#ifndef ZENBU_AUTH_HTTP_H
#define ZENBU_AUTH_HTTP_H

#include "auth/auth_store.h"
#include "dowa/dowa.h"
#include "seobeo/seobeo.h"

#define AUTH_HTTP_SESSION_COOKIE_NAME "mjj_session"

typedef enum {
  AUTH_HTTP_RESOLVE_ERROR     = -1,
  AUTH_HTTP_RESOLVE_NOT_FOUND = 0,
  AUTH_HTTP_RESOLVE_OK        = 1,
} Auth_HTTP_Resolve_Result;

typedef struct {
  Auth_User_Record    user;
  Auth_Session_Record session;
  /* Sensitive session bindings: cleanse this structure after use. */
  char token_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE];
  char csrf_token[AUTH_CRYPTO_TOKEN_SIZE];
} Auth_HTTP_Authenticated_User;

const char *Auth_HTTP_Request_Value(
    Seobeo_Request_Entry *p_request,
    const char           *key);

boolean Auth_HTTP_Parse_Cookie(
    const char *cookie_header,
    const char *name,
    char       *value_out,
    size_t      capacity);

boolean Auth_HTTP_Same_Origin(Seobeo_Request_Entry *p_request);

boolean Auth_HTTP_Derive_CSRF(
    const uint8 *cookie_secret,
    size_t       cookie_secret_length,
    const char  *binding,
    char        *csrf_out,
    size_t       csrf_capacity);

boolean Auth_HTTP_Verify_CSRF(
    Seobeo_Request_Entry *p_request,
    const uint8          *cookie_secret,
    size_t                cookie_secret_length,
    const char           *binding);

boolean Auth_HTTP_Verify_CSRF_Token(
    const uint8 *cookie_secret,
    size_t       cookie_secret_length,
    const char  *binding,
    const char  *provided_token);

/*
 * Resolve only an authenticated mjj_session user. Invalid, expired, revoked,
 * and absent sessions return NOT_FOUND. This function never creates guests.
 */
Auth_HTTP_Resolve_Result Auth_HTTP_Resolve_Authenticated_User(
    Seobeo_Request_Entry         *p_request,
    Auth_Store                   *p_store,
    const uint8                  *cookie_secret,
    size_t                        cookie_secret_length,
    int64                         current_unix,
    int64                         session_idle_ttl_secs,
    Auth_HTTP_Authenticated_User *p_user);

#endif