module Doorkeeper::AccessTokenMixin::ClassMethods

def authorized_tokens_for(application_id, resource_owner_id)
  where(application_id: application_id,
        resource_owner_id: resource_owner_id,
        revoked_at: nil)
end

def by_refresh_token(refresh_token)
  find_by_plaintext_token(:refresh_token, refresh_token)
end

def by_token(token)
  find_by_plaintext_token(:token, token)
end

def fallback_secret_strategy
  ::Doorkeeper.configuration.token_secret_fallback_strategy
end

def find_access_token_in_batches(relation, *args, &block)
  relation.find_in_batches(*args, &block)
end

def find_matching_token(relation, application, scopes)
  return nil unless relation
  matching_tokens = []
  batch_size = Doorkeeper.configuration.token_lookup_batch_size
  find_access_token_in_batches(relation, batch_size: batch_size) do |batch|
    tokens = batch.select do |token|
      scopes_match?(token.scopes, scopes, application.try(:scopes))
    end
    matching_tokens.concat(tokens)
  end
  matching_tokens.max_by(&:created_at)
end

def find_or_create_for(application, resource_owner_id, scopes, expires_in, use_refresh_token)
  if Doorkeeper.configuration.reuse_access_token
    access_token = matching_token_for(application, resource_owner_id, scopes)
    return access_token if access_token&.reusable?
  end
  create!(
    application_id: application.try(:id),
    resource_owner_id: resource_owner_id,
    scopes: scopes.to_s,
    expires_in: expires_in,
    use_refresh_token: use_refresh_token
  )
end

def last_authorized_token_for(application_id, resource_owner_id)
  authorized_tokens_for(application_id, resource_owner_id)
    .ordered_by(:created_at, :desc).first
end

def matching_token_for(application, resource_owner_or_id, scopes)
  resource_owner_id = if resource_owner_or_id.respond_to?(:to_key)
                        resource_owner_or_id.id
                      else
                        resource_owner_or_id
                      end
  tokens = authorized_tokens_for(application.try(:id), resource_owner_id)
  find_matching_token(tokens, application, scopes)
end

def revoke_all_for(application_id, resource_owner, clock = Time)
  where(application_id: application_id,
        resource_owner_id: resource_owner.id,
        revoked_at: nil)
    .update_all(revoked_at: clock.now.utc)
end

def scopes_match?(token_scopes, param_scopes, app_scopes)
  return true if token_scopes.empty? && param_scopes.empty?
  (token_scopes.sort == param_scopes.sort) &&
    Doorkeeper::OAuth::Helpers::ScopeChecker.valid?(
      scope_str: param_scopes.to_s,
      server_scopes: Doorkeeper.configuration.scopes,
      app_scopes: app_scopes
    )
end

def secret_strategy
  ::Doorkeeper.configuration.token_secret_strategy
end