
		}
	}

	return nil
}

func (auth *Auth) DB() bun.IDB {
	if auth == nil {
		return nil
	}
	return auth.db
}

func (auth *Auth) Router() *Router {
	if auth == nil {
		return nil
	}
	return auth.router
}

func (auth *Auth) Migrator() *migrations.Migrator {
	if auth == nil {
		return nil
	}
	return auth.migrator
}

func (auth *Auth) MigrationManager() *migrationmanager.Manager {
	if auth == nil {
		return nil
	}
	return auth.migrationManager
}

func (auth *Auth) CoreServices() *coreservices.CoreServices {
	if auth == nil {
		return nil
	}
	return auth.coreServices
}