class Google::Auth::WebUserAuthorizer

def self.extract_callback_state request
  state = MultiJson.load(request.params[STATE_PARAM] || "{}")
  redirect_uri = state[CURRENT_URI_KEY]
  callback_state = {
    AUTH_CODE_KEY  => request.params[AUTH_CODE_KEY],
    ERROR_CODE_KEY => request.params[ERROR_CODE_KEY],
    SESSION_ID_KEY => state[SESSION_ID_KEY],
    SCOPE_KEY      => request.params[SCOPE_KEY]
  }
  [callback_state, redirect_uri]
end

def self.handle_auth_callback_deferred request
  callback_state, redirect_uri = extract_callback_state request
  request.session[CALLBACK_STATE_KEY] = MultiJson.dump callback_state
  redirect_uri
end

def self.principal
  :web_user_authorization
end

def self.validate_callback_state state, request
  if state[AUTH_CODE_KEY].nil?
    raise AuthorizationError.with_details(
      MISSING_AUTH_CODE_ERROR,
      credential_type_name: name,
      principal: principal
    )
  end
  if state[ERROR_CODE_KEY]
    raise AuthorizationError.with_details(
      format(AUTHORIZATION_ERROR, state[ERROR_CODE_KEY]),
      credential_type_name: name,
      principal: principal
    )
  elsif request.session[XSRF_KEY] != state[SESSION_ID_KEY]
    raise AuthorizationError.with_details(
      INVALID_STATE_TOKEN_ERROR,
      credential_type_name: name,
      principal: principal
    )
  end
end

def get_authorization_url options = {}
  options = options.dup
  request = options[:request]
  raise InitializationError, NIL_REQUEST_ERROR if request.nil?
  raise InitializationError, NIL_SESSION_ERROR if request.session.nil?
  state = options[:state] || {}
  redirect_to = options[:redirect_to] || request.url
  request.session[XSRF_KEY] = SecureRandom.base64
  options[:state] = MultiJson.dump(state.merge(
                                     SESSION_ID_KEY  => request.session[XSRF_KEY],
                                     CURRENT_URI_KEY => redirect_to
                                   ))
  options[:base_url] = request.url
  super options
end

def get_credentials user_id, request = nil, scope = nil
  if request&.session&.key? CALLBACK_STATE_KEY
    # Note - in theory, no need to check required scope as this is
    # expected to be called immediately after a return from authorization
    state_json = request.session.delete CALLBACK_STATE_KEY
    callback_state = MultiJson.load state_json
    WebUserAuthorizer.validate_callback_state callback_state, request
    get_and_store_credentials_from_code(
      user_id:  user_id,
      code:     callback_state[AUTH_CODE_KEY],
      scope:    callback_state[SCOPE_KEY],
      base_url: request.url
    )
  else
    super user_id, scope
  end
end

def handle_auth_callback user_id, request
  callback_state, redirect_uri = WebUserAuthorizer.extract_callback_state(
    request
  )
  WebUserAuthorizer.validate_callback_state callback_state, request
  credentials = get_and_store_credentials_from_code(
    user_id:  user_id,
    code:     callback_state[AUTH_CODE_KEY],
    scope:    callback_state[SCOPE_KEY],
    base_url: request.url
  )
  [credentials, redirect_uri]
end

def initialize client_id, scope, token_store,
               legacy_callback_uri = nil,
               callback_uri: nil,
               code_verifier: nil
  super client_id, scope, token_store,
        legacy_callback_uri,
        code_verifier: code_verifier,
        callback_uri: callback_uri
end