1use std::convert::Infallible;
2
3use axum::{
4    extract::{FromRef, FromRequestParts, OptionalFromRequestParts},
5    http::request::Parts,
6};
7use base64::Engine;
8use jsonwebtoken::{Algorithm, DecodingKey, Validation, decode};
9use serde::{Deserialize, Serialize};
10use uuid::Uuid;
11
12use gitdot_core::error::AuthorizationError;
13
14use super::{AppError, AppState};
15
16#[derive(Debug, Clone, Serialize, Deserialize)]
17struct UserClaims {
18    pub sub: String,
19    pub email: Option<String>,
20    pub exp: usize,
21    pub iat: usize,
22    pub aud: String,
23    pub role: Option<String>,
24}
25
26#[derive(Debug, Clone, PartialEq, Eq)]
27pub struct AuthenticatedUser {
28    pub id: Uuid,
29}
30
31impl<S> FromRequestParts<S> for AuthenticatedUser
32where
33    AppState: FromRef<S>,
34    S: Send + Sync,
35{
36    type Rejection = AppError;
37
38    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {
39        let app_state = AppState::from_ref(state);
40        authenticate_user(parts, &app_state)
41            .await
42            .map_err(AppError::from)
43    }
44}
45
46impl<S> OptionalFromRequestParts<S> for AuthenticatedUser
47where
48    AppState: FromRef<S>,
49    S: Send + Sync,
50{
51    type Rejection = Infallible;
52
53    async fn from_request_parts(
54        parts: &mut Parts,
55        state: &S,
56    ) -> Result<Option<Self>, Self::Rejection> {
57        let app_state = AppState::from_ref(state);
58        Ok(authenticate_user(parts, &app_state).await.ok())
59    }
60}
61
62async fn authenticate_user(
63    parts: &Parts,
64    app_state: &AppState,
65) -> Result<AuthenticatedUser, AuthorizationError> {
66    let auth_header = parts
67        .headers
68        .get("Authorization")
69        .and_then(|value| value.to_str().ok())
70        .ok_or(AuthorizationError::MissingHeader)?;
71
72    if let Some(token) = auth_header.strip_prefix("Bearer ") {
73        authenticate_with_jwt(token, app_state)
74    } else if let Some(credentials) = auth_header.strip_prefix("Basic ") {
75        authenticate_with_credential(credentials, app_state).await
76    } else {
77        Err(AuthorizationError::InvalidHeaderFormat)
78    }
79}
80
81fn authenticate_with_jwt(
82    token: &str,
83    app_state: &AppState,
84) -> Result<AuthenticatedUser, AuthorizationError> {
85    let mut validation = Validation::new(Algorithm::ES256);
86    validation.set_audience(&["authenticated"]);
87    let jwt_public_key = app_state.settings.supabase_jwt_public_key.as_bytes();
88    let key = DecodingKey::from_ec_pem(jwt_public_key)
89        .map_err(|e| AuthorizationError::InvalidPublicKey(e.to_string()))?;
90
91    let token_data = decode::<UserClaims>(token, &key, &validation)
92        .map_err(|e| AuthorizationError::InvalidToken(e.to_string()))?;
93
94    let id = Uuid::parse_str(&token_data.claims.sub)
95        .map_err(|e| AuthorizationError::InvalidToken(e.to_string()))?;
96
97    Ok(AuthenticatedUser { id })
98}
99
100async fn authenticate_with_credential(
101    credentials: &str,
102    app_state: &AppState,
103) -> Result<AuthenticatedUser, AuthorizationError> {
104    let decoded = base64::engine::general_purpose::STANDARD
105        .decode(credentials)
106        .map_err(|_| AuthorizationError::Unauthorized)?;
107
108    let credential_str =
109        String::from_utf8(decoded).map_err(|_| AuthorizationError::Unauthorized)?;
110
111    let (_username, token) = credential_str
112        .split_once(':')
113        .ok_or(AuthorizationError::Unauthorized)?;
114
115    let user_id = app_state
116        .oauth_service
117        .validate_token(token)
118        .await
119        .map_err(|_| AuthorizationError::Unauthorized)?;
120
121    Ok(AuthenticatedUser { id: user_id })
122}
123