package domain

import (
	"fmt"
	"time"
)

// WorkloadCredential is the claim set extracted from a projected service
// account token or a one-match attested credential. Signature verification is
// deliberately supplied by the adapter: the domain must not depend on a JWT
// library or trust claims before the secure boundary has verified them.
type WorkloadCredential struct {
	Issuer        string
	Audience      string
	IssuedAt      time.Time
	ExpiresAt     time.Time
	Namespace     string
	ServiceAcct   string
	PodUID        string
	GameServerUID string
	AllocationID  string
	MatchID       string
	ServerID      string
	Signature     []byte
}

// WorkloadCredentialPolicy defines the exact one-allocation identity a result
// credential must carry. It is intentionally immutable after construction.
type WorkloadCredentialPolicy struct {
	expected WorkloadBinding
	verify   func(WorkloadCredential) bool
}

var ErrWorkloadCredential = fmt.Errorf("workload credential rejected")

func NewWorkloadCredentialPolicy(expected WorkloadBinding, verify func(WorkloadCredential) bool) (*WorkloadCredentialPolicy, error) {
	if err := validateBinding(expected); err != nil || verify == nil {
		return nil, ErrWorkloadCredential
	}
	return &WorkloadCredentialPolicy{expected: expected, verify: verify}, nil
}

// Validate returns the binding only after every claim has matched the
// allocation and the adapter has accepted the credential's signature.
func (p *WorkloadCredentialPolicy) Validate(credential WorkloadCredential, now time.Time) (WorkloadBinding, error) {
	if p == nil || len(credential.Signature) == 0 || p.verify == nil || !p.verify(credential) {
		return WorkloadBinding{}, ErrWorkloadCredential
	}
	if credential.Issuer != p.expected.Issuer || credential.Audience != p.expected.Audience ||
		credential.Namespace != p.expected.Namespace || credential.ServiceAcct != p.expected.ServiceAcct ||
		credential.PodUID != p.expected.PodUID || credential.GameServerUID != p.expected.GameServerUID ||
		credential.AllocationID != p.expected.AllocationID || credential.MatchID != p.expected.MatchID ||
		credential.ServerID != p.expected.ServerID || credential.IssuedAt.IsZero() || credential.ExpiresAt.IsZero() ||
		!credential.IssuedAt.Before(credential.ExpiresAt) || now.Before(credential.IssuedAt) || !now.Before(credential.ExpiresAt) {
		return WorkloadBinding{}, ErrWorkloadCredential
	}
	return p.expected, nil
}