1use async_trait::async_trait;
2use chrono::{Duration, Utc};
3use uuid::Uuid;
4
5use crate::dto::{
6    AuthorizeDeviceRequest, DeviceCodeRequest, DeviceCodeResponse, PollTokenRequest, TokenResponse,
7};
8use crate::error::OAuthError;
9use crate::model::DeviceAuthorizationStatus;
10use crate::repository::{OAuthRepository, OAuthRepositoryImpl, UserRepository, UserRepositoryImpl};
11use crate::util::oauth::{
12    DEVICE_CODE_EXPIRY_MINUTES, POLLING_INTERVAL_SECONDS, generate_access_token,
13    generate_device_code, generate_user_code, hash_token,
14};
15
16#[async_trait]
17pub trait OAuthService: Send + Sync + 'static {
18    async fn request_device_code(
19        &self,
20        request: DeviceCodeRequest,
21    ) -> Result<DeviceCodeResponse, OAuthError>;
22
23    async fn poll_token(&self, request: PollTokenRequest) -> Result<TokenResponse, OAuthError>;
24
25    async fn authorize_device(&self, request: AuthorizeDeviceRequest) -> Result<(), OAuthError>;
26
27    async fn validate_token(&self, token: &str) -> Result<Uuid, OAuthError>;
28}
29
30#[derive(Debug, Clone)]
31pub struct OAuthServiceImpl<R, U>
32where
33    R: OAuthRepository,
34    U: UserRepository,
35{
36    oauth_repo: R,
37    user_repo: U,
38}
39
40impl OAuthServiceImpl<OAuthRepositoryImpl, UserRepositoryImpl> {
41    pub fn new(oauth_repo: OAuthRepositoryImpl, user_repo: UserRepositoryImpl) -> Self {
42        Self {
43            oauth_repo,
44            user_repo,
45        }
46    }
47}
48
49#[async_trait]
50impl<R, U> OAuthService for OAuthServiceImpl<R, U>
51where
52    R: OAuthRepository,
53    U: UserRepository,
54{
55    async fn request_device_code(
56        &self,
57        request: DeviceCodeRequest,
58    ) -> Result<DeviceCodeResponse, OAuthError> {
59        let device_code = generate_device_code();
60        let user_code = generate_user_code();
61        let expires_at = Utc::now() + Duration::minutes(DEVICE_CODE_EXPIRY_MINUTES);
62
63        self.oauth_repo
64            .create_device_authorization(&device_code, &user_code, &request.client_id, expires_at)
65            .await?;
66
67        Ok(DeviceCodeResponse {
68            device_code,
69            user_code,
70            verification_uri: request.verification_uri,
71            expires_in: (DEVICE_CODE_EXPIRY_MINUTES * 60) as u64,
72            interval: POLLING_INTERVAL_SECONDS,
73        })
74    }
75
76    async fn poll_token(&self, request: PollTokenRequest) -> Result<TokenResponse, OAuthError> {
77        let device_auth = self
78            .oauth_repo
79            .get_device_authorization_by_device_code(&request.device_code)
80            .await?
81            .ok_or(OAuthError::InvalidDeviceCode)?;
82
83        if device_auth.expires_at < Utc::now()
84            && device_auth.status == DeviceAuthorizationStatus::Pending
85        {
86            self.oauth_repo
87                .expire_device_authorization(device_auth.id)
88                .await?;
89            return Err(OAuthError::ExpiredToken);
90        }
91
92        match device_auth.status {
93            DeviceAuthorizationStatus::Pending => {
94                return Err(OAuthError::AuthorizationPending);
95            }
96            DeviceAuthorizationStatus::Expired => {
97                return Err(OAuthError::ExpiredToken);
98            }
99            DeviceAuthorizationStatus::Authorized => {
100                let user_id = device_auth
101                    .user_id
102                    .ok_or(OAuthError::InvalidRequest("Missing user_id".to_string()))?;
103
104                let user = self
105                    .user_repo
106                    .get_by_id(user_id)
107                    .await
108                    .map_err(|e| OAuthError::InvalidRequest(e.to_string()))?
109                    .ok_or(OAuthError::InvalidRequest("User not found".to_string()))?;
110
111                let access_token = generate_access_token();
112                let token_hash = hash_token(&access_token);
113
114                self.oauth_repo
115                    .create_access_token(user_id, &device_auth.client_id, &token_hash)
116                    .await?;
117
118                self.oauth_repo
119                    .expire_device_authorization(device_auth.id)
120                    .await?;
121
122                Ok(TokenResponse {
123                    access_token,
124                    user_name: user.name,
125                    user_email: user.email,
126                })
127            }
128        }
129    }
130
131    async fn authorize_device(&self, request: AuthorizeDeviceRequest) -> Result<(), OAuthError> {
132        self.oauth_repo
133            .authorize_device(&request.user_code, request.user_id)
134            .await?
135            .ok_or(OAuthError::InvalidUserCode(
136                "User code not found".to_string(),
137            ))?;
138
139        Ok(())
140    }
141
142    async fn validate_token(&self, token: &str) -> Result<Uuid, OAuthError> {
143        let token_hash = hash_token(token);
144
145        let access_token = self
146            .oauth_repo
147            .get_access_token_by_hash(&token_hash)
148            .await?
149            .ok_or(OAuthError::AccessDenied)?;
150
151        self.oauth_repo.touch_access_token(access_token.id).await?;
152
153        Ok(access_token.user_id)
154    }
155}
156