package kmsvc

import (
	"context"

	"google.golang.org/grpc"
	"google.golang.org/grpc/metadata"
)

// TokenSource supplies a bearer token for each outgoing call. Implementations
// must be safe for concurrent use.
type TokenSource interface {
	Token(ctx context.Context) (string, error)
}

// StaticToken is a TokenSource that always returns the same token. Useful for
// tests and one-off scripts; not suitable for long-lived processes since the
// token is never refreshed.
type StaticToken string

func (t StaticToken) Token(ctx context.Context) (string, error) {
	return string(t), nil
}

// authUnaryInterceptor attaches the bearer token to outgoing gRPC metadata.
func authUnaryInterceptor(source TokenSource) grpc.UnaryClientInterceptor {
	return func(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
		tok, err := source.Token(ctx)
		if err != nil {
			return err
		}
		ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+tok)
		return invoker(ctx, method, req, reply, cc, opts...)
	}
}

func authStreamInterceptor(source TokenSource) grpc.StreamClientInterceptor {
	return func(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
		tok, err := source.Token(ctx)
		if err != nil {
			return nil, err
		}
		ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+tok)
		return streamer(ctx, desc, cc, method, opts...)
	}
}