class Google::Auth::UserAuthorizer

def get_and_store_credentials_from_code(options = {})
  credentials = get_credentials_from_code(options)
  monitor_credentials(options[:user_id], credentials)
  store_credentials(options[:user_id], credentials)
end

def get_authorization_url(options = {})
  scope = options[:scope] || @scope
  credentials = UserRefreshCredentials.new(
    client_id: @client_id.id,
    client_secret: @client_id.secret,
    scope: scope
  )
  redirect_uri = redirect_uri_for(options[:base_url])
  url = credentials.authorization_uri(access_type: 'offline',
                                      redirect_uri: redirect_uri,
                                      approval_prompt: 'force',
                                      state: options[:state],
                                      include_granted_scopes: true,
                                      login_hint: options[:login_hint])
  url.to_s
end

def get_credentials(user_id, scope = nil)
  saved_token = stored_token(user_id)
  return nil if saved_token.nil?
  data = MultiJson.load(saved_token)
  if data.fetch('client_id', @client_id.id) != @client_id.id
    raise sprintf(MISMATCHED_CLIENT_ID_ERROR,
                  data['client_id'], @client_id.id)
  end
  credentials = UserRefreshCredentials.new(
    client_id: @client_id.id,
    client_secret: @client_id.secret,
    scope: data['scope'] || @scope,
    access_token: data['access_token'],
    refresh_token: data['refresh_token'],
    expires_at: data.fetch('expiration_time_millis', 0) / 1000
  )
  scope ||= @scope
  if credentials.includes_scope?(scope)
    return monitor_credentials(user_id, credentials)
  end
  nil
end

def get_credentials_from_code(options = {})
  user_id = options[:user_id]
  code = options[:code]
  scope = options[:scope] || @scope
  base_url = options[:base_url]
  credentials = UserRefreshCredentials.new(
    client_id: @client_id.id,
    client_secret: @client_id.secret,
    redirect_uri: redirect_uri_for(base_url),
    scope: scope
  )
  credentials.code = code
  credentials.fetch_access_token!({})
  monitor_credentials(user_id, credentials)
end

def initialize(client_id, scope, token_store, callback_uri = nil)
  raise NIL_CLIENT_ID_ERROR if client_id.nil?
  raise NIL_SCOPE_ERROR if scope.nil?
  @client_id = client_id
  @scope = Array(scope)
  @token_store = token_store
  @callback_uri = callback_uri || '/oauth2callback'
end

def monitor_credentials(user_id, credentials)
  credentials.on_refresh do |cred|
    store_credentials(user_id, cred)
  end
  credentials
end

def redirect_uri_for(base_url)
  return @callback_uri unless URI(@callback_uri).scheme.nil?
  if base_url.nil? || URI(base_url).scheme.nil?
    raise sprintf(ISSING_ABSOLUTE_URL_ERROR, @callback_uri)
  end
  URI.join(base_url, @callback_uri).to_s
end

def revoke_authorization(user_id)
  credentials = get_credentials(user_id)
  if credentials
    begin
      @token_store.delete(user_id)
    ensure
      credentials.revoke!
    end
  end
  nil
end

def store_credentials(user_id, credentials)
  json = MultiJson.dump(
    client_id: credentials.client_id,
    access_token: credentials.access_token,
    refresh_token: credentials.refresh_token,
    scope: credentials.scope,
    expiration_time_millis: credentials.expires_at.to_i * 1000
  )
  @token_store.store(user_id, json)
  credentials
end

def stored_token(user_id)
  raise NIL_USER_ID_ERROR if user_id.nil?
  raise NIL_TOKEN_STORE_ERROR if @token_store.nil?
  @token_store.load(user_id)
end