package oauth

import (
	"context"
	"encoding/json"
	"fmt"
	"io"
	"net/http"

	"golang.org/x/oauth2"
	"golang.org/x/oauth2/github"
)

type githubEmail struct {
	Email      string `json:"email"`
	Primary    bool   `json:"primary"`
	Verified   bool   `json:"verified"`
	Visibility string `json:"visibility"`
}

func githubEmailResolver(ctx context.Context, nonce string, token *oauth2.Token) (string, bool, error) {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://api.github.com/user/emails", nil)
	if err != nil {
		return "", false, err
	}
	req.Header.Set("Authorization", fmt.Sprintf("token %s", token.AccessToken))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return "", false, err
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", false, err
	}

	emails := []githubEmail{}
	if err := json.Unmarshal(body, &emails); err != nil {
		return "", false, err
	}

	for _, email := range emails {
		if email.Verified && email.Primary {
			return email.Email, true, nil
		}
	}

	for _, email := range emails {
		if email.Verified {
			return email.Email, true, nil
		}
	}

	return "", false, fmt.Errorf("no verified primary email found")
}

func NewGithubOAuthClient(clientID, clientSecret, redirectURL string) OAuthClient {
	return NewOAuthClient("github", &oauth2.Config{
		ClientID:     clientID,
		ClientSecret: clientSecret,
		RedirectURL:  redirectURL,
		Scopes: []string{
			"user:email",
			"openid",
		},
		Endpoint: github.Endpoint,
	}, githubEmailResolver)
}